[{"data":1,"prerenderedAt":1787},["ShallowReactive",2],{"page-\u002Fagentic-modelling\u002F09-follow-a-credential":3,"navigation":1466},{"id":4,"title":5,"body":6,"description":1458,"extension":1459,"meta":1460,"navigation":1461,"path":1462,"seo":1463,"stem":1464,"__hash__":1465},"docs\u002F07.agentic-modelling\u002F09.09-follow-a-credential.md","Lesson 9: Follow a Credential",{"type":7,"value":8,"toc":1440},"minimark",[9,13,31,36,39,42,46,54,62,65,81,85,90,93,99,104,123,129,134,139,145,331,342,346,349,368,378,388,391,395,401,455,461,464,487,493,503,510,514,520,540,545,555,565,578,587,600,604,607,624,632,684,686,690,733,737,739,755,759,769,772,776,793,796,800,882,897,900,905,957,961,963,979,983,991,997,1003,1012,1021,1027,1038,1041,1045,1048,1060,1063,1099,1101,1106,1158,1163,1165,1189,1193,1202,1208,1237,1251,1253,1257,1262,1283,1287,1299,1301,1306,1340,1345,1347,1363,1366,1374,1378,1386,1395,1407,1419,1428,1430,1434],[10,11,5],"h1",{"id":12},"lesson-9-follow-a-credential",[14,15,16,21,22,26,27],"p",{},[17,18,20],"a",{"href":19},"\u002Fagentic-modelling","Training overview"," · Lesson 9 of 11 · Previous: ",[17,23,25],{"href":24},"\u002Fagentic-modelling\u002F08-leave-unknowns-open","Leave what you don't know open"," · Next: ",[17,28,30],{"href":29},"\u002Fagentic-modelling\u002F10-what-gets-in","Watch what gets into knowledge and memory",[32,33,35],"h2",{"id":34},"goal","Goal",[14,37,38],{},"A credential is a chain: a foothold, a reach to where the credential sits, and what it opens.",[14,40,41],{},"After this lesson you can draw a credential where it really sits, read the three legs of its chain, and tell which facts about the key the team has to give you.",[32,43,45],{"id":44},"what-you-start-from","What you start from",[14,47,48,49,53],{},"Your model from lesson 8, or import ",[17,50,52],{"href":51},"\u002Fguides\u002Fagentic-modelling\u002FL8-solution.zip","L8-solution.zip",".",[14,55,56,57,61],{},"The model refers to the lesson 7 control by name. If you import it, create that control first, as ",[17,58,60],{"href":59},"\u002Fagentic-modelling\u002F08-leave-unknowns-open#what-you-start-from","lesson 8"," describes.",[14,63,64],{},"The team that runs the copilot gives it a code tool, so it can work through the logs and exports customers paste into their tickets. The tool runs in the copilot's own container.",[14,66,67,71,72,75,76,80],{},[68,69,70],"strong",{},"The approval answer still holds."," Lesson 6's answer, ",[68,73,74],{},"All Consequential Action Paths Require Approval",", covers every consequential action the copilot takes, and running code is one. You ask the team, and they confirm that code runs wait for the same approval, so the answer stays ",[77,78,79],"code",{},"true",". A new tool reopens the answers it touches: ask again before you keep one given before the tool existed.",[32,82,84],{"id":83},"the-recipe-step","The recipe step",[86,87,89],"h3",{"id":88},"step-7-draw-where-each-credential-sits-and-what-it-opens","Step 7: Draw where each credential sits and what it opens",[14,91,92],{},"Draw each credential where it really sits: on the container or host that holds it, on every flow that presents it, and the store or service it opens at the end of that flow. A cloud role that a host's metadata endpoint serves sits on the host: draw the agent's container inside the host and the role on the host, with no arrow to the endpoint. Answer a credential's own facts (expiry, rotation, scope) and the host's metadata settings only as the team states them.",[14,94,95,98],{},[68,96,97],{},"Why:"," A credential is a chain: an injected agent runs where a credential can be reached, takes it, and opens something with it. The analysis follows the chain through what you draw, and finds a metadata endpoint's role with no arrow drawn. A credential drawn in the wrong place, or not at all, hides the chain.",[14,100,101],{},[68,102,103],{},"Ask:",[105,106,107,111,114,117,120],"ul",{},[108,109,110],"li",{},"Which credentials sit where the agent runs: in its container, or on its host, served by the host's metadata endpoint?",[108,112,113],{},"What does each credential open, and over which flow?",[108,115,116],{},"Can the agent run code, or fetch an address it is given, where a credential can be reached?",[108,118,119],{},"Is the host's metadata endpoint limited (IMDSv2, a hop limit), and does the agent's container share the host's PID, IPC or network namespace?",[108,121,122],{},"Does the agent's approval answer still cover the tool it just gained?",[14,124,125,128],{},[68,126,127],{},"Classes:"," Agent Credential, EC2 Instance, STS Temporary Credentials, Container.",[14,130,131],{},[68,132,133],{},"What the analysis reads here:",[105,135,136],{},[108,137,138],{},"A cloud credential a host's metadata endpoint serves: STS Temporary Credentials, and 1 more in modules you may have installed.",[14,140,141,144],{},[68,142,143],{},"Looks safe"," is the answer a guess would pick. Write it only when someone who knows has said so.",[146,147,153],"div",{"className":148,"tabIndex":150,"role":151,"ariaLabel":152},[149],"table-frame",0,"region","Table: