[{"data":1,"prerenderedAt":1639},["ShallowReactive",2],{"page-\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do":3,"navigation":1317},{"id":4,"title":5,"body":6,"description":1309,"extension":1310,"meta":1311,"navigation":1312,"path":1313,"seo":1314,"stem":1315,"__hash__":1316},"docs\u002F07.agentic-modelling\u002F05.05-state-what-the-agent-can-do.md","Lesson 5: State What the Agent Can Do",{"type":7,"value":8,"toc":1294},"minimark",[9,13,31,36,39,42,46,54,58,63,66,73,78,100,106,863,960,963,974,977,980,984,998,1001,1021,1041,1052,1090,1093,1097,1103,1145,1151,1154,1159,1165,1180,1184,1190,1210,1213,1219,1225,1235,1265,1271,1277,1281,1284,1288],[10,11,5],"h1",{"id":12},"lesson-5-state-what-the-agent-can-do",[14,15,16,21,22,26,27],"p",{},[17,18,20],"a",{"href":19},"\u002Fagentic-modelling","Training overview"," · Lesson 5 of 11 · Previous: ",[17,23,25],{"href":24},"\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","Draw a tool that reaches any host"," · Next: ",[17,28,30],{"href":29},"\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","Fix a finding with a fact",[32,33,35],"h2",{"id":34},"goal","Goal",[14,37,38],{},"Some facts about an agent cannot be drawn. You state them as attributes on the agent.",[14,40,41],{},"After this lesson you know which questions to ask the team that runs an agent, and how their answers decide whether the agent can act on what it reads.",[32,43,45],{"id":44},"what-you-start-from","What you start from",[14,47,48,49,53],{},"Your model from lesson 4, or import ",[17,50,52],{"href":51},"\u002Fguides\u002Fagentic-modelling\u002FL4-solution.zip","L4-solution.zip",".",[32,55,57],{"id":56},"the-recipe-step","The recipe step",[59,60,62],"h3",{"id":61},"step-5-state-what-the-agent-can-do","Step 5: State what the agent can do",[14,64,65],{},"Answer the element facts the drawing cannot show: what the agent's tools can do and whether they need approval, the harness approval mode, egress restrictions, and who can write to each store. A yes-or-no field offers Yes, No and Not answered; it starts at Not answered, and choosing Not answered takes an answer back.",[14,67,68,72],{},[69,70,71],"strong",{},"Why:"," Whether an agent can act on what it reads, and whether anything stops it, is not visible in a drawing.",[14,74,75],{},[69,76,77],{},"Ask:",[79,80,81,85,88,91,94,97],"ul",{},[82,83,84],"li",{},"Can the agent's tools change anything outside the conversation: send, post, update, delete, pay?",[82,86,87],{},"Does every such action need a person's approval?",[82,89,90],{},"Can the agent run code?",[82,92,93],{},"Is the agent's network egress limited to an allowlist?",[82,95,96],{},"Are the agent's tool credentials limited to the user it acts for?",[82,98,99],{},"Does the chat frontend render images or links in model output?",[14,101,102,105],{},[69,103,104],{},"Looks safe"," is the answer a guess would pick. Write it only when someone who knows has said so.",[107,108,114],"div",{"className":109,"tabIndex":111,"role":112,"ariaLabel":113},[110],"table-frame",0,"region","Table: Step 5: State what the agent can do",[115,116,117,135],"table",{},[118,119,120],"thead",{},[121,122,123,127,130,132],"tr",{},[124,125,126],"th",{},"On",[124,128,129],{},"Field",[124,131,104],{},[124,133,134],{},"What it decides",[136,137,138,163,183,200,219,239,259,279,299,319,338,355,375,399,429,448,468,486,504,523,544,563,581,601,619,640,658,676,694,713,733,752,772,790,809,827,845],"tbody",{},[121,139,140,144,155,160],{},[141,142,143],"td",{},"Agent Service",[141,145,146,149,150,154],{},[69,147,148],{},"Consequential Tools Present"," (",[151,152,153],"code",{},"consequential_tools_present",", under Human Oversight)",[141,156,157],{},[151,158,159],{},"false",[141,161,162],{},"Whether the agent can act at all; whether it holds tools that act",[121,164,165,167,175,180],{},[141,166,143],{},[141,168,169,149,172,154],{},[69,170,171],{},"All