[{"data":1,"prerenderedAt":1668},["ShallowReactive",2],{"page-\u002Fagentic-modelling\u002F11-tools-and-handoffs":3,"navigation":1346},{"id":4,"title":5,"body":6,"description":1338,"extension":1339,"meta":1340,"navigation":1341,"path":1342,"seo":1343,"stem":1344,"__hash__":1345},"docs\u002F07.agentic-modelling\u002F11.11-tools-and-handoffs.md","Lesson 11: Draw Tools From Others and Hand-offs",{"type":7,"value":8,"toc":1321},"minimark",[9,13,26,31,34,37,41,49,62,65,86,90,95,98,104,109,120,126,129,133,154,325,345,348,368,371,375,381,466,472,475,506,509,530,536,539,558,561,565,571,600,603,615,631,640,650,672,682,692,704,708,711,719,738,740,745,815,819,821,852,854,864,868,916,919,922,926,933,937,967,969,973,1033,1038,1040,1064,1066,1076,1080,1109,1122,1131,1133,1137,1150,1154,1171,1173,1178,1228,1232,1234,1256,1258,1271,1275,1281,1293,1301,1303,1307,1315],[10,11,5],"h1",{"id":12},"lesson-11-draw-tools-from-others-and-hand-offs",[14,15,16,21,22],"p",{},[17,18,20],"a",{"href":19},"\u002Fagentic-modelling","Training overview"," · Lesson 11 of 11 · Previous: ",[17,23,25],{"href":24},"\u002Fagentic-modelling\u002F10-what-gets-in","Watch what gets into knowledge and memory",[27,28,30],"h2",{"id":29},"goal","Goal",[14,32,33],{},"A tool server another party runs is an element with its own facts. A hand-off carries one agent's untrusted input to another.",[14,35,36],{},"After this lesson you can draw a third-party tool server and a hand-off between agents, read what the analysis asks about each, and tell which of those questions only the other party can answer.",[27,38,40],{"id":39},"what-you-start-from","What you start from",[14,42,43,44,48],{},"Your model from lesson 10, or import ",[17,45,47],{"href":46},"\u002Fguides\u002Fagentic-modelling\u002FL10-solution.zip","L10-solution.zip",".",[14,50,51,52,56,57,61],{},"The model refers to the lesson 7 control by name. If you import it, create that control first, as ",[17,53,55],{"href":54},"\u002Fagentic-modelling\u002F08-leave-unknowns-open#what-you-start-from","lesson 8"," describes, with the answer ",[17,58,60],{"href":59},"\u002Fagentic-modelling\u002F10-what-gets-in#steps","lesson 10"," changed.",[14,63,64],{},"The team adds refunds. You ask how they work, and they tell you:",[66,67,68,77,80,83],"ul",{},[69,70,71,72,76],"li",{},"The copilot does not issue refunds itself. It hands each refund request to a third agent, the ",[73,74,75],"strong",{},"Refund agent",", which runs in its own container and sends its decision back.",[69,78,79],{},"The Refund agent issues refunds on its own. Nobody approves them.",[69,81,82],{},"It issues them through the payment provider's MCP server, which the provider runs. The server's tools issue refunds, and the server creates each refund at the provider's payment service.",[69,84,85],{},"The Refund agent presents a payments API key to the server. The key sits in the Refund agent container's environment.",[27,87,89],{"id":88},"the-recipe-step","The recipe step",[91,92,94],"h3",{"id":93},"step-9-draw-tools-from-others-and-agents-handing-work-to-agents","Step 9: Draw tools from others and agents handing work to agents",[14,96,97],{},"Draw a tool server another party runs (an MCP server) as its own element, in that party's boundary, with the facts its tools carry, and the agent's call to it as an Agent Tool Call. Draw a hand-off to another agent as an Agent Tool Call and what comes back as a Context Ingress. Draw every way the receiving agent takes content in, and state each item's origin from where it really comes from.",[14,99,100,103],{},[73,101,102],{},"Why:"," A tool server acts for the agent and sends content back to it; a hand-off carries the first agent's untrusted input to the second. Neither shows unless it is drawn as what it is.",[14,105,106],{},[73,107,108],{},"Ask:",[66,110,111,114,117],{},[69,112,113],{},"Which tool servers does the agent call, who runs them, and can their tools change anything?",[69,115,116],{},"Does the agent hand work to another agent, and over which flow?",[69,118,119],{},"What does the receiving agent read, and who writes it?",[14,121,122,125],{},[73,123,124],{},"Classes:"," Remote MCP Server, Agent Tool Call, Context Ingress, Agent Service.",[14,127,128],{},"Two things look like a plain request and are not. A tool server sends content back that the agent's model reads, and its tools act for the agent. A hand-off passes work, and the content it came from, to another agent's model. Draw both as what they are, or the analysis cannot follow them.",[27,130,132],{"id":131},"steps","Steps",[14,134,135,138,139,142,143,146,147,150,151,48],{},[73,136,137],{},"Draw