Step 7: Draw where each credential sits and what it opens",[154,155,156,174],"table",{},[157,158,159],"thead",{},[160,161,162,166,169,171],"tr",{},[163,164,165],"th",{},"On",[163,167,168],{},"Field",[163,170,143],{},[163,172,173],{},"What it decides",[175,176,177,201,228,249,271,291,310],"tbody",{},[160,178,179,183,193,198],{},[180,181,182],"td",{},"STS Temporary Credentials",[180,184,185,188,189,192],{},[68,186,187],{},"IMDS HTTP Endpoint Enabled"," (",[77,190,191],{},"imds_http_endpoint_enabled",", under Network & Connectivity)",[180,194,195],{},[77,196,197],{},"false",[180,199,200],{},"Whether the host's metadata endpoint is cut off from the agent, or the credential is kept where it can read it",[160,202,203,205,214,226],{},[180,204,182],{},[180,206,207,188,210,213],{},[68,208,209],{},"IMDSv2 Required (HttpTokens=required)",[77,211,212],{},"imdsv2_required",", under Authentication & Access)",[180,215,216,218,219,222,223],{},[77,217,79],{},", and only together with ",[77,220,221],{},"imds_hop_limit"," = ",[77,224,225],{},"1",[180,227,200],{},[160,229,230,232,239,247],{},[180,231,182],{},[180,233,234,188,237,192],{},[68,235,236],{},"IMDS PUT Response Hop Limit",[77,238,221],{},[180,240,241,218,243,222,245],{},[77,242,225],{},[77,244,212],{},[77,246,79],{},[180,248,200],{},[160,250,251,254,261,269],{},[180,252,253],{},"EC2 Instance, EKS Node Group",[180,255,256,188,259,213],{},[68,257,258],{},"IMDSv2 Required",[77,260,212],{},[180,262,263,218,265,222,267],{},[77,264,79],{},[77,266,221],{},[77,268,225],{},[180,270,200],{},[160,272,273,275,281,289],{},[180,274,253],{},[180,276,277,188,279,213],{},[68,278,236],{},[77,280,221],{},[180,282,283,218,285,222,287],{},[77,284,225],{},[77,286,212],{},[77,288,79],{},[180,290,200],{},[160,292,293,295,304,308],{},[180,294,182],{},[180,296,297,188,300,303],{},[68,298,299],{},"Credentials Materialized in Logs \u002F Env",[77,301,302],{},"credentials_materialized_in_logs_or_env",", under Secrets & Credentials)",[180,305,306],{},[77,307,197],{},[180,309,200],{},[160,311,312,315,324,328],{},[180,313,314],{},"Container",[180,316,317,188,320,323],{},[68,318,319],{},"Host PID\u002FIPC\u002Fnetwork namespaces not shared",[77,321,322],{},"container_host_namespaces_not_shared",", under Host Isolation)",[180,325,326],{},[77,327,79],{},[180,329,330],{},"A container whose isolation from its host decides whether a hop limit cuts the metadata reach",[14,332,333,334,337,338,341],{},"You drew the CRM API key the way this step asks in lesson 2: on ",[68,335,336],{},"Copilot container",", which holds it, and on ",[68,339,340],{},"CRM lookup",", which presents it. Since then the analysis has asked whether the copilot can read its container's files and environment. This lesson answers that question.",[32,343,345],{"id":344},"steps","Steps",[14,347,348],{},"The team tells you the copilot now runs code. Record it:",[350,351,352],"ol",{},[108,353,354,355,358,359,188,362,365,366,53],{},"On ",[68,356,357],{},"Support copilot",", set ",[68,360,361],{},"Code Execution Tools Present",[77,363,364],{},"code_execution_tools_present",", under Application Security) = ",[77,367,79],{},[14,369,370,371,374,375,53],{},"The field shows ",[68,372,373],{},"No"," from lesson 5, where the team said the copilot runs no code. Choose ",[68,376,377],{},"Yes",[14,379,380,383,384,387],{},[68,381,382],{},"Save the answer."," The ",[68,385,386],{},"Attributes"," tab keeps your change until you click the save icon on the right of the panel. The icon has no label. A tab with unsaved changes shows a dot after its name.",[14,389,390],{},"Generate again.",[32,392,394],{"id":393},"what-you-should-see","What you should see",[14,396,397,400],{},[68,398,399],{},"Findings:"," 3 systemic findings: 2 Confirmed · 1 Not ruled out.",[146,402,405],{"className":403,"tabIndex":150,"role":151,"ariaLabel":404},[149],"Table: What you should see",[154,406,407,420],{},[157,408,409],{},[160,410,411,414,417],{},[163,412,413],{},"Finding",[163,415,416],{},"State",[163,418,419],{},"Legs",[175,421,422,433,444],{},[160,423,424,427,430],{},[180,425,426],{},"Credential chain at CRM API key",[180,428,429],{},"Confirmed · control modelled on foothold",[180,431,432],{},"foothold present · reach present · unlock present · weak credential undetermined (aggravating)",[160,434,435,438,441],{},[180,436,437],{},"Lethal trifecta at Support copilot",[180,439,440],{},"Confirmed · control modelled on U, X",[180,442,443],{},"U present · P present · X present · W absent (aggravating)",[160,445,446,449,452],{},[180,447,448],{},"Lethal trifecta at Ticket summariser",[180,450,451],{},"Not ruled out · unmitigated",[180,453,454],{},"U present · P present · X undetermined · W absent (aggravating)",[14,456,457,460],{},[68,458,459],{},"Facts to establish:"," 3 questions.",[14,462,463],{},"Open questions on Not ruled out findings:",[105,465,466],{},[108,467,468,469],{},"Lethal trifecta at Ticket summariser:\n",[105,470,471,474,477],{},[108,472,473],{},"Can an untrusted party read