Model an Agentic Architecture

Watch · 6:56Threat modeling of agentic architectures

A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.

The first eight lessons take about three hours. Lessons 9 to 11 each take about as long as one of those. Each lesson teaches one idea.

Who this training is for

Security architects and analysts who model AI agents, copilots and their tools on the Dethernety platform. You should be able to draw a model: add elements and boundaries, draw flows, pick classes and set attributes.

You do not need to know Threat Patterns yet. The training shows you what to look at after each step. For a full description of the screens, read the Threat Patterns user guide.

What you learn

Threat Patterns decides only from what your model says. Most of the facts it needs are in the drawing: which element is the agent, which data moves where, who is outside. The rest are a few attributes on the agent. The training teaches a fixed order for stating those facts, called the recipe, and what each fact changes in the analysis.

The training also teaches when to stop. A fact you do not know stays unanswered, and the analysis asks for it. A guessed answer can make a finding disappear for good, with nothing on screen to show it was a guess.

Before you start

You need:

• Platform 0.13.0 or later.
• Threat Patterns 0.1.5 or later. Earlier versions do not name the credited legs in a finding's state, as in Confirmed · control modelled on U, X, or the form section beside an attribute in a question. Lesson 9's exercise The sandbox and lesson 10's exercise Writes left open need 0.1.6 or later, because earlier versions do not read those answers. The lessons' results were checked with Threat Patterns 0.1.6 and its agentic pattern pack 0.1.6.
• The agentic class modules and the Threat Patterns analysis with the agentic pattern pack, installed on your platform. If Threat Patterns is not in the New Analysis list, or it says no pattern pack is installed, contact your administrator.
• Permission to create and import models and to run analyses.
• Optional: the AWS class modules AWS Compute & Containers (aws-compute-containers) and AWS Identity & Cryptography (aws-identity-cryptography), for lesson 9's two cloud exercises only. Every other lesson and exercise works without them.

Lessons 7 to 11, whose results depend on controls you create on the platform, were last checked on platform 0.11.1, and three of their exercises on 0.12.1.

The Browser's plus button

You create models and controls, and import models, from the + button at the top right of the Browser's content area. Its tooltip reads Create or import. Click it and three round icons open below it. Each icon names itself in a tooltip:

The model and control icons save the new item as soon as you click them: there is nothing to cancel.

Building your first model shows the same speed dial for a new model.

Import a lesson model

Every lesson after the first starts from a model you can import. Get the ZIP from Downloads, then:

1. Open the Browser and select the folder for the model.
2. Click the + button at the top right of the content area, then Import model. The Import Model dialog opens.
3. Click Select File and choose the ZIP. The Model name field fills in with the name stored in the ZIP, for example "Support copilot (training): lesson 1 solution".
4. Change Model name if you want another name.
5. Click the import icon at the bottom of the dialog. Its tooltip reads Import. It stays greyed out until you choose a file, and while Model name is empty. A progress bar shows each step, then a success message.

The model appears in the folder under the name in Model name. If the folder already holds a model of that name, the dialog gives the import a different name, and a hint under the field says so. You can change that name too.

Run Threat Patterns on a lesson model

An imported model is a new model, so it has no analysis yet:

1. Open the model.
2. Click the Analyses icon (sparkles) on the canvas toolbar. A dialog headed Analysis: and the model's name opens. Click New Analysis and choose Threat Patterns.
3. A row named Threat Patterns appears. Click its View results button, then click Generate.

The first time you open an analysis's results, Loading analysis view… can show briefly. If the page says This analysis view is unavailable right now. Try again shortly., click Retry.

The results open on the Sheet tab. The lessons read the Findings and Facts to establish tabs. To open the analysis again later, click the Analyses icon on the canvas toolbar, then View results on its row.

When you change the model later, the analysis shows the banner The model or Threat Patterns changed since this run. Generate again to read the current model. Click Generate again. Nothing changes until you do.

If a notice above the report reads Pattern pack … needs the Threat Patterns engine … or later; …, the engine skipped that pack, and the lesson's findings from it are missing. Ask your administrator to upgrade the Threat Patterns engine module, then click Generate again; see Troubleshooting.

Each question carries one button: Answer it, Draw it or Ask the owner. Answer it and Draw it open a dialog whose Open the model button opens the model editor; the dialog writes nothing. Ask the owner opens a dialog that only says whom to ask. A button is not a reason to act: answer only what the owner confirmed, and draw only what exists. The Facts to establish list and the to settle: lines of an expanded finding name an attribute by its title, with its key and the form section it sits in beside it, as in Consequential Tools Present (consequential_tools_present, in Human Oversight); the dialogs give the key alone. A leg whose question names no attribute shows none on its to settle: line or in its dialog; lesson 5 has one.

See Run the analysis in the Threat Patterns guide for more.

Zone names in the editor

The lessons name each zone as the boundary's pill on the diagram shows it, with the label from the Trust zone list in brackets, for example "Untrusted (Open internet)". You set a boundary's zone on its Zoning tab, under Trust zone:

Yes/no fields

An attribute that takes yes or no shows three buttons: Yes, No and Not answered. A field nobody answered shows Not answered. Choosing Not answered takes an answer back: when you save, the field is unanswered again. Where a lesson sets a field to true, choose Yes; where it sets false, choose No.

So answer only the fields a lesson names, and only with what someone confirmed. If you answer one by mistake, choose Not answered and save. The Attributes tab keeps your changes until you click the save icon on the right of the panel. The icon has no label.

The worked system

A fictional company runs a support copilot: an AI agent that answers customer tickets.