the Refund agent, the provider and the hand-off."," Set each element's answers on its ",[73,140,141],{},"Attributes"," tab (double-click the element) and save. As in lesson 5, ",[73,144,145],{},"All Consequential Action Paths Require Approval"," appears only after you choose ",[73,148,149],{},"Yes"," for ",[73,152,153],{},"Consequential Tools Present",[155,156,157,167,173,218,239,247,254,267,277,290,300,310,318],"ol",{},[69,158,159,160,163,164,48],{},"Add the boundary ",[73,161,162],{},"Refund agent container"," (class Container), inside ",[73,165,166],{},"Support network",[69,168,159,169,172],{},[73,170,171],{},"Payments provider"," (class Network Segment, zone Vendor (Trusted external)).",[69,174,175,176,178,179,181,182],{},"Add ",[73,177,75],{}," (class Agent Service), inside ",[73,180,162],{},", answering:\n",[66,183,184,197,207],{},[69,185,186,188,189,193,194],{},[73,187,153],{}," (",[190,191,192],"code",{},"consequential_tools_present",", under Human Oversight) = ",[190,195,196],{},"true",[69,198,199,188,201,193,204],{},[73,200,145],{},[190,202,203],{},"consequential_tools_all_require_approval",[190,205,206],{},"false",[69,208,209,188,212,215,216],{},[73,210,211],{},"Third-Party Tools or MCP Servers Used",[190,213,214],{},"third_party_tools_or_mcp_servers_used",", under Supply Chain Integrity) = ",[190,217,196],{},[69,219,175,220,223,224,181,226],{},[73,221,222],{},"Payments MCP server"," (class Remote MCP Server), inside ",[73,225,171],{},[66,227,228],{},[69,229,230,188,233,236,237],{},[73,231,232],{},"Destructive Tools Exposed",[190,234,235],{},"destructive_tools_exposed",", under Authorization & RBAC) = ",[190,238,196],{},[69,240,175,241,244,245,48],{},[73,242,243],{},"Payment service"," (class Application Service), inside ",[73,246,171],{},[69,248,249,250,253],{},"Add the data item ",[73,251,252],{},"Payments API key"," (class Agent Credential). Sensitivity: Restricted; Origin: Curated internal; Credential: Yes — a credential.",[69,255,256,257,260,261,264,265,48],{},"Draw ",[73,258,259],{},"Hand off refund"," (class Agent Tool Call) from ",[73,262,263],{},"Support copilot"," to ",[73,266,75],{},[69,268,256,269,272,273,264,275,48],{},[73,270,271],{},"Context Ingress: refund decision"," (class Context Ingress) from ",[73,274,75],{},[73,276,263],{},[69,278,256,279,260,282,264,284,286,287,289],{},[73,280,281],{},"Issue refund",[73,283,75],{},[73,285,222],{},", and tick ",[73,288,252],{}," on its Data tab.",[69,291,256,292,295,296,264,298,48],{},[73,293,294],{},"Create refund"," (class HTTP\u002FS Request) from ",[73,297,222],{},[73,299,243],{},[69,301,302,303,305,306,309],{},"On the Data tab of ",[73,304,259],{},", add the data item ",[73,307,308],{},"Refund request"," (no class). Sensitivity: Internal; Credential: No.",[69,311,302,312,305,314,317],{},[73,313,271],{},[73,315,316],{},"Refund decision"," (no class). Sensitivity: Internal; Origin: Agent relayed; Credential: No.",[69,319,320,321,264,323,48],{},"Attach ",[73,322,252],{},[73,324,162],{},[14,326,327,329,330,333,334,337,338,341,342,48],{},[73,328,171],{}," takes the zone the CRM vendor took in lesson 3: on its ",[73,331,332],{},"Zoning"," tab, pick ",[73,335,336],{},"Trusted external"," in the ",[73,339,340],{},"Trust zone"," list, and the diagram shows the pill ",[73,343,344],{},"Vendor",[14,346,347],{},"The drawing follows two habits from earlier lessons:",[66,349,350,356],{},[69,351,352,355],{},[73,353,354],{},"The hand-off is an Agent Tool Call, and the decision comes back on a Context Ingress",", as lesson 1's step says for any hand-off between agents.",[69,357,358,361,362,364,365,367],{},[73,359,360],{},"The Payments API key sits where it is held",", as lesson 9 teaches: on ",[73,363,162],{},", and on ",[73,366,281],{},", the flow that presents it.",[14,369,370],{},"Generate again.",[27,372,374],{"id":373},"what-you-should-see","What you should see",[14,376,377,380],{},[73,378,379],{},"Findings:"," 5 systemic findings: 3 Confirmed · 2 Not ruled out.",[382,383,389],"div",{"className":384,"tabIndex":386,"role":387,"ariaLabel":388},[385],"table-frame",0,"region","Table: What you should see",[390,391,392,408],"table",{},[393,394,395],"thead",{},[396,397,398,402,405],"tr",{},[399,400,401],"th",{},"Finding",[399,403,404],{},"State",[399,406,407],{},"Legs",[409,410,411,423,434,445,456],"tbody",{},[396,412,413,417,420],{},[414,415,416],"td",{},"Credential chain at CRM API key",[414,418,419],{},"Confirmed · control modelled on foothold",[414,421,422],{},"foothold present · reach present · unlock present · weak