[{"data":1,"prerenderedAt":2103},["ShallowReactive",2],{"page-\u002Fagentic-modelling\u002Frecipe-at-a-glance":3,"navigation":1779},{"id":4,"title":5,"body":6,"description":1771,"extension":1772,"meta":1773,"navigation":1774,"path":1775,"seo":1776,"stem":1777,"__hash__":1778},"docs\u002F07.agentic-modelling\u002F12.recipe-at-a-glance.md","The recipe at a glance",{"type":7,"value":8,"toc":1755},"minimark",[9,13,23,28,65,69,72,79,84,95,101,106,135,139,142,147,151,162,167,173,177,188,192,195,200,204,212,217,221,232,236,239,244,248,256,261,267,271,276,280,283,288,292,300,305,309,317,321,324,329,333,353,359,1116,1213,1217,1220,1225,1228,1464,1468,1471,1476,1480,1497,1502,1506,1511,1515,1682,1686,1689,1694,1698,1709,1714,1718,1723,1727,1730,1735,1739,1750],[10,11,5],"h1",{"id":12},"the-recipe-at-a-glance",[14,15,16,17,22],"p",{},"The ten steps of ",[18,19,21],"a",{"href":20},"\u002Fagentic-modelling","the training"," on one page. Each lesson teaches one or two of them.",[24,25,27],"h2",{"id":26},"rules-that-hold-throughout","Rules that hold throughout",[29,30,31,35,38,41,44,47,50,53,56,59,62],"ul",{},[32,33,34],"li",{},"An unanswered fact stays unknown. It is never read as \"no\".",[32,36,37],{},"A guess can remove a finding for good: one absent required leg means no finding.",[32,39,40],{},"An element with no zone on any boundary around it reads as Internal. It is the one fact with a default, so give every outside party a zone.",[32,42,43],{},"A drawn flow beats an egress attribute: answering \"egress restricted\" while a drawn flow still reaches an outsider keeps the way out, with a conflict note.",[32,45,46],{},"A vendor destination is a question, not an answer: can an untrusted party read what reaches it?",[32,48,49],{},"Origin \"Not assessed\" is an answer and counts as untrusted; an empty origin is not an answer.",[32,51,52],{},"A Context Ingress whose source is in an Untrusted zone, or is an Untrusted Content Source or a Public AI Artifact Hub, makes its content untrusted even with no item drawn on it.",[32,54,55],{},"A control never removes a finding. It credits a route: \"control modelled\", or \"detected only\" for detection.",[32,57,58],{},"Assert outbound flows complete is an answer, not a shortcut: it settles an element's ways out as absent. Use it only when someone who knows confirms every outbound flow is drawn.",[32,60,61],{},"A new tool, channel or hand-off reopens the answers it touches: ask again before you keep an approval or a control answer given before it existed.",[32,63,64],{},"Assert not a hand-off is an answer too: use it only when someone who knows confirms that the flow hands no work on and the receiving agent's model never reads what it carries.",[24,66,68],{"id":67},"_0-draw-the-agent","0. Draw the agent",[14,70,71],{},"One Agent Service per agent, or per group of agents with the same tools, model and context sources. A runtime product (a harness, an agent server or a platform) is its own element. Draw an Agent Runtime boundary only around two or more agents when no container holds exactly their process space. Never draw below the agent: a tool call is a flow, and what it calls (an MCP server, an API, a shell, a harness) is an element. A hand-off from one agent to another is an Agent Tool Call, and its result a Context Ingress back, drawn directly between the two agents.",[14,73,74,78],{},[75,76,77],"strong",{},"Why:"," Every agent pattern is about one agent. A tool drawn as its own agent splits one agent's facts across elements that cannot add up.",[14,80,81],{},[75,82,83],{},"Ask:",[29,85,86,89,92],{},[32,87,88],{},"Which agents does the system run, and which of them share the same tools, model and context sources?",[32,90,91],{},"What hosts each agent: a harness, an agent server, a platform, or nothing (a standalone service)?",[32,93,94],{},"Which