[{"data":1,"prerenderedAt":1443},["ShallowReactive",2],{"page-\u002Fagentic-modelling\u002F08-leave-unknowns-open":3,"navigation":1122},{"id":4,"title":5,"body":6,"description":1114,"extension":1115,"meta":1116,"navigation":1117,"path":1118,"seo":1119,"stem":1120,"__hash__":1121},"docs\u002F07.agentic-modelling\u002F08.08-leave-unknowns-open.md","Lesson 8: Leave What You Don't Know Open",{"type":7,"value":8,"toc":1093},"minimark",[9,13,31,36,39,42,46,54,62,81,84,179,182,186,191,194,200,203,467,470,474,479,511,519,525,534,537,540,571,574,578,581,587,630,636,639,661,664,692,698,709,715,719,723,758,763,765,781,783,790,795,805,809,815,825,847,851,854,908,912,915,921,925,939,945,969,971,975,1009,1013,1015,1031,1033,1043,1047,1054,1077,1080,1083,1087],[10,11,5],"h1",{"id":12},"lesson-8-leave-what-you-dont-know-open",[14,15,16,21,22,26,27],"p",{},[17,18,20],"a",{"href":19},"\u002Fagentic-modelling","Training overview"," · Lesson 8 of 11 · Previous: ",[17,23,25],{"href":24},"\u002Fagentic-modelling\u002F07-record-a-compensating-control","Record a compensating control"," · Next: ",[17,28,30],{"href":29},"\u002Fagentic-modelling\u002F09-follow-a-credential","Follow a credential",[32,33,35],"h2",{"id":34},"goal","Goal",[14,37,38],{},"An unanswered fact comes back as a question. A guess makes the question go away without settling anything.",[14,40,41],{},"After this lesson you can tell an open question from a settled one, answer only what you were told, and recognise what a guess would do before you make it.",[32,43,45],{"id":44},"what-you-start-from","What you start from",[14,47,48,49,53],{},"Import ",[17,50,52],{"href":51},"\u002Fguides\u002Fagentic-modelling\u002FL8-start.zip","L8-start.zip",".",[14,55,56,57,61],{},"It is the lesson 7 solution plus a second agent, the ",[58,59,60],"strong",{},"Ticket summariser",", already drawn. The summariser reads each ticket, looks the customer up in the CRM, and writes its summary only to the staff console. Nobody has answered any of its facts yet.",[14,63,64,67,68,71,72,75,76,80],{},[58,65,66],{},"Before you import, create the lesson 7 control."," The starting model refers to the control ",[58,69,70],{},"Support copilot: untrusted-content isolation"," by name, and the import does not create it. If you did not do lesson 7, create it in the ",[58,73,74],{},"Browser"," first, with exactly that name and the answers from ",[17,77,79],{"href":78},"\u002Fagentic-modelling\u002F07-record-a-compensating-control#steps","lesson 7",". Without it, the import reports a warning starting \"Could not find control: Support copilot: untrusted-content isolation\" and the copilot's trifecta shows no control credit. The summariser, which this lesson is about, is not affected.",[14,82,83],{},"If you continue your own model from lesson 7, draw the summariser first:",[85,86,87,98,106,124,138,150,161,172],"ol",{},[88,89,90,91,94,95,53],"li",{},"Add the boundary ",[58,92,93],{},"Summariser container"," (class Container), inside ",[58,96,97],{},"Support network",[88,99,100,101,103,104,53],{},"Add ",[58,102,60],{}," (class Agent Service), inside ",[58,105,93],{},[88,107,108,109,112,113,116,117,119,120,123],{},"Draw ",[58,110,111],{},"Context Ingress: ticket"," (class Context Ingress) from ",[58,114,115],{},"Ticket system"," to ",[58,118,60],{},", and tick ",[58,121,122],{},"Ticket text"," on its Data tab.",[88,125,108,126,129,130,116,132,119,135,123],{},[58,127,128],{},"CRM lookup"," (class Agent Tool Call) from ",[58,131,60],{},[58,133,134],{},"CRM",[58,136,137],{},"CRM API key",[88,139,108,140,112,143,116,145,119,147,123],{},[58,141,142],{},"Context Ingress: customer records",[58,144,134],{},[58,146,60],{},[58,148,149],{},"Customer records",[88,151,108,152,155,156,116,158,53],{},[58,153,154],{},"Summary to staff"," (class HTTP\u002FS Request) from ",[58,157,60],{},[58,159,160],{},"Staff console",[88,162,108,163,166,167,116,169,53],{},[58,164,165],{},"Inference Request \u002F Response"," (class Inference Request \u002F Response) from ",[58,168,60],{},[58,170,171],{},"Hosted model",[88,173,174,175,116,177,53],{},"Attach ",[58,176,137],{},[58,178,93],{},[14,180,181],{},"Drawing it repeats lesson 1. The new work in this lesson is reading the questions and deciding which ones you can answer.",[32,183,185],{"id":184},"the-recipe-step","The recipe step",[187,188,190],"h3",{"id":189},"step-6-leave-what-you-do-not-know-open","Step 