Consequential Action Paths Require Approval",[151,173,174],{},"consequential_tools_all_require_approval",[141,176,177],{},[151,178,179],{},"true",[141,181,182],{},"Whether its actions wait for a person",[121,184,185,187,195,198],{},[141,186,143],{},[141,188,189,149,192,154],{},[69,190,191],{},"Approval Gate Present",[151,193,194],{},"approval_gate_present",[141,196,197],{},"—",[141,199,182],{},[121,201,202,205,213,217],{},[141,203,204],{},"Agent Chat Frontend",[141,206,207,149,210,212],{},[69,208,209],{},"All Consequential Actions Require Blocking In-Chat Approval",[151,211,174],{},", under Authorization & RBAC)",[141,214,215],{},[151,216,179],{},[141,218,182],{},[121,220,221,224,232,237],{},[141,222,223],{},"Untrusted Content Source",[141,225,226,149,229,212],{},[69,227,228],{},"Human Approval for High-Risk Actions",[151,230,231],{},"human_approval_for_high_risk_actions",[141,233,234],{},[151,235,236],{},"required",[141,238,182],{},[121,240,241,244,253,257],{},[141,242,243],{},"Agent Code Execution Sandbox",[141,245,246,149,249,252],{},[69,247,248],{},"Consequential Computer-Use Actions Confirmed",[151,250,251],{},"computer_use_consequential_actions_confirmed",", under Computer Use)",[141,254,255],{},[151,256,179],{},[141,258,182],{},[121,260,261,263,272,276],{},[141,262,143],{},[141,264,265,149,268,271],{},[69,266,267],{},"Code Execution Tools Present",[151,269,270],{},"code_execution_tools_present",", under Application Security)",[141,273,274],{},[151,275,159],{},[141,277,278],{},"Whether it can run code; whether it holds tools that act",[121,280,281,284,292,296],{},[141,282,283],{},"Local MCP Server, Remote MCP Server",[141,285,286,149,289,212],{},[69,287,288],{},"Destructive Tools Exposed",[151,290,291],{},"destructive_tools_exposed",[141,293,294],{},[151,295,159],{},[141,297,298],{},"Whether it holds tools that act",[121,300,301,303,312,316],{},[141,302,143],{},[141,304,305,149,308,311],{},[69,306,307],{},"Network Egress Default-Deny Allowlist",[151,309,310],{},"network_egress_default_deny_allowlist",", under Network & Connectivity)",[141,313,314],{},[151,315,179],{},[141,317,318],{},"Whether a way out is closed",[121,320,321,324,332,336],{},[141,322,323],{},"Agent Tool Call",[141,325,326,149,329,311],{},[69,327,328],{},"Agent Egress Restricted",[151,330,331],{},"agent_egress_restricted",[141,333,334],{},[151,335,179],{},[141,337,318],{},[121,339,340,343,349,353],{},[141,341,342],{},"Agent Harness",[141,344,345,149,347,311],{},[69,346,307],{},[151,348,310],{},[141,350,351],{},[151,352,179],{},[141,354,318],{},[121,356,357,360,369,373],{},[141,358,359],{},"Local MCP Server",[141,361,362,149,365,368],{},[69,363,364],{},"Server Network Egress Restricted",[151,366,367],{},"server_network_egress_restricted",", under Data Handling & Residency)",[141,370,371],{},[151,372,179],{},[141,374,318],{},[121,376,377,379,388,397],{},[141,378,204],{},[141,380,381,149,384,387],{},[69,382,383],{},"Markdown Image Rendering Policy",[151,385,386],{},"markdown_image_rendering_policy",", under Output Rendering Exfiltration)",[141,389,390,393,394],{},[151,391,392],{},"disabled",", ",[151,395,396],{},"allowlisted_trusted_domains_only",[141,398,318],{},[121,400,401,403,411,426],{},[141,402,342],{},[141,404,405,149,408,212],{},[69,406,407],{},"Harness Approval Mode",[151,409,410],{},"harness_approval_mode",[141,412,413,393,416,149,419,393,422,425],{},[151,414,415],{},"default",[151,417,418],{},"plan",[151,420,421],{},"on-request",[151,423,424],{},"granular",": the agents' own approval answers decide)",[141,427,428],{},"How the harness approves actions",[121,430,431,433,441,445],{},[141,432,342],{},[141,434,435,149,438,212],{},[69,436,437],{},"All-Approvals-Off Launch Flags in Use",[151,439,440],{},"dangerously_skip_permissions_in_use",[141,442,443],{},[151,444,159],{},[141,446,447],{},"A