credential undetermined (aggravating)",[396,424,425,428,431],{},[414,426,427],{},"Lethal trifecta at Support copilot",[414,429,430],{},"Confirmed · control modelled on U, X",[414,432,433],{},"U present · P present · X present · W absent (aggravating)",[396,435,436,439,442],{},[414,437,438],{},"Lethal trifecta at Ticket summariser",[414,440,441],{},"Not ruled out · unmitigated",[414,443,444],{},"U present · P present · X undetermined · W absent (aggravating)",[396,446,447,450,453],{},[414,448,449],{},"Delegation hop at Refund agent",[414,451,452],{},"Confirmed · control modelled on untrusted content at the delegator, origin carried to the delegate, delegate holds the rest",[414,454,455],{},"untrusted content at the delegator present · origin carried to the delegate present · delegate holds the rest present · open delegation undetermined (aggravating)",[396,457,458,461,463],{},[414,459,460],{},"Injection to action at Refund agent",[414,462,441],{},[414,464,465],{},"untrusted input undetermined · action tools present · no gate present · sensitive target undetermined (aggravating) · broad identity undetermined (aggravating)",[14,467,468,471],{},[73,469,470],{},"Facts to establish:"," 8 questions.",[14,473,474],{},"Open questions on Not ruled out findings:",[66,476,477,498],{},[69,478,479,480],{},"Lethal trifecta at Ticket summariser:\n",[66,481,482,485,488],{},[69,483,484],{},"Can an untrusted party read what reaches CRM?",[69,486,487],{},"Every drawn route from CRM ends inside; assert its outbound flows complete if nothing else leaves it",[69,489,490,491,188,494,497],{},"Draw the outbound flows of Staff console, or answer ",[73,492,493],{},"Markdown Image Rendering Policy",[190,495,496],{},"markdown_image_rendering_policy",", in Output Rendering Exfiltration) on Staff console",[69,499,500,501],{},"Injection to action at Refund agent:\n",[66,502,503],{},[69,504,505],{},"Draw the data items on Payments MCP server",[14,507,508],{},"Facts that could raise a finding:",[66,510,511,521,524,527],{},[69,512,513,514,188,517,520],{},"Set the attribute ",[73,515,516],{},"Code Execution Tools Present",[190,518,519],{},"code_execution_tools_present",", in Application Security) on Refund agent, or draw its Agent Tool Call to the harness",[69,522,523],{},"Draw or classify the data Payments MCP server handles",[69,525,526],{},"Can an untrusted party read what reaches Payments MCP server?",[69,528,529],{},"Every drawn route from Payments MCP server ends inside; assert its outbound flows complete if nothing else leaves it",[14,531,532,535],{},[73,533,534],{},"Model gaps:"," No gaps these patterns can detect; not an attestation of completeness.",[14,537,538],{},"Two findings appear at the Refund agent:",[66,540,541,550],{},[69,542,543,545,546,549],{},[73,544,449],{},", ",[73,547,548],{},"Confirmed",": untrusted content at the delegator present, origin carried to the delegate present, delegate holds the rest present, and open delegation undetermined.",[69,551,552,545,554,557],{},[73,553,460],{},[73,555,556],{},"Not ruled out",": untrusted input undetermined, action tools present, no gate present. Its aggravating legs, sensitive target and broad identity, are undetermined.",[14,559,560],{},"The copilot's and the summariser's trifectas and the CRM API key's chain keep their states.",[27,562,564],{"id":563},"what-changed-and-why","What changed and why",[14,566,567,570],{},[73,568,569],{},"The hand-off carries the copilot's untrusted input."," The delegation hop's legs read in order:",[66,572,573,579,588,594],{},[69,574,575,578],{},[73,576,577],{},"untrusted content at the delegator",": the copilot reads tickets and fetched pages anyone can write.",[69,580,581,584,585,587],{},[73,582,583],{},"origin carried to the delegate",": its route reads \"relayed from Support copilot (depth 1)\". ",[73,586,259],{}," is an Agent Tool Call from one agent to another, so the analysis carries the copilot's untrusted origin across it.",[69,589,590,593],{},[73,591,592],{},"delegate holds the rest",": the Refund agent has tools that act, and no gate. Its private data and its way out are undetermined; one present route is enough.",[69,595,596,599],{},[73,597,598],{},"open delegation"," is aggravating, so it is not asked.",[14,601,602],{},"An injected ticket can steer the copilot into a refund request the attacker wrote, and the Refund agent acts on it without anyone approving.",[14,604,605,608,609,611,612,614],{},[73,606,607],{},"The Refund agent can act, and nothing gates it."," Injection to action reads its action tools on two routes: the agent's own, from ",[73,610,153],{},", and the MCP server's, from ",[73,613,232],{},". Its no-gate leg comes from your answer that its actions do not all need approval.",[14,616,617,620,621,623,624,627,628,48],{},[73,618,619],{},"Its own untrusted input is the open part."," Injection to action reads only the agent's own ways in; what reaches it through the hand-off is the delegation hop's leg. The Refund agent has one way in of its own drawn: the Payments MCP server, as a route that is undetermined. So the finding is ",[73,622,556],{},", and its question, under ",[73,625,626],{},"Open questions on Not ruled out findings",", is: ",[629,630,505],"em",{},[14,632,633,636,637,48],{},[73,634,635],{},"What the question asks."," A tool server sends content back to the agent that calls it: the results of its tools, and the descriptions of the tools themselves, which the agent's model reads to decide what to call. Who writes that content decides whether the Refund agent reads untrusted input. A refund status may carry text the payment provider took from elsewhere, and the provider can change its tool descriptions at any time. Only the provider can say what the server sends and where it comes from. Leave the question open until they do, and give it an owner and a date, as in ",[17,638,55],{"href":639},"\u002Fagentic-modelling\u002F08-leave-unknowns-open#who-settles-these-questions",[14,641,642,645,646,649],{},[73,643,644],{},"Below the bar."," Four more questions sit under ",[73,647,648],{},"Facts that could raise a finding",":",[66,651,652,661],{},[69,653,654,660],{},[629,655,656,657,659],{},"Set the attribute Code Execution Tools Present (",[190,658,519],{},", in Application Security) on Refund agent, or draw its Agent Tool Call to the harness."," It is lesson 2's question, now for the Payments API key in the Refund agent's container: can the Refund agent read its container's files and environment?",[69,662,663,664,545,666,668,669,671],{},"Three about the Payments MCP server: ",[629,665,523],{},[629,667,526],{}," and ",[629,670,529],{},". The provider owns these answers too.",[14,673,674,677,678,681],{},[73,675,676],{},"The last question has a second button."," Beside it sits ",[73,679,680],{},"Assert outbound flows complete",". Do not use it until the provider confirms that every flow leaving the server is drawn.",[14,683,684,687,688,691],{},[73,685,686],{},"The decision coming back."," The refund decision's origin is ",[73,689,690],{},"Agent relayed",": the Refund agent's model writes it, from content others can steer. On the copilot's trifecta, the U leg lists the decision's own route as absent, and a separate route relayed from the Refund agent as undetermined. The analysis follows the Refund agent's input on that relayed route, so whatever the Refund agent reads could ride back to the copilot on its decision.",[14,693,694,697,698,700,701,703],{},[73,695,696],{},"Each agent's approval answer covers its own actions."," You ask the team whether the copilot's approval answer from lesson 6 still holds now that it hands refunds off. They confirm that a staff member approves each hand-off of a refund, so the answer stays ",[190,699,196],{},". The Refund agent issues the refund with no approval, and that is its own answer, ",[190,702,206],{},". A new tool, tool server or hand-off reopens the answers it touches: ask again before you keep one given before it existed.",[27,705,707],{"id":706},"exercise-the-guess","Exercise: The guess",[14,709,710],{},"On a scratch copy, before asking anyone, make two guesses in one drawing. Assume the Refund agent reads only the refund status the Payments MCP server reports, and that the status is first party because it reports on your own refund.",[14,712,713,714,718],{},"On a scratch copy: import ",[17,715,717],{"href":716},"\u002Fguides\u002Fagentic-modelling\u002FL11-solution.zip","L11-solution.zip"," and rename it.",[155,720,721,730],{},[69,722,256,723,272,726,264,728,48],{},[73,724,725],{},"Context Ingress: refund status",[73,727,222],{},[73,729,75],{},[69,731,302,732,305,734,737],{},[73,733,725],{},[73,735,736],{},"Refund status"," (no class). Sensitivity: Internal; Origin: Authenticated first party; Credential: No.",[14,739,370],{},[14,741,742,744],{},[73,743,379],{}," 6 systemic findings: 3 Confirmed · 3 Not ruled out.",[382,746,749],{"className":747,"tabIndex":386,"role":387,"ariaLabel":748},[385],"Table: Exercise: The