what reaches CRM?",[108,475,476],{},"Every drawn route from CRM ends inside; assert its outbound flows complete if nothing else leaves it",[108,478,479,480,188,483,486],{},"Draw the outbound flows of Staff console, or answer ",[68,481,482],{},"Markdown Image Rendering Policy",[77,484,485],{},"markdown_image_rendering_policy",", in Output Rendering Exfiltration) on Staff console",[14,488,489,492],{},[68,490,491],{},"Model gaps:"," No gaps these patterns can detect; not an attestation of completeness.",[14,494,495,496,498,499,502],{},"A new finding appears: ",[68,497,426],{},", ",[68,500,501],{},"Confirmed",". Its legs read foothold present, reach present, unlock present, and weak credential undetermined. The lethal trifectas at the copilot and at the summariser keep their states from lesson 8, and so do the summariser's three questions.",[14,504,505,506,509],{},"The two questions under ",[68,507,508],{},"Facts that could raise a finding"," in lesson 8 are gone. Both asked about a harness that reads files for an agent, which matters only to reach the CRM API key. The copilot now reaches the key itself, and the key now has a finding, so neither is asked.",[32,511,513],{"id":512},"what-changed-and-why","What changed and why",[14,515,516,519],{},[68,517,518],{},"The key's question became a finding."," Expand the chain. It lists its paths, foothold → reach → unlock, and then each leg with its routes. Each required leg has one present route:",[105,521,522,528,534],{},[108,523,524,527],{},[68,525,526],{},"foothold",": the injected copilot. It reads untrusted content, from lesson 2, and now runs code.",[108,529,530,533],{},[68,531,532],{},"reach",": its route reads \"shared space of Copilot container\". Code the copilot runs can read the container's files and environment, and the key sits in that environment.",[108,535,536,539],{},[68,537,538],{},"unlock",": its route reads \"CRM handles Customer records\". Whoever holds the key can read the customer records.",[14,541,542,543,53],{},"All three required legs are present, so the chain is ",[68,544,501],{},[14,546,547,550,551,554],{},[68,548,549],{},"Weak credential is undetermined."," It is the chain's aggravating leg: it ranks the finding, but never decides it, so ",[68,552,553],{},"Facts to establish"," does not ask about it. The key's own facts settle it: whether it expires, whether it is rotated, and how far its scope reaches. Those are facts about the key, not the copilot, and only the team that issued it can give them. The exercise below answers them.",[14,556,557,560,561,564],{},[68,558,559],{},"The summariser holds the same key."," The chain also lists ",[68,562,563],{},"Ticket summariser"," as a foothold and a reach, both undetermined: the summariser's container holds the key too. One present route is enough for a leg, so those routes do not change the result and are not asked.",[14,566,567,570,571,574,575,577],{},[68,568,569],{},"P gains a route."," On the copilot's trifecta, the P leg now has a present ",[68,572,573],{},"shared space"," route for the CRM API key, on ",[68,576,336],{},". In lesson 2 this route was undetermined. The key is private data in its own right, and the copilot can now read it.",[14,579,580,583,584,586],{},[68,581,582],{},"Draw your host."," A credential sits where it is held, not where it is used. The key is used on ",[68,585,340],{},", but it is held in the container's environment, and that is where an injected copilot finds it. Draw the holder first, then every flow that presents the credential, then what it opens at the end of that flow. A credential drawn in the wrong place, or not at all, hides the chain.",[14,588,589,592,593,188,596,599],{},[68,590,591],{},"A sandbox is an answer the team gives."," The class has a field for it, ",[68,594,595],{},"Code Execution Sandboxed",[77,597,598],{},"code_execution_sandboxed",", under Application Security). Threat Patterns 0.1.6 and later read it. Stated sandboxed, the copilot's code reads nothing of its container, so the CRM API key's chain is not raised, unless something else reads the container. Answer it only when the team confirms four things: the sandbox mounts none of the copilot's files or working directory, receives none of its secrets or environment variables, holds no cloud or host credentials of its own, and its network cannot reach the cloud metadata endpoint or the copilot's own services. Never answer it as a guess: the chain disappears, and nothing on screen says it was a guess. The last exercise below shows what changes.",[32,601,603],{"id":602},"exercise-the-keys-own-facts","Exercise: The key's own facts",[14,605,606],{},"The team that issued the CRM API key confirms four facts about it: it expires, it is rotated, it is scoped to the CRM records the copilot needs, and it carries only the permissions the copilot needs.",[14,608,609,610,613,614,616,617,620,621,623],{},"These facts are on the key itself. Open the ",[68,611,612],{},"Data"," tab of ",[68,615,340],{}," and click the pencil icon on the key's row. The dialog reads ",[68,618,619],{},"Edit