• Customers write tickets on the internet. The ticket system receives them and e-mails replies back to the customer.
• The support copilot reads each new ticket, looks the customer up in a CRM that a vendor hosts, drafts a reply and posts it to the ticket.
• Support staff read the copilot's answers in a staff console.
• The copilot reasons with a hosted model from a model provider.
• In lesson 4 the copilot gains a web-fetch tool that can open any web page.
• In lesson 8 a second agent, the ticket summariser, joins. It summarises each ticket with the customer's history for the staff console.
• In lesson 9 the copilot gains a code tool.
• In lesson 10 the copilot gains a knowledge base, filled from resolved tickets, and a memory of each customer.
• In lesson 11 the copilot hands refunds to a third agent, the Refund agent, which issues them through the payment provider's MCP server.

All names are fictional. Every lesson's numbered instructions name the exact elements, classes and values to use.

How each lesson works

Each lesson has the same parts:

1. Goal: the one idea the lesson teaches.
2. What you start from: the model to import, or your own model from the lesson before.
3. The recipe step: the step of the recipe the lesson teaches.
4. Steps: what to draw or set, one change at a time.
5. What you should see: what Threat Patterns shows after you click Generate again.
6. What changed and why.
7. Exercise: a small change that shows the idea from another side.

If you did the previous lesson, keep working in your own model. If you skipped it, or your model drifted, import the previous lesson's solution and continue from there.

What you should see lists systemic findings only. Each lesson quotes the systemic findings, the questions on Facts to establish and the model gaps. Your screen also shows element exposures: a second count line in the header, an Element exposures group at the end of the Findings list, and an N exposures inside chip on a finding. Your element classes raise those, and this training does not cover them. To see the list as the lessons show it, set the Scope filter on the Findings tab to systemic.

Reading a Findings row. A row shows a severity chip, the finding, one dot per leg and the finding's state, for example Confirmed · control modelled on U, X. The dots read ● present, ◐ undetermined, ○ absent, with the required legs first and the aggravating legs last. Under a Not ruled out finding's chip, if confirmed means the severity it has once confirmed. It is not a lower risk.

The result screens offer more than the lessons use: you can record a finding as an issue or a risk with ＋ Issue and ＋ Risk, affirm or disposition an exposure with Affirm and Disposition…, and read an exposure's map and severity chips in its dialogs: see Raise an issue, Record a finding or an exposure as a risk, Affirm or disposition an exposure and Dialogs in the Threat Patterns guide.

Do the exercises on a scratch copy. Each exercise changes the model in a way the next lesson does not want. Import the ZIP the exercise names as a second model, and give it a name of its own in the Model name field as you import it, so you can tell it from your own model in the Browser. You can also rename it after the import: click the Model settings icon on its card, change Name on the General tab, and save. Do the exercise there, and delete the copy when you are done. An exercise that builds on the one before says so, and continues on that copy.

Lessons

Rules that hold throughout

These rules apply in every lesson. Each one is taught where it first matters.

• An unanswered fact stays unknown. It is never read as "no".
• A guess can remove a finding for good: one absent required leg means no finding.
• An element with no zone on any boundary around it reads as Internal. It is the one fact with a default, so give every outside party a zone.
• A drawn flow beats an egress attribute: answering "egress restricted" while a drawn flow still reaches an outsider keeps the way out, with a conflict note.
• A vendor destination is a question, not an answer: can an untrusted party read what reaches it?
• Origin "Not assessed" is an answer and counts as untrusted; an empty origin is not an answer.
• A Context Ingress whose source is in an Untrusted zone, or is an Untrusted Content Source or a Public AI Artifact Hub, makes its content untrusted even with no item drawn on it.
• A control never removes a finding. It credits a route: "control modelled", or "detected only" for detection.
• Assert outbound flows complete is an answer, not a shortcut: it settles an element's ways out as absent. Use it only when someone who knows confirms every outbound flow is drawn.
• A new tool, channel or hand-off reopens the answers it touches: ask again before you keep an approval or a control answer given before it existed.
• Assert not a hand-off is an answer too: use it only when someone who knows confirms that the flow hands no work on and the receiving agent's model never reads what it carries.

Two of them deserve a sentence more:

• Not ruled out is not a lower grade of risk. It means some legs of the finding are present and the model does not say enough to decide the rest. The Findings list still ranks Confirmed before Not ruled out, because Confirmed is more certain. Do not read the order as risk: give each open question of a Not ruled out finding an owner and a date (lesson 8).
• A control never removes a finding. It changes how the finding's coverage reads. Only a changed fact can make a required leg absent.

What this training does not cover

The worked system teaches the recipe on a few agents and their tools. These threats are real, but no lesson covers them:

• Poisoning a knowledge base or a memory by writing to it directly. Lesson 10 covers only what gets in through the pipeline that fills the knowledge base and through the agent's own memory.
• Poisoned MCP tool descriptions as an attack of their own (lesson 11 asks only who writes what a tool server sends), and malicious packages.
• Relays through a store that one agent writes and another reads.
• Injection through attachments, images and hidden text.
• People who act on what an agent tells them.
• What the hosted model provider keeps of your prompts and outputs.

Downloads

The model files sit beside these pages: each link below downloads one. Each lesson after the first starts from the previous lesson's solution. Lesson 8 has its own starting model, which adds the second agent. Each exercise names the file it starts from, or the exercise it continues from.

The recipe on one page

• The recipe at a glance: every step and rule on one page, for when you model your own system.

Related guides

• Threat Patterns user guide: how to read findings, fixes and Facts to establish.
• Modelling checklist: the facts the analysis asks for most often, and which leg each one settles.