6: Leave what you do not know open",[14,192,193],{},"Write a value only when someone who knows has stated it, or you found it in evidence you can point to. Leave every other fact unanswered, on purpose. This holds for both answers: guessing that a tool exists is as much a guess as guessing that it does not.",[14,195,196,199],{},[58,197,198],{},"Why:"," An unanswered fact comes back as a question that names what would settle it. A guess makes the question go away without settling anything.",[14,201,202],{},"What a guess does:",[204,205,211],"div",{"className":206,"tabIndex":208,"role":209,"ariaLabel":210},[207],"table-frame",0,"region","Table: Step 6: Leave what you do not know open",[212,213,214,227],"table",{},[215,216,217],"thead",{},[218,219,220,224],"tr",{},[221,222,223],"th",{},"If you guess",[221,225,226],{},"What happens",[228,229,230,240,260,273,285,297,319,336,345,353,361,369,377,385,393,402,415,434,443,451,459],"tbody",{},[218,231,232,238],{},[233,234,235],"td",{},[58,236,237],{},"Answers on components",[233,239],{},[218,241,242,253],{},[233,243,244,248,249,252],{},[245,246,247],"code",{},"consequential_tools_all_require_approval"," = ",[245,250,251],{},"true"," (Agent Service)",[233,254,255,256,259],{},"The agent's actions read as approved through its own answer, so injection to action is no longer raised through them, unless another answer says actions run unapproved: ",[245,257,258],{},"approval_gate_present"," = false on the agent, a chat frontend or a source that approves automatically, or a drawn path answered unapproved. With consequential tools answered false, the answer covers nothing the agent runs and does not count.",[218,261,262,270],{},[233,263,264,248,267,252],{},[245,265,266],{},"consequential_tools_present",[245,268,269],{},"false",[233,271,272],{},"With code execution also answered false, and no MCP server it calls answering destructive tools true, the agent reads as holding no tools that act: the question about them closes, and injection to action cannot be raised through its own tools. With code execution open, the question stays; with code execution true, or such a server, it is raised as before. The agent's own approval answer then counts only toward actions running unapproved.",[218,274,275,282],{},[233,276,277,248,280,252],{},[245,278,279],{},"code_execution_tools_present",[245,281,269],{},[233,283,284],{},"The agent reads as running no code: with consequential tools also false, injection to action is no longer raised through its own tools. Whether it reads files stays open: the question moves to the harness that might read them for it.",[218,286,287,294],{},[233,288,289,248,292,252],{},[245,290,291],{},"network_egress_default_deny_allowlist",[245,293,251],{},[233,295,296],{},"The agent's own undrawn ways out read as closed. A drawn flow from it that reaches an outsider still counts.",[218,298,299,312],{},[233,300,301,248,304,307,308,311],{},[245,302,303],{},"harness_approval_mode",[245,305,306],{},"default"," or ",[245,309,310],{},"plan"," (Agent Harness)",[233,313,314,315,318],{},"Every agent the harness runs reads as waiting for approval, so injection to action is no longer raised for them through the harness, unless the agent's own approval answer, or ",[245,316,317],{},"dangerously_skip_permissions_in_use"," on the harness, says otherwise.",[218,320,321,333],{},[233,322,323,248,326,307,329,332],{},[245,324,325],{},"markdown_image_rendering_policy",[245,327,328],{},"disabled",[245,330,331],{},"allowlisted_trusted_domains_only"," (Agent Chat Frontend)",[233,334,335],{},"Every undrawn way out through images rendered in the chat frontend reads as closed. A drawn flow from it still counts.",[218,337,338,343],{},[233,339,340],{},[58,341,342],{},"Answers on data items",[233,344],{},[218,346,347,350],{},[233,348,349],{},"Sensitivity = Public (data item)",[233,351,352],{},"With Credential = No, the item no longer counts as private, and an element that handles only it no longer counts as a sensitive target or as something a credential unlocks.",[218,354,355,358],{},[233,356,357],{},"Credential = No (data item)",[233,359,360],{},"The item is no longer treated as a credential: no credential chain starts from it. An item whose class is a credential class counts as one while the answer is open; another item counts only once it is answered Yes.",[218,362,363,366],{},[233,364,365],{},"Origin = Authenticated first party (data item)",[233,367,368],{},"The item no longer counts as untrusted, unless the flow carrying it comes from an Untrusted zone or an untrusted source class.",[218,370,371,374],{},[233,372,373],{},"Origin = Curated internal (data item)",[233,375,376],{},"The item counts as trusted, as for first party. For a knowledge base fed from outside, the knowledge route loses it, unless the ingestion is drawn: a pipeline's Knowledge Write carries the least trusted origin it ingests, whatever origin is stated.",[218,378,379,382],{},[233,380,381],{},"Origin = Agent relayed (data item)",[233,383,384],{},"The item counts as trusted on the agent's own routes, so injection to action loses it as untrusted input. If the relaying agent and its hand-off are drawn, the relayed route still carries the relayer's untrusted input to the trifecta.",[218,386,387,390],{},[233,388,389],{},"Origin = Model generated (data item)",[233,391,392],{},"Content the model wrote counts as trusted on the agent's own routes, even when it wrote it from untrusted content: the taint is laundered there. Read back from the agent's own memory it reads undetermined instead, and Facts to establish says second-order poisoning is not analysed. Through a store another agent reads, the writer's untrusted input still reaches the reader when the same item is drawn on the write and on the read.",[218,394,395,400],{},[233,396,397],{},[58,398,399],{},"Answers on paths",[233,401],{},[218,403,404,412],{},[233,405,406,248,409,411],{},[245,407,408],{},"human_approval_for_sensitive_tool_calls",[245,410,251],{}," (Agent Tool Call)",[233,413,414],{},"That path reads as approved. Injection to action is no longer raised only when every path into and out of the agent is approved, untrusted content reaches it no other way (a tool server, a knowledge item), and it runs no code off its drawn calls.",[218,416,417,431],{},[233,418,419,248,422,424,425,248,428,430],{},[245,420,421],{},"human_approval_for_actions_after_untrusted_ingress",[245,423,251],{},", or ",[245,426,427],{},"untrusted_ingress_can_trigger_consequential_actions",[245,429,269],{}," (Context Ingress)",[233,432,433],{},"As for an approved tool call, for the path the untrusted content comes in on.",[218,435,436,441],{},[233,437,438],{},[58,439,440],{},"Zones and assertions",[233,442],{},[218,444,445,448],{},[233,446,447],{},"Assert outbound flows complete (on an element)",[233,449,450],{},"Every undrawn way out of that element reads as closed; its drawn flows are still followed. It is the user's answer to give, never a shortcut.",[218,452,453,456],{},[233,454,455],{},"Zone = Internal for a boundary drawn Untrusted (Open internet) or Public (Internet-facing)",[233,457,458],{},"Content from it no longer counts as untrusted by zone, and what reaches it no longer counts as a way out: untrusted input and the trifecta's way out can both fall, and a public-facing foothold goes.",[218,460,461,464],{},[233,462,463],{},"Zone = Internal for a boundary drawn Vendor (Trusted external)",[233,465,466],{},"What reaches the vendor reads as staying inside: the analysis stops asking whether an untrusted party can read it.",[14,468,469],{},"The table above is the reason for this step. Each row is a value that looks safe and, if nobody told you it is true, can remove a finding for good. The polarity differs from fact to fact: \"no\" looks safe for a fact about what tools exist, \"yes\" for a fact about approval or egress. So the rule is not \"never write a false value\". It is \"never answer what nobody told you\".",[32,471,473],{"id":472},"steps","Steps",[14,475,476],{},[58,477,478],{},"Read before you answer.",[85,480,481,497,504],{},[88,482,483,484,487,488,491,492,496],{},"Open the model, create a Threat Patterns analysis, open it with ",[58,485,486],{},"View results"," and click ",[58,489,490],{},"Generate"," (see ",[17,493,495],{"href":494},"\u002Fagentic-modelling#run-threat-patterns-on-a-lesson-model","Run Threat Patterns on a lesson model",").",[88,498,499,500,503],{},"On the ",[58,501,502],{},"Findings"," tab, find the lethal trifecta at the ticket summariser.",[88,505,506,507,510],{},"Open the ",[58,508,509],{},"Facts to establish"," tab and read every question about the summariser. Do not change anything yet.",[14,512,513,514,518],{},"Compare what you see with ",[17,515,517],{"href":516},"#before-you-answer","Before