agents hand work to another agent, and which agent holds the tools that act?",[14,96,97,100],{},[75,98,99],{},"Classes:"," Agent Service, Agent Harness, Agent Server, Agent Runtime, Agent Code Execution Sandbox.",[14,102,103],{},[75,104,105],{},"What the analysis reads here:",[29,107,108,111,114,117,120,123,126,129,132],{},[32,109,110],{},"An agent: Agent Service.",[32,112,113],{},"A remote agent you reach over A2A: Remote A2A Agent.",[32,115,116],{},"A harness that runs an agent and approves its actions: Agent Harness.",[32,118,119],{},"A boundary around agents that share one process space: Agent Runtime.",[32,121,122],{},"A sandbox the agent runs code in: Agent Code Execution Sandbox.",[32,124,125],{},"An agent platform that hosts agents: AnythingLLM, Dify, Flowise, Langflow, LibreChat, LobeHub, MaxKB, n8n, Open WebUI, OpenClaw, RAGFlow.",[32,127,128],{},"Something that runs code or tools for an agent: Agent Harness, Agent Server, AnythingLLM, Dify, Flowise, Langflow, LibreChat, LobeHub, MaxKB, Open WebUI, OpenClaw, RAGFlow, n8n.",[32,130,131],{},"An executor that can read files in the agent's space: Agent Harness.",[32,133,134],{},"An MCP server: Local MCP Server, Remote MCP Server.",[24,136,138],{"id":137},"_1-say-what-data-moves","1. Say what data moves",[14,140,141],{},"Draw each data item once and classify it: its sensitivity, whether it is a credential, and its origin (who can write it).",[14,143,144,146],{},[75,145,77],{}," The facts about content live on the data items: private data, untrusted content and credentials are read from them.",[14,148,149],{},[75,150,83],{},[29,152,153,156,159],{},[32,154,155],{},"Which content does each agent read: tickets, documents, web pages, tool results, memory?",[32,157,158],{},"For each item: how sensitive is it, is it a credential, and who can write it?",[32,160,161],{},"Which secrets does each agent, harness, MCP server or sandbox hold, and what does each one unlock?",[14,163,164,166],{},[75,165,99],{}," User Input, Customer & Personal Data, User Credentials, Agent Credential, System Prompt & Agent Instructions.",[14,168,169,172],{},[75,170,171],{},"Data item fields:"," Sensitivity, Credential, Origin.",[14,174,175],{},[75,176,105],{},[29,178,179,182,185],{},[32,180,181],{},"A credential: Agent Credential, STS Temporary Credentials, Authentication Tokens, User Credentials, and 9 more in modules you may have installed.",[32,183,184],{},"Agent memory: Conversation State \u002F Checkpoint, Knowledge Item.",[32,186,187],{},"A knowledge item: Knowledge Item.",[24,189,191],{"id":190},"_2-attach-the-data","2. Attach the data",[14,193,194],{},"Attach each item to every flow that carries it, above all every Context Ingress into an agent, and to every element that holds it: credential holders, stores and MCP servers. Attach a credential to its holder (the container, when it sits in an environment variable or a file) and to the tool call that presents it.",[14,196,197,199],{},[75,198,77],{}," A classified item that rides on no flow settles nothing at the agent.",[14,201,202],{},[75,203,83],{},[29,205,206,209],{},[32,207,208],{},"Which flows carry each item into the agent?",[32,210,211],{},"Which elements hold each item at rest?",[14,213,214,216],{},[75,215,99],{}," Context Ingress, Agent Tool Call, Knowledge Write.",[14,218,219],{},[75,220,105],{},[29,222,223,226,229],{},[32,224,225],{},"Content flowing into an agent: Context Ingress.",[32,227,228],{},"An agent calling a tool, an MCP server or another agent: Agent Tool Call.",[32,230,231],{},"A source whose normal traffic is the product's own: Public AI Artifact Hub.",[24,233,235],{"id":234},"_3-mark-who-is-outside","3. Mark who is outside",[14,237,238],{},"Put the open internet, and anyone who can write content the agent reads without being one of your own vetted staff or systems, in a boundary