switch that skips approval whatever the mode",[121,449,450,453,461,465],{},[141,451,452],{},"Context Ingress",[141,454,455,149,458,212],{},[69,456,457],{},"Human Approval for Actions After Untrusted Ingress",[151,459,460],{},"human_approval_for_actions_after_untrusted_ingress",[141,462,463],{},[151,464,179],{},[141,466,467],{},"Whether a path into an action waits for a person",[121,469,470,472,480,484],{},[141,471,452],{},[141,473,474,149,477,212],{},[69,475,476],{},"Untrusted Ingress Can Trigger Consequential Actions",[151,478,479],{},"untrusted_ingress_can_trigger_consequential_actions",[141,481,482],{},[151,483,159],{},[141,485,467],{},[121,487,488,490,498,502],{},[141,489,323],{},[141,491,492,149,495,212],{},[69,493,494],{},"Human Approval for Sensitive Tool Calls",[151,496,497],{},"human_approval_for_sensitive_tool_calls",[141,499,500],{},[151,501,179],{},[141,503,467],{},[121,505,506,508,516,520],{},[141,507,143],{},[141,509,510,149,513,212],{},[69,511,512],{},"Tool Credentials Least Privilege in User Context",[151,514,515],{},"tool_credentials_least_privilege_user_context",[141,517,518],{},[151,519,179],{},[141,521,522],{},"Whether the agent's tool credentials are limited to the user it acts for",[121,524,525,528,537,541],{},[141,526,527],{},"Vector Database",[141,529,530,149,533,536],{},[69,531,532],{},"Authentication Required for Every Request",[151,534,535],{},"authentication_required",", under Authentication & Access)",[141,538,539],{},[151,540,179],{},[141,542,543],{},"Who can write to a store the agent reads",[121,545,546,548,557,561],{},[141,547,527],{},[141,549,550,149,553,556],{},[69,551,552],{},"Writes Restricted to Ingestion Pipeline",[151,554,555],{},"index_write_restricted_to_pipeline",", under Data Integrity)",[141,558,559],{},[151,560,179],{},[141,562,543],{},[121,564,565,567,575,579],{},[141,566,527],{},[141,568,569,149,572,311],{},[69,570,571],{},"API Not Publicly Reachable",[151,573,574],{},"not_publicly_reachable",[141,576,577],{},[151,578,179],{},[141,580,543],{},[121,582,583,586,595,599],{},[141,584,585],{},"Agent Memory Service",[141,587,588,149,591,594],{},[69,589,590],{},"Memory Writes Gated From Untrusted Content",[151,592,593],{},"memory_write_gated_from_untrusted_content",", under Memory Integrity)",[141,596,597],{},[151,598,179],{},[141,600,543],{},[121,602,603,605,613,617],{},[141,604,585],{},[141,606,607,149,610,536],{},[69,608,609],{},"Memory Endpoints Require Authentication",[151,611,612],{},"memory_endpoints_require_authentication",[141,614,615],{},[151,616,179],{},[141,618,543],{},[121,620,621,624,633,637],{},[141,622,623],{},"Agent Credential",[141,625,626,149,629,632],{},[69,627,628],{},"Credential Expiry Enforced",[151,630,631],{},"credential_expiry_enforced",", under Secrets & Credentials)",[141,634,635],{},[151,636,179],{},[141,638,639],{},"How strong a credential is",[121,641,642,644,652,656],{},[141,643,623],{},[141,645,646,149,649,632],{},[69,647,648],{},"Key Rotation Enabled",[151,650,651],{},"key_rotation_enabled",[141,653,654],{},[151,655,179],{},[141,657,639],{},[121,659,660,662,670,674],{},[141,661,623],{},[141,663,664,149,667,212],{},[69,665,666],{},"Resource Scope Restricted",[151,668,669],{},"resource_scope_restricted",[141,671,672],{},[151,673,179],{},[141,675,639],{},[121,677,678,680,688,692],{},[141,679,623],{},[141,681,682,149,685,212],{},[69,683,684],{},"Permission Scope Minimized",[151,686,687],{},"permission_scope_minimized",[141,689,690],{},[151,691,179],{},[141,693,639],{},[121,695,696,698,706,710],{},[141,697,323],{},[141,699,700,149,703,212],{},[69,701,702],{},"Handoff Permission Mode Not Widened",[151,704,705],{},"handoff_permission_mode_not_widened",[141,707,708],{},[151,709,179],{},[141,711,712],{},"Whether a hand-off widens the permissions",[121,714,715,718,726,730],{},[141,716,717],{},"Agent