Data Entity",". Go to its ",[68,622,386],{}," tab, answer as below, and save with the save icon at the bottom right of the dialog. It stays greyed out until something changes.",[14,625,626,627,631],{},"On a scratch copy: import ",[17,628,630],{"href":629},"\u002Fguides\u002Fagentic-modelling\u002FL9-solution.zip","L9-solution.zip"," and rename it.",[350,633,634],{},[108,635,354,636,639,640],{},[68,637,638],{},"CRM API key",", set:\n",[105,641,642,653,663,674],{},[108,643,644,188,647,650,651],{},[68,645,646],{},"Credential Expiry Enforced",[77,648,649],{},"credential_expiry_enforced",", under Secrets & Credentials) = ",[77,652,79],{},[108,654,655,188,658,650,661],{},[68,656,657],{},"Key Rotation Enabled",[77,659,660],{},"key_rotation_enabled",[77,662,79],{},[108,664,665,188,668,671,672],{},[68,666,667],{},"Resource Scope Restricted",[77,669,670],{},"resource_scope_restricted",", under Authorization & RBAC) = ",[77,673,79],{},[108,675,676,188,679,671,682],{},[68,677,678],{},"Permission Scope Minimized",[77,680,681],{},"permission_scope_minimized",[77,683,79],{},[14,685,390],{},[14,687,688,400],{},[68,689,399],{},[146,691,694],{"className":692,"tabIndex":150,"role":151,"ariaLabel":693},[149],"Table: Exercise: The key's own facts",[154,695,696,706],{},[157,697,698],{},[160,699,700,702,704],{},[163,701,413],{},[163,703,416],{},[163,705,419],{},[175,707,708,717,725],{},[160,709,710,712,714],{},[180,711,426],{},[180,713,429],{},[180,715,716],{},"foothold present · reach present · unlock present · weak credential absent (aggravating)",[160,718,719,721,723],{},[180,720,437],{},[180,722,440],{},[180,724,443],{},[160,726,727,729,731],{},[180,728,448],{},[180,730,451],{},[180,732,454],{},[14,734,735,460],{},[68,736,459],{},[14,738,463],{},[105,740,741],{},[108,742,468,743],{},[105,744,745,747,749],{},[108,746,473],{},[108,748,476],{},[108,750,479,751,188,753,486],{},[68,752,482],{},[77,754,485],{},[14,756,757,492],{},[68,758,491],{},[14,760,761,762,764,765,53],{},"Weak credential goes absent, and the chain stays ",[68,763,501],{},". A well-kept key still sits where the injected copilot can take it, and it still opens the CRM. Weak credential is aggravating, so it never decided the finding. Only a changed fact that makes a required leg absent removes a chain, as in ",[17,766,768],{"href":767},"\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","lesson 6",[14,770,771],{},"Delete the copy when you are done.",[32,773,775],{"id":774},"exercise-the-cloud-host","Exercise: The cloud host",[14,777,778,779,188,782,785,786,188,789,792],{},"This exercise needs the AWS class modules ",[68,780,781],{},"AWS Compute & Containers",[77,783,784],{},"aws-compute-containers",") and ",[68,787,788],{},"AWS Identity & Cryptography",[77,790,791],{},"aws-identity-cryptography",") installed on your platform. Without them, the classes EC2 Instance and STS Temporary Credentials are not in the class picker. If they are missing, read the exercise and skip the drawing.",[14,794,795],{},"The team tells you more about where the copilot runs. Its container runs on an EC2 instance. An attachment service on the same instance stores the files customers attach to their tickets, and it uses the instance's role to write them to an attachment store. The copilot does not use the role.",[14,797,626,798,631],{},[17,799,630],{"href":629},[350,801,802,812,821,829,836,842,861,868,874],{},[108,803,804,805,808,809,53],{},"Add the boundary ",[68,806,807],{},"Copilot host"," (class EC2 Instance), inside ",[68,810,811],{},"Support network",[108,813,814,815,818,819,53],{},"Add ",[68,816,817],{},"Attachment service"," (class Application Service), inside ",[68,820,807],{},[108,822,814,823,826,827,53],{},[68,824,825],{},"Attachment store"," (class Object Storage), inside ",[68,828,811],{},[108,830,831,832,835],{},"Add the data item ",[68,833,834],{},"Copilot host role"," (class STS Temporary Credentials). Sensitivity: Restricted; Origin: Curated internal; Credential: Yes — a credential.",[108,837,831,838,841],{},[68,839,840],{},"Ticket attachments"," (class User Input). Sensitivity: Confidential; Origin: Arbitrary public; Credential: No.",[108,843,844,845,848,849,851,852,854,855,857,858,860],{},"Draw ",[68,846,847],{},"Store attachments"," (class HTTP\u002FS Request) from ",[68,850,817],{}," to ",[68,853,825],{},", and tick ",[68,856,834],{}," and ",[68,859,840],{}," on its Data tab.",[108,862,863,864,851,866,53],{},"Attach ",[68,865,834],{},[68,867,807],{},[108,869,863,870,851,872,53],{},[68,871,840],{},[68,873,825],{},[108,875,876,877,879,880,53],{},"Move ",[68,878,336],{}," into ",[68,881,807],{},[14,883,884,887,888,890,891,893,894,896],{},[68,885,886],{},"Moving the container into the host (step 9)."," A boundary nests in another only when you drop it fully inside a larger one. Drag a corner of ",[68,889,807],{}," until it is larger than ",[68,892,336],{}," on both sides. Then drag the container and drop it fully inside the host. To check, drag ",[68,895,807],{}," a little: the container moves with it.",[14,898,899],{},"Draw