with the Untrusted zone (Open internet); an account does not make content trusted. Put vendor-operated elements in a boundary with the Vendor zone (Trusted external). The zone is what counts: a zone-only boundary needs no class. Never leave an outside party outside every boundary: it reads as internal.",[14,240,241,243],{},[75,242,77],{}," Zones decide who can read what the agent sends, and who can write what it reads.",[14,245,246],{},[75,247,83],{},[29,249,250,253],{},[32,251,252],{},"Who can write content that reaches the agent? Anyone who can sign up counts as outside.",[32,254,255],{},"Which elements does a vendor operate?",[14,257,258,260],{},[75,259,99],{}," Network Segment, Container.",[14,262,263,266],{},[75,264,265],{},"Zones:"," Untrusted (Open internet), Vendor (Trusted external), Internal.",[14,268,269],{},[75,270,105],{},[29,272,273],{},[32,274,275],{},"A model endpoint: never counted as a way out: Hosted LLM API, Self-Hosted LLM Inference.",[24,277,279],{"id":278},"_4-draw-tools-that-reach-any-host","4. Draw tools that reach any host",[14,281,282],{},"Draw every flow an agent's tools can open, outbound ones included. A tool that can reach any host (a web fetch, a shell, an image fetched while rendering) gets one flow to an \"Arbitrary internet hosts\" element in the Untrusted boundary, and the content it brings back as a Context Ingress.",[14,284,285,287],{},[75,286,77],{}," A tool that can reach any host is both a way out and a way in. Nothing infers it from an attribute: it counts only when it is drawn.",[14,289,290],{},[75,291,83],{},[29,293,294,297],{},[32,295,296],{},"Which of the agent's tools can reach a host the attacker chooses?",[32,298,299],{},"Can it reach internal addresses or the cloud metadata endpoint? If so, draw those flows too.",[14,301,302,304],{},[75,303,99],{}," Untrusted Content Source, Agent Tool Call, HTTP\u002FS Request, Context Ingress.",[14,306,307],{},[75,308,105],{},[29,310,311,314],{},[32,312,313],{},"A source whose content is untrusted by its class: Untrusted Content Source, Public AI Artifact Hub.",[32,315,316],{},"A frontend that renders model output: Agent Chat Frontend.",[24,318,320],{"id":319},"_5-state-what-the-agent-can-do","5. State what the agent can do",[14,322,323],{},"Answer the element facts the drawing cannot show: what the agent's tools can do and whether they need approval, the harness approval mode, egress restrictions, and who can write to each store. A yes-or-no field offers Yes, No and Not answered; it starts at Not answered, and choosing Not answered takes an answer back.",[14,325,326,328],{},[75,327,77],{}," Whether an agent can act on what it reads, and whether anything stops it, is not visible in a drawing.",[14,330,331],{},[75,332,83],{},[29,334,335,338,341,344,347,350],{},[32,336,337],{},"Can the agent's tools change anything outside the conversation: send, post, update, delete, pay?",[32,339,340],{},"Does every such action need a person's approval?",[32,342,343],{},"Can the agent run code?",[32,345,346],{},"Is the agent's network egress limited to an allowlist?",[32,348,349],{},"Are the agent's tool credentials limited to the user it acts for?",[32,351,352],{},"Does the chat frontend render images or links in model output?",[14,354,355,358],{},[75,356,357],{},"Looks safe"," is the answer a guess would pick. Write it only when someone who knows has said so.",[360,361,367],"div",{"className":362,"tabIndex":364,"role":365,"ariaLabel":366},[363],"table-frame",0,"region","Table: 5. State what the agent can do",[368,369,370,388],"table",{},[371,372,373],"thead",{},[374,375,376,380,383,385],"tr",{},[377,378,379],"th",{},"On",[377,381,382],{},"Field",[377,384,357],{},[377,386,387],{},"What it