Server",[141,719,720,149,723,632],{},[69,721,722],{},"Server Secrets Readable by Tool Code",[151,724,725],{},"server_secrets_readable_by_tool_code",[141,727,728],{},[151,729,159],{},[141,731,732],{},"Whether tool code can read the server's secrets",[121,734,735,737,745,749],{},[141,736,717],{},[141,738,739,149,742,536],{},[69,740,741],{},"Runtime API Authentication Enforced",[151,743,744],{},"api_authentication_enforced",[141,746,747],{},[151,748,179],{},[141,750,751],{},"How an outsider gets a first foothold",[121,753,754,757,766,770],{},[141,755,756],{},"Langflow",[141,758,759,149,762,765],{},[69,760,761],{},"Custom Components Allowed",[151,763,764],{},"allow_custom_components",", under Code Execution)",[141,767,768],{},[151,769,159],{},[141,771,751],{},[121,773,774,776,784,788],{},[141,775,756],{},[141,777,778,149,781,536],{},[69,779,780],{},"Auto-Login Enabled",[151,782,783],{},"langflow_auto_login",[141,785,786],{},[151,787,159],{},[141,789,751],{},[121,791,792,794,803,807],{},[141,793,359],{},[141,795,796,149,799,802],{},[69,797,798],{},"Launcher Package Version Pinned",[151,800,801],{},"launcher_package_version_pinned",", under Supply Chain Integrity)",[141,804,805],{},[151,806,179],{},[141,808,751],{},[121,810,811,813,821,825],{},[141,812,359],{},[141,814,815,149,818,802],{},[69,816,817],{},"Server Package Provenance Vetted",[151,819,820],{},"server_package_provenance_vetted",[141,822,823],{},[151,824,179],{},[141,826,751],{},[121,828,829,831,839,843],{},[141,830,359],{},[141,832,833,149,836,271],{},[69,834,835],{},"mcp-remote Bridge Used",[151,837,838],{},"mcp_remote_bridge_used",[141,840,841],{},[151,842,159],{},[141,844,751],{},[121,846,847,849,857,861],{},[141,848,359],{},[141,850,851,149,854,271],{},[69,852,853],{},"mcp-remote Version Patched",[151,855,856],{},"mcp_remote_version_patched",[141,858,859],{},[151,860,179],{},[141,862,751],{},[107,864,866],{"className":865,"tabIndex":111,"role":112,"ariaLabel":113},[110],[115,867,868,878],{},[118,869,870],{},[121,871,872,875],{},[124,873,874],{},"Harness approval mode",[124,876,877],{},"The agent it runs",[136,879,880,889,897,907,916,925,934,943,952],{},[121,881,882,886],{},[141,883,884],{},[151,885,415],{},[141,887,888],{},"waits for approval",[121,890,891,895],{},[141,892,893],{},[151,894,418],{},[141,896,888],{},[121,898,899,904],{},[141,900,901],{},[151,902,903],{},"acceptEdits",[141,905,906],{},"acts without approval",[121,908,909,914],{},[141,910,911],{},[151,912,913],{},"auto",[141,915,906],{},[121,917,918,923],{},[141,919,920],{},[151,921,922],{},"dontAsk",[141,924,906],{},[121,926,927,932],{},[141,928,929],{},[151,930,931],{},"bypassPermissions",[141,933,906],{},[121,935,936,941],{},[141,937,938],{},[151,939,940],{},"never",[141,942,906],{},[121,944,945,949],{},[141,946,947],{},[151,948,421],{},[141,950,951],{},"does not decide: also answer the agent's own approval facts",[121,953,954,958],{},[141,955,956],{},[151,957,424],{},[141,959,951],{},[14,961,962],{},"You ask the team that runs the copilot. They tell you:",[79,964,965,968,971],{},[82,966,967],{},"The copilot posts replies and updates tickets. Those actions change something outside the conversation.",[82,969,970],{},"Nobody approves them: the copilot posts on its own.",[82,972,973],{},"The copilot runs no code.",[14,975,976],{},"The code fact matters even for an agent without consequential tools: an agent that runs code counts as able to act.",[14,978,979],{},"The team does not say whether the copilot's network egress is limited to an allowlist. Nor do they say whether the copilot's tool credentials are limited to the customer it serves. Leave both facts unanswered. Lesson 8 is about why.",[32,981,983],{"id":982},"steps","Steps",[14,985,986,987,990,991,994,995,997],{},"Double-click the support copilot. Its settings open in a panel at the bottom of the canvas, headed ",[69,988,989],{},"Process: Support copilot",". Go to its ",[69,992,993],{},"Attributes"," tab. Its fields are grouped by category, and the lessons name the category with each field, for example \"under Human Oversight\". Click a category to expand it and see its fields. The first of the two small buttons at the top right of the ",[69,996,993],{}," tab switches the categories between foldable sections and tabs.",[14,999,1000],{},"Each of these fields shows three buttons:",[79,1002,1003,1009,1015],{},[82,1004,1005,1008],{},[69,1006,1007],{},"Not answered"," means unanswered. Every field starts that way.",[82,1010,1011,1014],{},[69,1012,1013],{},"Yes"," answers yes.",[82,1016,1017,1020],{},[69,1018,1019],{},"No"," answers no.",[14,1022,1023,1024,1026,1027,1031,1032,1034,1035,1037,1038,1040],{},"Answer only the fields below. If you answer one by mistake, choose ",[69,1025,1007],{}," and save (see ",[17,1028,1030],{"href":1029},"\u002Fagentic-modelling#yesno-fields","Yes\u002Fno fields","). ",[69,1033,171],{}," is not shown until you choose ",[69,1036,1013],{}," for ",[69,1039,148],{},": it appears beside it once you do.",[14,1042,1043,1044,1047,1048,1051],{},"In the ",[69,1045,1046],{},"Human Oversight"," fields, a * and the hint \"is a required property\" mark a fact the class asks for, for example ",[69,1049,1050],{},"Approval Gate Present*",". The model saves without it. Leave such a field unanswered unless the lesson tells you to set it.",[1053,1054,1055],"ol",{},[82,1056,1057,1058,1061,1062],{},"On ",[69,1059,1060],{},"Support copilot",", set:\n",[79,1063,1064,1073,1081],{},[82,1065,1066,149,1068,1070,1071],{},[69,1067,148],{},[151,1069,153],{},", under Human Oversight) = ",[151,1072,179],{},[82,1074,1075,149,1077,1070,1079],{},[69,1076,171],{},[151,1078,174],{},[151,1080,159],{},[82,1082,1083,149,1085,1087,1088],{},[69,1084,267],{},[151,1086,270],{},", under Application Security) = ",[151,1089,159],{},[14,1091,1092],{},"Generate again.",[32,1094,1096],{"id":1095},"what-you-should-see","What you should see",[14,1098,1099,1102],{},[69,1100,1101],{},"Findings:"," 2 systemic findings: 2 Confirmed · 0 Not ruled out.",[107,1104,1107],{"className":1105,"tabIndex":111,"role":112,"ariaLabel":1106},[110],"Table: What you should see",[115,1108,1109,1122],{},[118,1110,1111],{},[121,1112,1113,1116,1119],{},[124,1114,1115],{},"Finding",[124,1117,1118],{},"State",[124,1120,1121],{},"Legs",[136,1123,1124,1135],{},[121,1125,1126,1129,1132],{},[141,1127,1128],{},"Lethal trifecta at Support copilot",[141,1130,1131],{},"Confirmed · unmitigated",[141,1133,1134],{},"U present · P present · X present · W present (aggravating)",[121,1136,1137,1140,1142],{},[141,1138,1139],{},"Injection to action at Support copilot",[141,1141,1131],{},[141,1143,1144],{},"untrusted input present · action tools present · no gate present · sensitive target present (aggravating) · broad identity undetermined (aggravating)",[14,1146,1147,1150],{},[69,1148,1149],{},"Facts to establish:"," 1 question.",[14,1152,1153],{},"Facts that could raise a finding:",[79,1155,1156],{},[82,1157,1158],{},"Draw the Agent Tool Call from Support copilot to the harness that reads files for it, if there is one",[14,1160,1161,1164],{},[69,1162,1163],{},"Model gaps:"," No gaps these patterns can detect; not an attestation of completeness.",[14,1166,1167,1168,1171,1172,1175,1176,1179],{},"A second finding appears: ",[69,1169,1170],{},"Injection to action"," at the support copilot, ",[69,1173,1174],{},"Confirmed",". The trifecta's W leg is now present. The model gap is gone. One question stays on ",[69,1177,1178],{},"Facts to establish",": the CRM API key's, from lesson 2.",[32,1181,1183],{"id":1182},"what-changed-and-why","What changed and why",[14,1185,1186,1189],{},[69,1187,1188],{},"Injection to action is Confirmed."," Its three required legs are