guess",[390,750,751,761],{},[393,752,753],{},[396,754,755,757,759],{},[399,756,401],{},[399,758,404],{},[399,760,407],{},[409,762,763,771,779,787,798,807],{},[396,764,765,767,769],{},[414,766,416],{},[414,768,419],{},[414,770,422],{},[396,772,773,775,777],{},[414,774,427],{},[414,776,430],{},[414,778,433],{},[396,780,781,783,785],{},[414,782,438],{},[414,784,441],{},[414,786,444],{},[396,788,789,792,795],{},[414,790,791],{},"Lethal trifecta at Refund agent",[414,793,794],{},"Not ruled out · control modelled on U",[414,796,797],{},"U present · P present · X undetermined · W present (aggravating)",[396,799,800,802,805],{},[414,801,449],{},[414,803,804],{},"Confirmed · control modelled on untrusted content at the delegator, origin carried to the delegate",[414,806,455],{},[396,808,809,811,813],{},[414,810,460],{},[414,812,441],{},[414,814,465],{},[14,816,817,471],{},[73,818,470],{},[14,820,474],{},[66,822,823,837,846],{},[69,824,479,825],{},[66,826,827,829,831],{},[69,828,484],{},[69,830,487],{},[69,832,490,833,188,835,497],{},[73,834,493],{},[190,836,496],{},[69,838,839,840],{},"Lethal trifecta at Refund agent:\n",[66,841,842,844],{},[69,843,526],{},[69,845,529],{},[69,847,500,848],{},[66,849,850],{},[69,851,505],{},[14,853,508],{},[66,855,856,862],{},[69,857,513,858,188,860,520],{},[73,859,516],{},[190,861,519],{},[69,863,523],{},[14,865,866,535],{},[73,867,534],{},[66,869,870,879,889,911],{},[69,871,872,875,876,878],{},[73,873,874],{},"Injection to action stays Not ruled out."," The refund status route reads absent, because you stated it first party. The MCP server's own route is still undetermined, and ",[629,877,505],{}," is still asked. A drawn ingress from the server does not say what else the server sends.",[69,880,881,884,885,888],{},[73,882,883],{},"A lethal trifecta at Refund agent appears, Not ruled out."," Its U is present, relayed from the copilot: its route reads \"relayed from Support copilot (depth 1)\". Its P is present, from the ",[73,886,887],{},"Internal"," refund status you drew. Its X is undetermined, on the Refund agent's flow to the Payments MCP server, in the Vendor zone.",[69,890,891,894,895,668,897,899,900,902,903,905,906,908,909,48],{},[73,892,893],{},"Two questions move up."," ",[629,896,526],{},[629,898,529],{}," leave ",[73,901,648],{},". They now sit under ",[73,904,626],{},", under the lethal trifecta at Refund agent. Below the bar, ",[629,907,523],{}," stays, beside the code question. It is a different question from ",[629,910,505],{},[69,912,913],{},[73,914,915],{},"The delegation hop stays Confirmed.",[14,917,918],{},"The guess changed what you see without settling anything. The model now says the Refund agent reads only first-party content, and nobody told you that. Compare it with the next exercise.",[14,920,921],{},"Delete the copy when you are done.",[27,923,925],{"id":924},"exercise-the-truth","Exercise: The truth",[14,927,928,929,932],{},"Now ask the team, and draw what they tell you. The Refund agent reads the refund status the payment provider reports. That status is the provider's data, so its origin is ",[73,930,931],{},"Third party",". It also reads the ticket history, to check the customer's claim. On a fresh scratch copy:",[14,934,713,935,718],{},[17,936,717],{"href":716},[155,938,939,947,960],{},[69,940,256,941,272,943,264,945,48],{},[73,942,725],{},[73,944,222],{},[73,946,75],{},[69,948,256,949,272,952,264,955,286,957,289],{},[73,950,951],{},"Context Ingress: ticket history",[73,953,954],{},"Ticket system",[73,956,75],{},[73,958,959],{},"Ticket text",[69,961,302,962,305,964,966],{},[73,963,725],{},[73,965,736],{}," (no class). Sensitivity: Internal; Origin: Third party; Credential: No.",[14,968,370],{},[14,970,971,380],{},[73,972,379],{},[382,974,977],{"className":975,"tabIndex":386,"role":387,"ariaLabel":976},[385],"Table: Exercise: The truth",[390,978,979,989],{},[393,980,981],{},[396,982,983,985,987],{},[399,984,401],{},[399,986,404],{},[399,988,407],{},[409,990,991,999,1007,1015,1023],{},[396,992,993,995,997],{},[414,994,416],{},[414,996,419],{},[414,998,422],{},[396,1000,1001,1003,1005],{},[414,1002,427],{},[414,1004,430],{},[414,1006,433],{},[396,1008,1009,1011,1013],{},[414,1010,791],{},[414,1012,441],{},[414,1014,797],{},[396,1016,1017,1019,1021],{},[414,1018,438],{},[414,1020,441],{},[414,1022,444],{},[396,1024,1025,1027,1030],{},[414,1026,460],{},[414,1028,1029],{},"Confirmed · unmitigated",[414,1031,1032],{},"untrusted input present · action tools present · no gate present · sensitive target undetermined (aggravating) · broad identity undetermined (aggravating)",[14,1034,1035,1037],{},[73,1036,470],{}," 7 