decides",[389,390,391,416,436,453,472,492,512,532,552,572,591,608,628,652,682,701,721,739,757,776,797,816,834,854,872,893,911,929,947,966,986,1005,1025,1043,1062,1080,1098],"tbody",{},[374,392,393,397,408,413],{},[394,395,396],"td",{},"Agent Service",[394,398,399,402,403,407],{},[75,400,401],{},"Consequential Tools Present"," (",[404,405,406],"code",{},"consequential_tools_present",", under Human Oversight)",[394,409,410],{},[404,411,412],{},"false",[394,414,415],{},"Whether the agent can act at all; whether it holds tools that act",[374,417,418,420,428,433],{},[394,419,396],{},[394,421,422,402,425,407],{},[75,423,424],{},"All Consequential Action Paths Require Approval",[404,426,427],{},"consequential_tools_all_require_approval",[394,429,430],{},[404,431,432],{},"true",[394,434,435],{},"Whether its actions wait for a person",[374,437,438,440,448,451],{},[394,439,396],{},[394,441,442,402,445,407],{},[75,443,444],{},"Approval Gate Present",[404,446,447],{},"approval_gate_present",[394,449,450],{},"—",[394,452,435],{},[374,454,455,458,466,470],{},[394,456,457],{},"Agent Chat Frontend",[394,459,460,402,463,465],{},[75,461,462],{},"All Consequential Actions Require Blocking In-Chat Approval",[404,464,427],{},", under Authorization & RBAC)",[394,467,468],{},[404,469,432],{},[394,471,435],{},[374,473,474,477,485,490],{},[394,475,476],{},"Untrusted Content Source",[394,478,479,402,482,465],{},[75,480,481],{},"Human Approval for High-Risk Actions",[404,483,484],{},"human_approval_for_high_risk_actions",[394,486,487],{},[404,488,489],{},"required",[394,491,435],{},[374,493,494,497,506,510],{},[394,495,496],{},"Agent Code Execution Sandbox",[394,498,499,402,502,505],{},[75,500,501],{},"Consequential Computer-Use Actions Confirmed",[404,503,504],{},"computer_use_consequential_actions_confirmed",", under Computer Use)",[394,507,508],{},[404,509,432],{},[394,511,435],{},[374,513,514,516,525,529],{},[394,515,396],{},[394,517,518,402,521,524],{},[75,519,520],{},"Code Execution Tools Present",[404,522,523],{},"code_execution_tools_present",", under Application Security)",[394,526,527],{},[404,528,412],{},[394,530,531],{},"Whether it can run code; whether it holds tools that act",[374,533,534,537,545,549],{},[394,535,536],{},"Local MCP Server, Remote MCP Server",[394,538,539,402,542,465],{},[75,540,541],{},"Destructive Tools Exposed",[404,543,544],{},"destructive_tools_exposed",[394,546,547],{},[404,548,412],{},[394,550,551],{},"Whether it holds tools that act",[374,553,554,556,565,569],{},[394,555,396],{},[394,557,558,402,561,564],{},[75,559,560],{},"Network Egress Default-Deny Allowlist",[404,562,563],{},"network_egress_default_deny_allowlist",", under Network & Connectivity)",[394,566,567],{},[404,568,432],{},[394,570,571],{},"Whether a way out is closed",[374,573,574,577,585,589],{},[394,575,576],{},"Agent Tool Call",[394,578,579,402,582,564],{},[75,580,581],{},"Agent Egress Restricted",[404,583,584],{},"agent_egress_restricted",[394,586,587],{},[404,588,432],{},[394,590,571],{},[374,592,593,596,602,606],{},[394,594,595],{},"Agent Harness",[394,597,598,402,600,564],{},[75,599,560],{},[404,601,563],{},[394,603,604],{},[404,605,432],{},[394,607,571],{},[374,609,610,613,622,626],{},[394,611,612],{},"Local MCP Server",[394,614,615,402,618,621],{},[75,616,617],{},"Server Network Egress Restricted",[404,619,620],{},"server_network_egress_restricted",", under Data Handling & Residency)",[394,623,624],{},[404,625,432],{},[394,627,571],{},[374,629,630,632,641,650],{},[394,631,457],{},[394,633,634,402,637,640],{},[75,635,636],{},"Markdown Image Rendering Policy",[404,638,639],{},"markdown_image_rendering_policy",", under Output Rendering Exfiltration)",[394,642,643,646,647],{},[404,644,645],{},"disabled",", ",[404,648,649],{},"allowlisted_trusted_domains_only",[394,651,571],{},[374,653,654,656,664,679],{},[394,655,595],{},[394,657,658,402,661,465],{},[75,659,660],{},"Harness Approval