no arrow to the instance's metadata endpoint. Generate again.",[14,901,902,904],{},[68,903,399],{}," 4 systemic findings: 3 Confirmed · 1 Not ruled out.",[146,906,909],{"className":907,"tabIndex":150,"role":151,"ariaLabel":908},[149],"Table: Exercise: The cloud host",[154,910,911,921],{},[157,912,913],{},[160,914,915,917,919],{},[163,916,413],{},[163,918,416],{},[163,920,419],{},[175,922,923,931,941,949],{},[160,924,925,927,929],{},[180,926,426],{},[180,928,429],{},[180,930,432],{},[160,932,933,936,939],{},[180,934,935],{},"Credential chain at Copilot host role",[180,937,938],{},"Confirmed · control modelled on foothold, reach",[180,940,432],{},[160,942,943,945,947],{},[180,944,437],{},[180,946,440],{},[180,948,443],{},[160,950,951,953,955],{},[180,952,448],{},[180,954,451],{},[180,956,454],{},[14,958,959,460],{},[68,960,459],{},[14,962,463],{},[105,964,965],{},[108,966,468,967],{},[105,968,969,971,973],{},[108,970,473],{},[108,972,476],{},[108,974,479,975,188,977,486],{},[68,976,482],{},[77,978,485],{},[14,980,981,492],{},[68,982,491],{},[14,984,985,986,498,988,990],{},"A second chain appears: ",[68,987,935],{},[68,989,501],{},". Its legs read foothold present, reach present, unlock present, and weak credential undetermined. The CRM API key's chain is unchanged.",[14,992,993,996],{},[68,994,995],{},"The analysis found the reach with no arrow drawn."," The reach route reads \"Copilot host role served by the credential endpoint of Copilot host\". An EC2 instance serves its role to whatever on the instance asks its metadata endpoint for it, and the copilot has two ways to ask. Its code runs on the instance, inside its container, and can ask the endpoint directly. Its web fetch from lesson 4 can be pointed at the endpoint's address, and the role comes back into its context. That is the foothold route's basis: \"untrusted input in the context the credential is returned into\". The role lands beside the tickets and pages an attacker writes.",[14,998,999,1002],{},[68,1000,1001],{},"Taking the code tool away would not remove this reach."," The web fetch still asks the endpoint.",[14,1004,1005,1008,1009,1011],{},[68,1006,1007],{},"The unlock follows the attachment service's flow."," The unlock route reads \"Attachment store handles Ticket attachments\". The role opens the store because ",[68,1010,847],{}," carries it there. The copilot never uses the role, yet an injected copilot can take it and open the store.",[14,1013,1014,1017,1018,1020],{},[68,1015,1016],{},"Why the role sits on the host."," The metadata endpoint belongs to the instance, and so does the role it serves. The role is in no file or environment variable of the copilot's container. Drawn inside the container, it would say the container holds it in a file or its environment, which is false. Drawn on ",[68,1019,807],{},", with the container inside the host, it says what is true: anything running on the instance can ask for it.",[14,1022,1023,1026],{},[68,1024,1025],{},"Why there is no arrow to the endpoint."," Nothing in the copilot calls the metadata endpoint. The reach is something an injected copilot could do, not traffic that happens. An arrow would draw a call that does not exist. Draw the role on the host and the container inside it, and the analysis finds the endpoint's reach from that.",[14,1028,1029,1030,1032,1033,1035,1036,53],{},"The copilot's trifecta also gains a present ",[68,1031,573],{}," route on its P leg, for ",[68,1034,834],{}," on ",[68,1037,807],{},[14,1039,1040],{},"Keep this copy for the next exercise.",[32,1042,1044],{"id":1043},"exercise-the-hop-limit","Exercise: The hop limit",[14,1046,1047],{},"You ask the platform team how the instance's metadata endpoint is set up. They confirm that the instance requires IMDSv2 with a hop limit of 1, and that the copilot's container shares none of the host's PID, IPC and network namespaces. The container's field claims all three, so the team has to confirm all three.",[14,1049,1050,1051,1053,1054,1056,1057,1059],{},"Double-click ",[68,1052,807],{}," and set the first answers on its ",[68,1055,386],{}," tab. Set the namespace answer on ",[68,1058,336],{},". Save each.",[14,1061,1062],{},"Continue on your copy from the exercise before.",[350,1064,1065,1088],{},[108,1066,354,1067,639,1069],{},[68,1068,807],{},[105,1070,1071,1080],{},[108,1072,1073,188,1075,1077,1078],{},[68,1074,258],{},[77,1076,212],{},", under Authentication & Access) = ",[77,1079,79],{},[108,1081,1082,188,1084,1077,1086],{},[68,1083,236],{},[77,1085,221],{},[77,1087,225],{},[108,1089,354,1090,358,1092,188,1094,1096,1097,53],{},[68,1091,336],{},[68,1093,319],{},[77,1095,322],{},", under Host Isolation) = ",[77,1098,79],{},[14,1100,390],{},[14,1102,1103,1105],{},[68,1104,399],{}," 4 systemic findings: 2 Confirmed · 2 Not ruled out.",[146,1107,1110],{"className":1108,"tabIndex":150,"role":151,"ariaLabel":1109},[149],"Table: Exercise: The hop