questions.",[14,1039,474],{},[66,1041,1042,1050],{},[69,1043,839,1044],{},[66,1045,1046,1048],{},[69,1047,526],{},[69,1049,529],{},[69,1051,479,1052],{},[66,1053,1054,1056,1062],{},[69,1055,484],{},[69,1057,490,1058,188,1060,497],{},[73,1059,493],{},[190,1061,496],{},[69,1063,487],{},[14,1065,508],{},[66,1067,1068,1074],{},[69,1069,513,1070,188,1072,520],{},[73,1071,516],{},[190,1073,519],{},[69,1075,523],{},[14,1077,1078,535],{},[73,1079,534],{},[66,1081,1082,1094,1100,1106],{},[69,1083,1084,1087,1088,1090,1091,1093],{},[73,1085,1086],{},"Injection to action at Refund agent is Confirmed."," Untrusted input is present on two routes: the refund status, which the provider writes, and the ticket history, which carries ticket text that customers write. The Refund agent reads content others write and issues refunds nobody approves. ",[629,1089,505],{}," is no longer asked: one present route is enough. ",[629,1092,523],{}," still sits below the bar.",[69,1095,1096,1099],{},[73,1097,1098],{},"The delegation hop is gone from the list."," The Refund agent now has untrusted input of its own, and the analysis raises a delegation hop only for an agent whose own untrusted input is not present. The hand-off is still a live way in. If the team later closes the Refund agent's own inputs, the delegation hop comes back, so keep the hand-off in the remediation plan.",[69,1101,1102,1105],{},[73,1103,1104],{},"The lethal trifecta at Refund agent is Not ruled out",", with the same two questions about what reaches the Payments MCP server.",[69,1107,1108],{},"On the copilot's trifecta, the route relayed back from the Refund agent now reads present.",[14,1110,1111,1114,1115,188,1118,1121],{},[73,1112,1113],{},"The tool-description question is unasked, not settled."," The MCP server's own route on the untrusted input leg is still undetermined, but the analysis no longer asks about it, because other routes are present. What the provider's tool descriptions say is still unknown. The fact that covers them is ",[73,1116,1117],{},"Tool Descriptions Pinned and Reviewed",[190,1119,1120],{},"tool_descriptions_pinned_and_reviewed",", under Supply Chain Integrity) on the untrusted-content isolation control.",[14,1123,1124,1125,1127,1128,1130],{},"Set side by side with the guess, the difference is one origin and one flow. The guess left a finding ",[73,1126,556],{}," with a question; the truth makes it ",[73,1129,548],{},". Never state a vendor's data first party.",[14,1132,921],{},[27,1134,1136],{"id":1135},"exercise-a-hand-off-drawn-as-a-request","Exercise: A hand-off drawn as a request",[14,1138,1139,1140,1142,1143,1145,1146,1149],{},"Redraw ",[73,1141,259],{}," as an HTTP\u002FS Request instead of an Agent Tool Call. ",[73,1144,308],{}," is on neither end of the new flow, so the Data tab's list does not show it at first: choose ",[73,1147,1148],{},"All"," above the list to find it.",[14,1151,713,1152,718],{},[17,1153,717],{"href":716},[155,1155,1156,1161],{},[69,1157,1158,1159,48],{},"Delete ",[73,1160,259],{},[69,1162,256,1163,295,1165,264,1167,286,1169,289],{},[73,1164,259],{},[73,1166,263],{},[73,1168,75],{},[73,1170,308],{},[14,1172,370],{},[14,1174,1175,1177],{},[73,1176,379],{}," 4 systemic findings: 2 Confirmed · 2 Not ruled out.",[382,1179,1182],{"className":1180,"tabIndex":386,"role":387,"ariaLabel":1181},[385],"Table: Exercise: A hand-off drawn as a request",[390,1183,1184,1194],{},[393,1185,1186],{},[396,1187,1188,1190,1192],{},[399,1189,401],{},[399,1191,404],{},[399,1193,407],{},[409,1195,1196,1204,1212,1220],{},[396,1197,1198,1200,1202],{},[414,1199,416],{},[414,1201,419],{},[414,1203,422],{},[396,1205,1206,1208,1210],{},[414,1207,427],{},[414,1209,430],{},[414,1211,433],{},[396,1213,1214,1216,1218],{},[414,1215,438],{},[414,1217,441],{},[414,1219,444],{},[396,1221,1222,1224,1226],{},[414,1223,460],{},[414,1225,441],{},[414,1227,465],{},[14,1229,1230,1037],{},[73,1231,470],{},[14,1233,474],{},[66,1235,1236,1250],{},[69,1237,479,1238],{},[66,1239,1240,1242,1248],{},[69,1241,484],{},[69,1243,490,1244,188,1246,497],{},[73,1245,493],{},[190,1247,496],{},[69,1249,487],{},[69,1251,500,1252],{},[66,1253,1254],{},[69,1255,505],{},[14,1257,508],{},[66,1259,1260,1263,1269],{},[69,1261,1262],{},"Is Hand off refund a hand-off? If so, redraw it as an Agent Tool Call",[69,1264,513,1265,188,1267,520],{},[73,1266,516],{},[190,1268,519],{},[69,1270,523],{},[14,1272,1273,535],{},[73,1274,534],{},[14,1276,1277,1278,1280],{},"The delegation hop is gone. Injection to action at the Refund agent stays ",[73,1279,556],{},", with the same question about the Payments MCP server.",[14,1282,1283,1284,1286,1287,1289,1290,48],{},"Under ",[73,1285,648],{},", a new question asks: ",[629,1288,1262],{},". Beside it