present:",[79,1191,1192,1198,1204],{},[82,1193,1194,1197],{},[69,1195,1196],{},"untrusted input",": from lessons 2 to 4, the copilot reads tickets and fetched pages that anyone can write;",[82,1199,1200,1203],{},[69,1201,1202],{},"action tools",": you stated that the copilot has consequential tools;",[82,1205,1206,1209],{},[69,1207,1208],{},"no gate",": you stated that those tools do not all need approval.",[14,1211,1212],{},"Untrusted content can trigger an action that nobody approves.",[14,1214,1215,1218],{},[69,1216,1217],{},"W turns present on the trifecta."," The copilot writes without approval. W is aggravating: it only ranks the trifecta above otherwise equal findings. The trifecta was already Confirmed without it.",[14,1220,1221,1224],{},[69,1222,1223],{},"The harness question is settled."," In lesson 1 the analysis asked you to tie the copilot to its harness, to find out how its actions get approved. The copilot has no harness. Its own answer, that its tools do not all need approval, now decides the question, so the question and the model gap both go.",[14,1226,1227,1230,1231,1234],{},[69,1228,1229],{},"The key's question stays, in new words."," It still asks whether the copilot can read the files in its container, and so reach the CRM API key. You answered that the copilot runs no code, so the analysis no longer asks for that fact. Running no code does not rule out reading files, though: a harness can read them for the agent. Only a drawn Agent Tool Call to such a harness can show that, so the question now reads ",[1232,1233,1158],"em",{},". The copilot has no harness, so there is nothing to draw. The question stays open in every later lesson. No finding depends on it, so leave it.",[14,1236,1237,1240,1241,1244,1245,1248,1249,1251,1252,1255,1256,1259,1260,149,1262,1264],{},[69,1238,1239],{},"Aggravating legs never decide a finding."," The injection-to-action finding shows two aggravating legs: ",[69,1242,1243],{},"sensitive target"," is present and ",[69,1246,1247],{},"broad identity"," is undetermined. Aggravating legs only rank a finding above otherwise equal findings, by how many of them are present. The severity stays the pattern's band. Because they never decide the finding, ",[69,1250,1178],{}," does not ask about them. Inside the expanded finding, the broad identity leg still shows a ",[69,1253,1254],{},"to settle:"," line with an ",[69,1257,1258],{},"Answer it"," button. Its question names no attribute, so neither the line nor its dialog names one. The attribute is ",[69,1261,512],{},[151,1263,515],{},", under Authorization & RBAC). Leave it open.",[14,1266,1267,1270],{},[69,1268,1269],{},"Broad identity is still worth asking."," The step asks: are the copilot's tool credentials limited to the customer it serves? The answer does not decide the finding, but it decides how much an injected copilot can reach. If the CRM API key can read every customer's records, one injected ticket can pull any customer's data, not only the data of the customer who wrote it.",[14,1272,1273,1276],{},[69,1274,1275],{},"You answered only what the team told you."," The egress fact and the identity fact stay open. Answering either with a value nobody gave you would be a guess.",[32,1278,1280],{"id":1279},"exercise","Exercise",[14,1282,1283],{},"This lesson has no exercise. Lesson 6 builds on it directly.",[32,1285,1287],{"id":1286},"next","Next",[14,1289,1290,1293],{},[17,1291,1292],{"href":29},"Lesson 6: Fix a finding with a fact",". The team adds approval, and you record