you answer"," below.",[14,520,521,524],{},[58,522,523],{},"Ask, then answer only what you were told."," You ask the team that runs the summariser. They tell you:",[526,527,528,531],"ul",{},[88,529,530],{},"The summariser only writes summaries for staff to read. It posts nothing, updates nothing and sends nothing on its own.",[88,532,533],{},"It runs no code.",[14,535,536],{},"They do not know whether the staff console renders images in the summaries, and they cannot say who at the CRM vendor can read what the summariser sends there. Leave those facts open.",[14,538,539],{},"Record the two answers you were given:",[85,541,542],{},[88,543,544,545,547,548],{},"On ",[58,546,60],{},", set:\n",[526,549,550,561],{},[88,551,552,555,556,558,559],{},[58,553,554],{},"Consequential Tools Present"," (",[245,557,266],{},", under Human Oversight) = ",[245,560,269],{},[88,562,563,555,566,568,569],{},[58,564,565],{},"Code Execution Tools Present",[245,567,279],{},", under Application Security) = ",[245,570,269],{},[14,572,573],{},"Generate again.",[32,575,577],{"id":576},"what-you-should-see","What you should see",[187,579,517],{"id":580},"before-you-answer",[14,582,583,586],{},[58,584,585],{},"Findings:"," 2 systemic findings: 1 Confirmed · 1 Not ruled out.",[204,588,591],{"className":589,"tabIndex":208,"role":209,"ariaLabel":590},[207],"Table: Before you answer",[212,592,593,606],{},[215,594,595],{},[218,596,597,600,603],{},[221,598,599],{},"Finding",[221,601,602],{},"State",[221,604,605],{},"Legs",[228,607,608,619],{},[218,609,610,613,616],{},[233,611,612],{},"Lethal trifecta at Support copilot",[233,614,615],{},"Confirmed · control modelled on U, X",[233,617,618],{},"U present · P present · X present · W absent (aggravating)",[218,620,621,624,627],{},[233,622,623],{},"Lethal trifecta at Ticket summariser",[233,625,626],{},"Not ruled out · unmitigated",[233,628,629],{},"U present · P present · X undetermined · W undetermined (aggravating)",[14,631,632,635],{},[58,633,634],{},"Facts to establish:"," 7 questions.",[14,637,638],{},"Open questions on Not ruled out findings:",[526,640,641],{},[88,642,643,644],{},"Lethal trifecta at Ticket summariser:\n",[526,645,646,649,658],{},[88,647,648],{},"Can an untrusted party read what reaches CRM?",[88,650,651,652,555,655,657],{},"Draw the outbound flows of Staff console, or answer ",[58,653,654],{},"Markdown Image Rendering Policy",[245,656,325],{},", in Output Rendering Exfiltration) on Staff console",[88,659,660],{},"Every drawn route from CRM ends inside; assert its outbound flows complete if nothing else leaves it",[14,662,663],{},"Facts that could raise a finding:",[526,665,666,674,677,689],{},[88,667,668,669,555,671,673],{},"Set the attribute ",[58,670,565],{},[245,672,279],{},", in Application Security) on Ticket summariser, or draw its Agent Tool Call to the harness",[88,675,676],{},"Draw the Agent Tool Call from Support copilot to the harness that reads files for it, if there is one",[88,678,668,679,555,681,683,684,555,686,688],{},[58,680,554],{},[245,682,266],{},", in Human Oversight) or ",[58,685,565],{},[245,687,279],{},", in Application Security) on Ticket summariser",[88,690,691],{},"Draw the runtime boundary or the Agent Tool Call that ties Ticket summariser to its harness",[14,693,694,697],{},[58,695,696],{},"Model gaps:"," 1 of 2 agents have no hosting harness drawn, so their W cannot be read from one (on Ticket summariser)",[14,699,700,701,704,705,708],{},"The support copilot's trifecta is unchanged from lesson 7. The summariser has a lethal trifecta, ",[58,702,703],{},"Not ruled out",": U and P are present, X is undetermined. Injection to action at the summariser is short of a finding, and its questions sit under ",[58,706,707],{},"Facts that could raise a finding",". So does a question about the CRM API key, which the summariser's container now holds too: the same question the copilot had in lesson 2. The copilot's own key question reads differently, because you answered its code fact in lesson 5.",[14,710,711,712,714],{},"The model gaps sit at the top of the ",[58,713,509],{}," tab. The line about agents with no hosting harness drawn now counts the summariser: it reads \"1 of 2 agents have no hosting harness drawn, so their W cannot be read from one\", and the line beneath it names the element, \"on Ticket summariser\".",[187,716,718],{"id":717},"after-you-answer","After