is a second button, ",[73,1291,1292],{},"Assert not a hand-off, and Refund agent's model never reads it",[14,1294,1295,1296,1300],{},"Here the assertion would be false. The Refund agent's model reads the refund request and decides on it: that is what a hand-off is. Do not assert it. Redraw the flow as an Agent Tool Call. Use the assertion only for a flow that hands no work on and whose content the receiving agent's model never reads, and only when someone who knows confirms it. See ",[17,1297,1299],{"href":1298},"\u002Fthreat-patterns#act-on-a-question","Act on a question"," in the Threat Patterns guide.",[14,1302,921],{},[27,1304,1306],{"id":1305},"next","Next",[14,1308,1309,1310,1314],{},"You have finished the training. To model your own system, keep ",[17,1311,1313],{"href":1312},"\u002Fagentic-modelling\u002Frecipe-at-a-glance","the recipe at a glance"," open beside the model editor, and work through the steps in order. When the analysis asks a question you cannot answer, leave it open.",[14,1316,1317,1318,48],{},"Back to the ",[17,1319,1320],{"href":19},"training overview",{"title":1322,"searchDepth":1323,"depth":1323,"links":1324},"",3,[1325,1327,1328,1331,1332,1333,1334,1335,1336,1337],{"id":29,"depth":1326,"text":30},2,{"id":39,"depth":1326,"text":40},{"id":88,"depth":1326,"text":89,"children":1329},[1330],{"id":93,"depth":1323,"text":94},{"id":131,"depth":1326,"text":132},{"id":373,"depth":1326,"text":374},{"id":563,"depth":1326,"text":564},{"id":706,"depth":1326,"text":707},{"id":924,"depth":1326,"text":925},{"id":1135,"depth":1326,"text":1136},{"id":1305,"depth":1326,"text":1306},"Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory","md",{},true,"\u002Fagentic-modelling\u002F11-tools-and-handoffs",{"title":5,"description":1338},"07.agentic-modelling\u002F11.11-tools-and-handoffs","YxrxqQJ8C1jJuUdgi8u2TuWQkRkablraTMG5mMKP_X4",[1347,1402,1437,1492,1526,1570,1585,1648],{"title":1348,"description":1349,"path":1350,"stem":1351,"children":1352,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1353,1357,1362,1367,1372,1377,1382,1387,1392,1397],{"title":1354,"path":1350,"stem":1355,"description":1356},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1358,"path":1359,"stem":1360,"description":1361},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1363,"path":1364,"stem":1365,"description":1366},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1368,"path":1369,"stem":1370,"description":1371},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1373,"path":1374,"stem":1375,"description":1376},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1378,"path":1379,"stem":1380,"description":1381},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1383,"path":1384,"stem":1385,"description":1386},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1388,"path":1389,"stem":1390,"description":1391},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1393,"path":1394,"stem":1395,"description":1396},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1398,"path":1399,"stem":1400,"description":1401},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1403,"description":1404,"path":1405,"stem":1406,"children":1407,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1408,1412,1417,1422,1427,1432],{"title":1409,"path":1405,"stem":1410,"description":1411},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1413,"path":1414,"stem":1415,"description":1416},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1418,"path":1419,"stem":1420,"description":1421},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1423,"path":1424,"stem":1425,"description":1426},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1428,"path":1429,"stem":1430,"description":1431},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1433,"path":1434,"stem":1435,"description":1436},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1438,"description":1439,"path":1440,"stem":1441,"children":1442,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1443,1447,1452,1457,1462,1467,1472,1477,1482,1487],{"title":1444,"path":1440,"stem":1445,"description":1446},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1448,"path":1449,"stem":1450,"description":1451},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1453,"path":1454,"stem":1455,"description":1456},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1458,"path":1459,"stem":1460,"description":1461},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1463,"path":1464,"stem":1465,"description":1466},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1468,"path":1469,"stem":