limit",[154,1111,1112,1122],{},[157,1113,1114],{},[160,1115,1116,1118,1120],{},[163,1117,413],{},[163,1119,416],{},[163,1121,419],{},[175,1123,1124,1132,1142,1150],{},[160,1125,1126,1128,1130],{},[180,1127,426],{},[180,1129,429],{},[180,1131,432],{},[160,1133,1134,1136,1139],{},[180,1135,935],{},[180,1137,1138],{},"Not ruled out · control modelled on foothold",[180,1140,1141],{},"foothold present · reach undetermined · unlock present · weak credential undetermined (aggravating)",[160,1143,1144,1146,1148],{},[180,1145,437],{},[180,1147,440],{},[180,1149,443],{},[160,1151,1152,1154,1156],{},[180,1153,448],{},[180,1155,451],{},[180,1157,454],{},[14,1159,1160,1162],{},[68,1161,459],{}," 4 questions.",[14,1164,463],{},[105,1166,1167,1181],{},[108,1168,468,1169],{},[105,1170,1171,1173,1179],{},[108,1172,473],{},[108,1174,479,1175,188,1177,486],{},[68,1176,482],{},[77,1178,485],{},[108,1180,476],{},[108,1182,1183,1184],{},"Credential chain at Copilot host role:\n",[105,1185,1186],{},[108,1187,1188],{},"Is Copilot host role also kept on disk on Copilot host, where Support copilot can read it?",[14,1190,1191,492],{},[68,1192,491],{},[14,1194,1195,1196,1199,1200,53],{},"The role's chain falls to ",[68,1197,1198],{},"Not ruled out",": foothold present, reach undetermined, unlock present. The reach route now reads \"shared space of Copilot host\". The CRM API key's chain is still ",[68,1201,501],{},[14,1203,1204,1207],{},[68,1205,1206],{},"The hop limit cut the endpoint's reach."," With IMDSv2 and a hop limit of 1, the endpoint's token cannot travel the extra network hop from the container to the instance, so neither the copilot's code nor its web fetch can get the role from it. The container's answer matters as much as the hop limit: a hop limit of 1 stops a container one hop behind the host, not a process on the host itself, and a container that shares the host's network is not one hop behind.",[14,1209,1210,1213,1214,1217,1218,1221,1222,188,1224,1226,1227,1229,1230,1232,1233,1236],{},[68,1211,1212],{},"One question stays."," Under ",[68,1215,1216],{},"Open questions on Not ruled out findings",", the chain asks: ",[1219,1220,1188],"em",{}," The role may also sit in a file on the instance, for example in a host directory mounted into the copilot's container. Only the platform team can say. The question reads ",[68,1223,299],{},[77,1225,302],{},", under Secrets & Credentials) on ",[68,1228,834],{},". Answer it ",[77,1231,197],{}," only if the team confirms the role is never written to disk, to logs or to the environment. Otherwise leave the question open, and give it an owner and a date, as in ",[17,1234,60],{"href":1235},"\u002Fagentic-modelling\u002F08-leave-unknowns-open#who-settles-these-questions",". Until it is settled, treat the reach as possible.",[14,1238,1239,1242,1243,1245,1246,1035,1248,1250],{},[68,1240,1241],{},"P still lists the role."," The copilot's trifecta keeps its present ",[68,1244,573],{}," route for ",[68,1247,834],{},[68,1249,807],{},". P counts what sits in the copilot's space; the chain asks the sharper question of whether the copilot can read it.",[14,1252,771],{},[32,1254,1256],{"id":1255},"exercise-the-sandbox","Exercise: The sandbox",[14,1258,1259,1260,53],{},"This exercise needs Threat Patterns 0.1.6 or later, because earlier versions do not read ",[68,1261,595],{},[14,1263,1264,1265,1267,1268,1270,1271,1273,1274,1276,1277,1279,1280,1282],{},"The team confirms that the code tool runs in a sandbox that mounts none of the copilot's files or working directory, receives none of its secrets or environment variables, and holds no cloud or host credentials of its own. The sandbox's network cannot reach the cloud metadata endpoint or the copilot's own services. Double-click ",[68,1266,357],{},", choose ",[68,1269,377],{}," for ",[68,1272,595],{}," on its ",[68,1275,386],{}," tab, and save. The field shows only while ",[68,1278,361],{}," is ",[68,1281,377],{},", as it is since this lesson's step.",[14,1284,626,1285,631],{},[17,1286,630],{"href":629},[350,1288,1289],{},[108,1290,354,1291,358,1293,188,1295,365,1297,53],{},[68,1292,357],{},[68,1294,595],{},[77,1296,598],{},[77,1298,79],{},[14,1300,390],{},[14,1302,1303,1305],{},[68,1304,399],{}," 2 systemic findings: 1 Confirmed · 1 Not ruled out.",[146,1307,1310],{"className":1308,"tabIndex":150,"role":151,"ariaLabel":1309},[149],"Table: Exercise: The sandbox",[154,1311,1312,1322],{},[157,1313,1314],{},[160,1315,1316,1318,1320],{},[163,1317,413],{},[163,1319,416],{},[163,1321,419],{},[175,1323,1324,1332],{},[160,1325,1326,1328,1330],{},[180,1327,437],{},[180,1329,440],{},[180,1331,443],{},[160,1333,1334,1336,1338],{},[180,1335,448],{},[180,1337,451],{},[180,1339,454],{},[14,1341,1342,1344],{},[68,1343,459],{}," 5 questions.",[14,1346,463],{},[105,1348,1349],{},[108,1350,468,1351],{},[105,1352,1353,1355,1357],{},[108,1354,473],{},[108,1356,476],{},[108,1358,479,1359,188,1361,486],{},[68,1360,482],{},[77,1362,485],{},[14,1364,1365],{},"Facts that could raise a finding:",[105,1367,1368,1371],{},[108,1369,1370],{},"Draw the Agent Tool Call from Support copilot to the harness that reads files for it, if there is one (its code runs sandboxed)",[108,1372,1373],{},"Draw