you answer",[14,720,721,586],{},[58,722,585],{},[204,724,727],{"className":725,"tabIndex":208,"role":209,"ariaLabel":726},[207],"Table: After you answer",[212,728,729,739],{},[215,730,731],{},[218,732,733,735,737],{},[221,734,599],{},[221,736,602],{},[221,738,605],{},[228,740,741,749],{},[218,742,743,745,747],{},[233,744,612],{},[233,746,615],{},[233,748,618],{},[218,750,751,753,755],{},[233,752,623],{},[233,754,626],{},[233,756,757],{},"U present · P present · X undetermined · W absent (aggravating)",[14,759,760,762],{},[58,761,634],{}," 5 questions.",[14,764,638],{},[526,766,767],{},[88,768,643,769],{},[526,770,771,773,779],{},[88,772,648],{},[88,774,651,775,555,777,657],{},[58,776,654],{},[245,778,325],{},[88,780,660],{},[14,782,663],{},[526,784,785,787],{},[88,786,676],{},[88,788,789],{},"Draw the Agent Tool Call from Ticket summariser to the harness that reads files for it, if there is one",[14,791,792,794],{},[58,793,696],{}," No gaps these patterns can detect; not an attestation of completeness.",[14,796,797,798,800,801,804],{},"The questions about the summariser's tools and the one tying it to a harness are gone, and so is the model gap. The summariser's trifecta is still ",[58,799,703],{},", with the same questions on its X leg. The CRM API key's question stays, in the new words the copilot's took in lesson 5: ",[802,803,789],"em",{},". You said the summariser runs no code, so that fact is not asked again; only a drawn call to a harness could show that something reads its files for it.",[32,806,808],{"id":807},"what-changed-and-why","What changed and why",[14,810,811,814],{},[58,812,813],{},"The tool questions were settled."," You answered both of the summariser's action-tool facts. It has no tools that act and runs no code, so injection to action cannot be raised for it: the question about it is answered, not hidden. Its approval no longer matters either, so the harness question goes too. The trifecta's W leg reads absent: an agent with no consequential tools does not write without approval.",[14,816,817,820,821,824],{},[58,818,819],{},"The X questions stay, and that is correct."," The trifecta asks, under ",[58,822,823],{},"Open questions on Not ruled out findings",":",[526,826,827,832,841],{},[88,828,829,831],{},[802,830,648],{}," A vendor destination alone does not answer it. No attribute or drawing in this model settles it yet, so it stays open.",[88,833,834,840],{},[802,835,836,837,839],{},"Draw the outbound flows of Staff console, or answer Markdown Image Rendering Policy (",[245,838,325],{},", in Output Rendering Exfiltration) on Staff console."," A chat frontend that renders images can send data out through the image addresses. Nobody told you how this console behaves, so leave it open.",[88,842,843,846],{},[802,844,845],{},"Every drawn route from CRM ends inside; assert its outbound flows complete if nothing else leaves it."," The routes drawn from the CRM lead only back to the two agents. Whether anything else leaves it is partly your own configuration. In a SaaS CRM, your own administrators set up the connected apps, webhooks and outbound workflows that send its data elsewhere. Assert the CRM's outbound flows complete only when the CRM administrator confirms that nothing else leaves. In 2025, attackers used tokens stolen from one such connected app, the Salesloft Drift chat integration, to pull data out of many companies' Salesforce instances.",[187,848,850],{"id":849},"who-settles-these-questions","Who settles these questions",[14,852,853],{},"Do not guess. Find the person who knows, and give each open question an owner and a date. Until it is settled, treat an open way out as present when you plan monitoring.",[204,855,858],{"className":856,"tabIndex":208,"role":209,"ariaLabel":857},[207],"Table: Who settles these questions",[212,859,860,873],{},[215,861,862],{},[218,863,864,867,870],{},[221,865,866],{},"Question",[221,868,869],{},"Who settles it",[221,871,872],{},"How",[228,874,875,886,897],{},[218,876,877,880,883],{},[233,878,879],{},"Does the staff console render images or links in model output?",[233,881,882],{},"The owner of the staff console",[233,884,885],{},"Read its rendering settings, then test them: put a markdown image that points at an address you control into a test ticket, and see whether the console fetches it",[218,887,888,891,894],{},[233,889,890],{},"What