1470,"description":1471},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1473,"path":1474,"stem":1475,"description":1476},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1478,"path":1479,"stem":1480,"description":1481},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1483,"path":1484,"stem":1485,"description":1486},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1488,"path":1489,"stem":1490,"description":1491},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1493,"description":1494,"path":1495,"stem":1496,"children":1497,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1498,1501,1506,1511,1516,1521],{"title":1493,"path":1495,"stem":1499,"description":1500},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1502,"path":1503,"stem":1504,"description":1505},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1507,"path":1508,"stem":1509,"description":1510},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1512,"path":1513,"stem":1514,"description":1515},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1517,"path":1518,"stem":1519,"description":1520},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1522,"path":1523,"stem":1524,"description":1525},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1527,"description":1528,"path":1529,"stem":1530,"children":1531,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1532,1536,1541,1546,1551,1556,1560,1565],{"title":1533,"path":1529,"stem":1534,"description":1535},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1537,"path":1538,"stem":1539,"description":1540},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1542,"path":1543,"stem":1544,"description":1545},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1547,"path":1548,"stem":1549,"description":1550},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1552,"path":1553,"stem":1554,"description":1555},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1507,"path":1557,"stem":1558,"description":1559},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1561,"path":1562,"stem":1563,"description":1564},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1566,"path":1567,"stem":1568,"description":1569},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1571,"description":1572,"path":1573,"stem":1574,"children":1575,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1576,1580],{"title":1577,"path":1573,"stem":1578,"description":1579},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1581,"path":1582,"stem":1583,"description":1584},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1586,"description":1587,"path":19,"stem":1588,"children":1589,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","07.agentic-modelling",[1590,1594,1599,1604,1609,1614,1619,1624,1629,1634,1639,1643,1644],{"title":1591,"path":19,"stem":1592,"description":1593},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1595,"path":1596,"stem":1597,"description":1598},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1600,"path":1601,"stem":1602,"description":1603},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1605,"path":1606,"stem":1607,"description":1608},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1610,"path":1611,"stem":1612,"description":1613},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1615,"path":1616,"stem":1617,"description":1618},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1620,"path":1621,"stem":1622,"description":1623},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1625,"path":1626,"stem":1627,"description":1628},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1630,"path":1631,"stem":1632,"description":1633},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1635,"path":1636,"stem":1637,"description":1638},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1640,"path":24,"stem":1641,"description":1642},"Lesson 10: Watch What Gets Into Knowledge and Memory","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":5,"path":1342,"stem":1344,"description":1338},{"title":1645,"path":1312,"stem":1646,"description":1647},"The recipe at a glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1649,"description":1650,"path":1651,"stem":1652,"children":1653,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1654,1658,1663],{"title":1655,"path":1651,"stem":1656,"description":1657},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1659,"path":1660,"stem":1661,"description":1662},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1664,"path":1665,"stem":1666,"description":1667},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186700]