it.",{"title":1295,"searchDepth":1296,"depth":1296,"links":1297},"",3,[1298,1300,1301,1304,1305,1306,1307,1308],{"id":34,"depth":1299,"text":35},2,{"id":44,"depth":1299,"text":45},{"id":56,"depth":1299,"text":57,"children":1302},[1303],{"id":61,"depth":1296,"text":62},{"id":982,"depth":1299,"text":983},{"id":1095,"depth":1299,"text":1096},{"id":1182,"depth":1299,"text":1183},{"id":1279,"depth":1299,"text":1280},{"id":1286,"depth":1299,"text":1287},"Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact","md",{},true,"\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do",{"title":5,"description":1309},"07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Zm3DG3ZIPXrrcH4It_sYQTiauCECAsybAVIL-1Rc8hM",[1318,1373,1408,1463,1497,1541,1556,1619],{"title":1319,"description":1320,"path":1321,"stem":1322,"children":1323,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1324,1328,1333,1338,1343,1348,1353,1358,1363,1368],{"title":1325,"path":1321,"stem":1326,"description":1327},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1329,"path":1330,"stem":1331,"description":1332},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1334,"path":1335,"stem":1336,"description":1337},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1339,"path":1340,"stem":1341,"description":1342},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1344,"path":1345,"stem":1346,"description":1347},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1349,"path":1350,"stem":1351,"description":1352},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1354,"path":1355,"stem":1356,"description":1357},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1359,"path":1360,"stem":1361,"description":1362},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1364,"path":1365,"stem":1366,"description":1367},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1369,"path":1370,"stem":1371,"description":1372},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1374,"description":1375,"path":1376,"stem":1377,"children":1378,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1379,1383,1388,1393,1398,1403],{"title":1380,"path":1376,"stem":1381,"description":1382},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1384,"path":1385,"stem":1386,"description":1387},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1389,"path":1390,"stem":1391,"description":1392},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1394,"path":1395,"stem":1396,"description":1397},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1399,"path":1400,"stem":1401,"description":1402},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1404,"path":1405,"stem":1406,"description":1407},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1409,"description":1410,"path":1411,"stem":1412,"children":1413,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1414,1418,1423,1428,1433,1438,1443,1448,1453,1458],{"title":1415,"path":1411,"stem":1416,"description":1417},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1419,"path":1420,"stem":1421,"description":1422},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1424,"path":1425,"stem":1426,"description":1427},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1429,"path":1430,"stem":1431,"description":1432},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1434,"path":1435,"stem":1436,"description":1437},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1439,"path":1440,"stem":1441,"description":1442},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1444,"path":1445,"stem":1446,"description":1447},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1449,"path":1450,"stem":1451,"description":1452},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1454,"path":1455,"stem":1456,"description":1457},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1459,"path":1460,"stem":1461,"description":1462},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1464,"description":1465,"path":1466,"stem":1467,"children":1468,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1469,1472,1477,1482,1487,1492],{"title":1464,"path":1466,"stem":1470,"description":1471},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