does the CRM pass on, and who can read what reaches it?",[233,892,893],{},"The CRM administrator, for connected apps, webhooks and outbound workflows. Vendor management, for the vendor's subprocessor list and audit report",[233,895,896],{},"Ask for the list of integrations and outbound rules; ask vendor management for the documents",[218,898,899,902,905],{},[233,900,901],{},"Is an agent's network egress limited to an allowlist?",[233,903,904],{},"The platform or network team",[233,906,907],{},"Read the egress configuration itself, and the list it allows. Do not settle it by asking someone's opinion",[187,909,911],{"id":910},"what-the-patterns-do-not-check-people","What the patterns do not check: people",[14,913,914],{},"The summariser writes for people. A summary can steer a person even when the agent itself can do nothing: an injected ticket can make the summary show a fake security alert with a phone number to call. The patterns do not check this. Note it as an item for manual review: what does the console show staff, and what would they do with it?",[14,916,917,920],{},[58,918,919],{},"Not ruled out is not a lower grade of risk."," The summariser reads untrusted tickets and confidential customer records. Whether it can send them to an outsider is the open part. The finding says exactly what is missing. Answering a question to make it go away would leave the summariser no safer and the model wrong.",[32,922,924],{"id":923},"exercise-the-guess","Exercise: The guess",[14,926,927,928,931,932,934,935,938],{},"On a scratch copy of the starting model, before asking anyone, make a guess. Assume the summariser posts its summaries itself and that a person approves every post. Set both facts without anyone saying they are true. Choose ",[58,929,930],{},"Yes"," for ",[58,933,554],{}," first: ",[58,936,937],{},"All Consequential Action Paths Require Approval"," appears only after that.",[14,940,941,942,944],{},"On a scratch copy: import ",[17,943,52],{"href":51}," and rename it.",[85,946,947],{},[88,948,544,949,547,951],{},[58,950,60],{},[526,952,953,961],{},[88,954,955,555,957,558,959],{},[58,956,554],{},[245,958,266],{},[245,960,251],{},[88,962,963,555,965,558,967],{},[58,964,937],{},[245,966,247],{},[245,968,251],{},[14,970,573],{},[14,972,973,586],{},[58,974,585],{},[204,976,979],{"className":977,"tabIndex":208,"role":209,"ariaLabel":978},[207],"Table: Exercise: The guess",[212,980,981,991],{},[215,982,983],{},[218,984,985,987,989],{},[221,986,599],{},[221,988,602],{},[221,990,605],{},[228,992,993,1001],{},[218,994,995,997,999],{},[233,996,612],{},[233,998,615],{},[233,1000,618],{},[218,1002,1003,1005,1007],{},[233,1004,623],{},[233,1006,626],{},[233,1008,757],{},[14,1010,1011,762],{},[58,1012,634],{},[14,1014,638],{},[526,1016,1017],{},[88,1018,643,1019],{},[526,1020,1021,1023,1029],{},[88,1022,648],{},[88,1024,651,1025,555,1027,657],{},[58,1026,654],{},[245,1028,325],{},[88,1030,660],{},[14,1032,663],{},[526,1034,1035,1041],{},[88,1036,668,1037,555,1039,673],{},[58,1038,565],{},[245,1040,279],{},[88,1042,676],{},[14,1044,1045,794],{},[58,1046,696],{},[14,1048,1049,1050,1053],{},"Compare it with ",[17,1051,718],{"href":1052},"#after-you-answer",", the result of the truthful answer.",[526,1055,1056,1065,1071],{},[88,1057,1058,1061,1062,1064],{},[58,1059,1060],{},"The screen matches the truthful answer."," There is no injection to action at the summariser and no model gap. The question about its action tools and the one tying it to a harness are gone. The summariser's trifecta shows W as absent, just as it does after the truthful answer. One line differs: the CRM API key's question on the summariser still asks for Code Execution Tools Present (",[245,1063,279],{},", in Application Security), because the guess left the code fact unanswered. That line says nothing about the guess itself.",[88,1066,1067,1070],{},[58,1068,1069],{},"Two guesses gave the same result as two facts."," The truthful answer said the summariser has no tools that act. The guess says it has them and that a person approves every one. Both make injection to action impossible to raise, and nothing about injection to action on screen tells them apart.",[88,1072,1073,1076],{},[58,1074,1075],{},"The guess also says something false about the system."," Anyone who reads the model later learns that the summariser posts on its own behind an approval