the Agent Tool Call from Ticket summariser to the harness that reads files for it, if there is one",[14,1375,1376,492],{},[68,1377,491],{},[14,1379,1380,1381,1383,1384,53],{},"The credential chain at the CRM API key is gone. The lethal trifectas at the copilot and at the summariser keep their states: the copilot's is still ",[68,1382,501],{},", the summariser's still ",[68,1385,1198],{},[14,1387,1388,1391,1392,1394],{},[68,1389,1390],{},"Sandboxed code reads nothing of the container."," The chain's reach leg rested on the copilot's code reading ",[68,1393,336],{},", where the key sits. Stated sandboxed, the code has no reach to the container, and nothing else drawn reads it, so no reach leg is present and no chain is raised.",[14,1396,1397,1400,1401,1403,1404,1406],{},[68,1398,1399],{},"The key's questions come back."," With no finding on the key, the questions about it return under ",[68,1402,508],{},". The copilot's carries one addition: ",[1219,1405,1370],{},". A sandbox stops the code, not a harness that reads files for the copilot. The summariser's question from lesson 8 returns beside it.",[14,1408,1409,1412,1413,1415,1416,1418],{},[68,1410,1411],{},"P loses the route."," On the copilot's trifecta, the ",[68,1414,573],{}," route for the CRM API key on ",[68,1417,336],{}," goes back to undetermined, as it was in lesson 2.",[14,1420,1421,1424,1425,1427],{},[68,1422,1423],{},"Answer it only when the team confirms it."," The chain was ",[68,1426,501],{},", and one answer removed it. If the code can in fact read the container, an injected copilot can still take the key, and the model no longer shows it. A guessed sandbox hides a real chain.",[14,1429,771],{},[32,1431,1433],{"id":1432},"next","Next",[14,1435,1436,1439],{},[17,1437,1438],{"href":29},"Lesson 10: Watch what gets into knowledge and memory",". The copilot gains a knowledge base and a memory, and you draw how content gets into them.",{"title":1441,"searchDepth":1442,"depth":1442,"links":1443},"",3,[1444,1446,1447,1450,1451,1452,1453,1454,1455,1456,1457],{"id":34,"depth":1445,"text":35},2,{"id":44,"depth":1445,"text":45},{"id":83,"depth":1445,"text":84,"children":1448},[1449],{"id":88,"depth":1442,"text":89},{"id":344,"depth":1445,"text":345},{"id":393,"depth":1445,"text":394},{"id":512,"depth":1445,"text":513},{"id":602,"depth":1445,"text":603},{"id":774,"depth":1445,"text":775},{"id":1043,"depth":1445,"text":1044},{"id":1255,"depth":1445,"text":1256},{"id":1432,"depth":1445,"text":1433},"Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory","md",{},true,"\u002Fagentic-modelling\u002F09-follow-a-credential",{"title":5,"description":1458},"07.agentic-modelling\u002F09.09-follow-a-credential","HaSJn1tJs1Ppdx3MxAOlTkjyx9DsT0lDPntBNPu_ves",[1467,1522,1557,1612,1646,1690,1705,1767],{"title":1468,"description":1469,"path":1470,"stem":1471,"children":1472,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1473,1477,1482,1487,1492,1497,1502,1507,1512,1517],{"title":1474,"path":1470,"stem":1475,"description":1476},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1478,"path":1479,"stem":1480,"description":1481},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1483,"path":1484,"stem":1485,"description":1486},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1488,"path":1489,"stem":1490,"description":1491},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1493,"path":1494,"stem":1495,"description":1496},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1498,"path":1499,"stem":1500,"description":1501},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1503,"path":1504,"stem":1505,"description":1506},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1508,"path":1509,"stem":1510,"description":1511},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1513,"path":1514,"stem":1515,"description":1516},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1518,"path":1519,"stem":1520,"description":1521},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1523,"description":1524,"path":1525,"stem":1526,"children":1527,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1528,1532,1537,1542,1547,1552],{"title":1529,"path":1525,"stem":1530,"description":1531},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1533,"path":1534,"stem":1535,"description":1536},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1538,"path":1539,"stem":1540,"description":1541},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1543,"path":1544,"stem":1545,"description":1546},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1548,"path":1549,"stem":1550,"description":1551},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1553,"path":1554,"stem":1555,"description":1556},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1558,"description":1559,"path":1560,"stem":1561,"children":1562,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1563,1567,1572,1577,1582,1587,1592,1597,1602,1607],{"title":1564,"path":1560,"stem":1565,"description":1566},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1568,"path":1569,"stem":1570,"description":1571},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1573,"path":1574,"stem":1575,"description":1576},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1578,"path":1579,"stem":1580,"description":1581},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1583,"path":1584,"stem":1585,"description":1586},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1588,"path":1589,"stem":1590,"description":1591},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1593,"path":1594,"stem":1595,"description":1596},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1598,"path":1599,"stem":1600,"description":1601},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1603,"path":1604,"stem":1605,"description":1606},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1608,"path":1609,"stem":1610,"description":1611},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1613,"description":1614,"path":1615,"stem":1616,"children":1617,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1618,1621,1626,1631,1636,1641],{"title":1613,"path":1615,"stem":1619,"description":1620},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1622,"path":1623,"stem":1624,"description":1625},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1627,"path":1628,"stem":1629,"description":1630},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1632,"path":1633,"stem":1634,"description":1635},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1637,"path":1638,"stem":1639,"description":1640},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1642,"path":1643,"stem":1644,"description":1645},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1647,"description":1648,"path":1649,"stem":1650,"children":1651,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1652,1656,1661,1666,1671,1676,1680,1685],{"title":1653,"path":1649,"stem":1654,"description":1655},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1657,"path":1658,"stem":1659,"description":1660},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1662,"path":1663,"stem":1664,"description":1665},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1667,"path":1668,"stem":1669,"description":1670},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1672,"path":1673,"stem":1674,"description":1675},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1627,"path":1677,"stem":1678,"description":1679},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1681,"path":1682,"stem":1683,"description":1684},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1686,"path":1687,"stem":1688,"description":1689},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1691,"description":1692,"path":1693,"stem":1694,"children":1695,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1696,1700],{"title":1697,"path":1693,"stem":1698,"description":1699},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1701,"path":1702,"stem":1703,"description":1704},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1706,"description":1707,"path":19,"stem":1708,"children":1709,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","07.agentic-modelling",[1710,1714,1719,1724,1729,1734,1739,1743,1748,1752,1753,1757,1762],{"title":1711,"path":19,"stem":1712,"description":1713},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1715,"path":1716,"stem":1717,"description":1718},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1720,"path":1721,"stem":1722,"description":1723},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1725,"path":1726,"stem":1727,"description":1728},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1730,"path":1731,"stem":1732,"description":1733},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1735,"path":1736,"stem":1737,"description":1738},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1740,"path":767,"stem":1741,"description":1742},"Lesson 6: Fix a Finding With a Fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1744,"path":1745,"stem":1746,"description":1747},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1749,"path":24,"stem":1750,"description":1751},"Lesson 8: Leave What You Don't Know Open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":5,"path":1462,"stem":1464,"description":1458},{"title":1754,"path":29,"stem":1755,"description":1756},"Lesson 10: Watch What Gets Into Knowledge and Memory","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1758,"path":1759,"stem":1760,"description":1761},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1763,"path":1764,"stem":1765,"description":1766},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1768,"description":1769,"path":1770,"stem":1771,"children":1772,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1773,1777,1782],{"title":1774,"path":1770,"stem":1775,"description":1776},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1778,"path":1779,"stem":1780,"description":1781},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1783,"path":1784,"stem":1785,"description":1786},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186643]