1473,"path":1474,"stem":1475,"description":1476},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1478,"path":1479,"stem":1480,"description":1481},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1483,"path":1484,"stem":1485,"description":1486},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1488,"path":1489,"stem":1490,"description":1491},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1493,"path":1494,"stem":1495,"description":1496},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1498,"description":1499,"path":1500,"stem":1501,"children":1502,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1503,1507,1512,1517,1522,1527,1531,1536],{"title":1504,"path":1500,"stem":1505,"description":1506},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1508,"path":1509,"stem":1510,"description":1511},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1513,"path":1514,"stem":1515,"description":1516},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1518,"path":1519,"stem":1520,"description":1521},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1523,"path":1524,"stem":1525,"description":1526},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1478,"path":1528,"stem":1529,"description":1530},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1532,"path":1533,"stem":1534,"description":1535},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1537,"path":1538,"stem":1539,"description":1540},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1542,"description":1543,"path":1544,"stem":1545,"children":1546,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1547,1551],{"title":1548,"path":1544,"stem":1549,"description":1550},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1552,"path":1553,"stem":1554,"description":1555},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1557,"description":1558,"path":19,"stem":1559,"children":1560,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","07.agentic-modelling",[1561,1565,1570,1575,1580,1584,1585,1589,1594,1599,1604,1609,1614],{"title":1562,"path":19,"stem":1563,"description":1564},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1566,"path":1567,"stem":1568,"description":1569},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1571,"path":1572,"stem":1573,"description":1574},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1576,"path":1577,"stem":1578,"description":1579},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1581,"path":24,"stem":1582,"description":1583},"Lesson 4: Draw a Tool That Reaches Any Host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":5,"path":1313,"stem":1315,"description":1309},{"title":1586,"path":29,"stem":1587,"description":1588},"Lesson 6: Fix a Finding With a Fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1590,"path":1591,"stem":1592,"description":1593},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1595,"path":1596,"stem":1597,"description":1598},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1600,"path":1601,"stem":1602,"description":1603},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1605,"path":1606,"stem":1607,"description":1608},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1610,"path":1611,"stem":1612,"description":1613},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1615,"path":1616,"stem":1617,"description":1618},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1620,"description":1621,"path":1622,"stem":1623,"children":1624,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1625,1629,1634],{"title":1626,"path":1622,"stem":1627,"description":1628},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1630,"path":1631,"stem":1632,"description":1633},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1635,"path":1636,"stem":1637,"description":1638},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186467]