step. Neither is true.",[14,1078,1079],{},"That is the danger: a guess and the truth can look the same on screen. In lesson 6 the approval answer was a fix, because it was true. Here it is a cover-up. The analysis cannot tell the two apart: it believes what the model says.",[14,1081,1082],{},"Delete the copy when you are done.",[32,1084,1086],{"id":1085},"next","Next",[14,1088,1089,1092],{},[17,1090,1091],{"href":29},"Lesson 9: Follow a credential",". The copilot gains a code tool, and the CRM API key it has held since lesson 2 becomes a credential chain.",{"title":1094,"searchDepth":1095,"depth":1095,"links":1096},"",3,[1097,1099,1100,1103,1104,1108,1112,1113],{"id":34,"depth":1098,"text":35},2,{"id":44,"depth":1098,"text":45},{"id":184,"depth":1098,"text":185,"children":1101},[1102],{"id":189,"depth":1095,"text":190},{"id":472,"depth":1098,"text":473},{"id":576,"depth":1098,"text":577,"children":1105},[1106,1107],{"id":580,"depth":1095,"text":517},{"id":717,"depth":1095,"text":718},{"id":807,"depth":1098,"text":808,"children":1109},[1110,1111],{"id":849,"depth":1095,"text":850},{"id":910,"depth":1095,"text":911},{"id":923,"depth":1098,"text":924},{"id":1085,"depth":1098,"text":1086},"Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential","md",{},true,"\u002Fagentic-modelling\u002F08-leave-unknowns-open",{"title":5,"description":1114},"07.agentic-modelling\u002F08.08-leave-unknowns-open","raNDNnNRKMS-X5zxijFpl7G4qbHqvBXJKVGwRxMbd3g",[1123,1178,1213,1268,1302,1345,1360,1423],{"title":1124,"description":1125,"path":1126,"stem":1127,"children":1128,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1129,1133,1138,1143,1148,1153,1158,1163,1168,1173],{"title":1130,"path":1126,"stem":1131,"description":1132},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1134,"path":1135,"stem":1136,"description":1137},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1139,"path":1140,"stem":1141,"description":1142},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1144,"path":1145,"stem":1146,"description":1147},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1149,"path":1150,"stem":1151,"description":1152},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1154,"path":1155,"stem":1156,"description":1157},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1159,"path":1160,"stem":1161,"description":1162},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1164,"path":1165,"stem":1166,"description":1167},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1169,"path":1170,"stem":1171,"description":1172},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1174,"path":1175,"stem":1176,"description":1177},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1179,"description":1180,"path":1181,"stem":1182,"children":1183,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1184,1188,1193,1198,1203,1208],{"title":1185,"path":1181,"stem":1186,"description":1187},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1189,"path":1190,"stem":1191,"description":1192},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1194,"path":1195,"stem":1196,"description":1197},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1199,"path":1200,"stem":1201,"description":1202},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1204,"path":1205,"stem":1206,"description":1207},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1209,"path":1210,"stem":1211,"description":1212},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1214,"description":1215,"path":1216,"stem":1217,"children":1218,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1219,1223,1228,1233,1238,1243,1248,1253,1258,1263],{"title":1220,"path":1216,"stem":1221,"description":1222},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1224,"path":1225,"stem":1226,"description":1227},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1229,"path":1230,"stem":1231,"description":1232},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1234,"path":1235,"stem":1236,"description":1237},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1239,"path":1240,"stem":1241,"description":1242},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1244,"path":1245,"stem":1246,"description":1247},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1249,"path":1250,"stem":1251,"description":1252},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1254,"path":1255,"stem":1256,"description":1257},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1259,"path":1260,"stem":1261,"description":1262},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1264,"path":1265,"stem":1266,"description":1267},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1269,"description":1270,"path":1271,"stem":1272,"children":1273,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1274,1277,1282,1287,1292,1297],{"title":1269,"path":1271,"stem":1275,"description":1276},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1278,"path":1279,"stem":1280,"description":1281},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1283,"path":1284,"stem":1285,"description":1286},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1288,"path":1289,"stem":1290,"description":1291},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1293,"path":1294,"stem":1295,"description":1296},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1298,"path":1299,"stem":1300,"description":1301},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1303,"description":1304,"path":1305,"stem":1306,"children":1307,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1308,1312,1317,1321,1326,1331,1335,1340],{"title":1309,"path":1305,"stem":1310,"description":1311},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1313,"path":1314,"stem":1315,"description":1316},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":502,"path":1318,"stem":1319,"description":1320},"\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1322,"path":1323,"stem":1324,"description":1325},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1327,"path":1328,"stem":1329,"description":1330},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1283,"path":1332,"stem":1333,"description":1334},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1336,"path":1337,"stem":1338,"description":1339},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1341,"path":1342,"stem":1343,"description":1344},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1346,"description":1347,"path":1348,"stem":1349,"children":1350,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1351,1355],{"title":1352,"path":1348,"stem":1353,"description":1354},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1356,"path":1357,"stem":1358,"description":1359},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1361,"description":1362,"path":19,"stem":1363,"children":1364,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","07.agentic-modelling",[1365,1369,1374,1379,1384,1389,1394,1399,1403,1404,1408,1413,1418],{"title":1366,"path":19,"stem":1367,"description":1368},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1370,"path":1371,"stem":1372,"description":1373},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1375,"path":1376,"stem":1377,"description":1378},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1380,"path":1381,"stem":1382,"description":1383},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1385,"path":1386,"stem":1387,"description":1388},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1390,"path":1391,"stem":1392,"description":1393},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1395,"path":1396,"stem":1397,"description":1398},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1400,"path":24,"stem":1401,"description":1402},"Lesson 7: Record a Compensating Control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":5,"path":1118,"stem":1120,"description":1114},{"title":1405,"path":29,"stem":1406,"description":1407},"Lesson 9: Follow a Credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1409,"path":1410,"stem":1411,"description":1412},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1414,"path":1415,"stem":1416,"description":1417},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1419,"path":1420,"stem":1421,"description":1422},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1424,"description":1425,"path":1426,"stem":1427,"children":1428,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1429,1433,1438],{"title":1430,"path":1426,"stem":1431,"description":1432},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1434,"path":1435,"stem":1436,"description":1437},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1439,"path":1440,"stem":1441,"description":1442},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186637]