Mode",[404,662,663],{},"harness_approval_mode",[394,665,666,646,669,402,672,646,675,678],{},[404,667,668],{},"default",[404,670,671],{},"plan",[404,673,674],{},"on-request",[404,676,677],{},"granular",": the agents' own approval answers decide)",[394,680,681],{},"How the harness approves actions",[374,683,684,686,694,698],{},[394,685,595],{},[394,687,688,402,691,465],{},[75,689,690],{},"All-Approvals-Off Launch Flags in Use",[404,692,693],{},"dangerously_skip_permissions_in_use",[394,695,696],{},[404,697,412],{},[394,699,700],{},"A switch that skips approval whatever the mode",[374,702,703,706,714,718],{},[394,704,705],{},"Context Ingress",[394,707,708,402,711,465],{},[75,709,710],{},"Human Approval for Actions After Untrusted Ingress",[404,712,713],{},"human_approval_for_actions_after_untrusted_ingress",[394,715,716],{},[404,717,432],{},[394,719,720],{},"Whether a path into an action waits for a person",[374,722,723,725,733,737],{},[394,724,705],{},[394,726,727,402,730,465],{},[75,728,729],{},"Untrusted Ingress Can Trigger Consequential Actions",[404,731,732],{},"untrusted_ingress_can_trigger_consequential_actions",[394,734,735],{},[404,736,412],{},[394,738,720],{},[374,740,741,743,751,755],{},[394,742,576],{},[394,744,745,402,748,465],{},[75,746,747],{},"Human Approval for Sensitive Tool Calls",[404,749,750],{},"human_approval_for_sensitive_tool_calls",[394,752,753],{},[404,754,432],{},[394,756,720],{},[374,758,759,761,769,773],{},[394,760,396],{},[394,762,763,402,766,465],{},[75,764,765],{},"Tool Credentials Least Privilege in User Context",[404,767,768],{},"tool_credentials_least_privilege_user_context",[394,770,771],{},[404,772,432],{},[394,774,775],{},"Whether the agent's tool credentials are limited to the user it acts for",[374,777,778,781,790,794],{},[394,779,780],{},"Vector Database",[394,782,783,402,786,789],{},[75,784,785],{},"Authentication Required for Every Request",[404,787,788],{},"authentication_required",", under Authentication & Access)",[394,791,792],{},[404,793,432],{},[394,795,796],{},"Who can write to a store the agent reads",[374,798,799,801,810,814],{},[394,800,780],{},[394,802,803,402,806,809],{},[75,804,805],{},"Writes Restricted to Ingestion Pipeline",[404,807,808],{},"index_write_restricted_to_pipeline",", under Data Integrity)",[394,811,812],{},[404,813,432],{},[394,815,796],{},[374,817,818,820,828,832],{},[394,819,780],{},[394,821,822,402,825,564],{},[75,823,824],{},"API Not Publicly Reachable",[404,826,827],{},"not_publicly_reachable",[394,829,830],{},[404,831,432],{},[394,833,796],{},[374,835,836,839,848,852],{},[394,837,838],{},"Agent Memory Service",[394,840,841,402,844,847],{},[75,842,843],{},"Memory Writes Gated From Untrusted Content",[404,845,846],{},"memory_write_gated_from_untrusted_content",", under Memory Integrity)",[394,849,850],{},[404,851,432],{},[394,853,796],{},[374,855,856,858,866,870],{},[394,857,838],{},[394,859,860,402,863,789],{},[75,861,862],{},"Memory Endpoints Require Authentication",[404,864,865],{},"memory_endpoints_require_authentication",[394,867,868],{},[404,869,432],{},[394,871,796],{},[374,873,874,877,886,890],{},[394,875,876],{},"Agent Credential",[394,878,879,402,882,885],{},[75,880,881],{},"Credential Expiry Enforced",[404,883,884],{},"credential_expiry_enforced",", under Secrets & Credentials)",[394,887,888],{},[404,889,432],{},[394,891,892],{},"How strong a credential is",[374,894,895,897,905,909],{},[394,896,876],{},[394,898,899,402,902,885],{},[75,900,901],{},"Key Rotation Enabled",[404,903,904],{},"key_rotation_enabled",[394,906,907],{},[404,908,432],{},[394,910,892],{},[374,912,913,915,923,927],{},[394,914,876],{},[394,916,917,402,920,465],{},[75,918,919],{},"Resource Scope Restricted",[404,921,922],{},"resource_scope_restricted",[394,924,925],{},[404,926,432],{},[394,928,892],{},[374,930,931,933,941,945],{},[394,932,876],{},[394,934,935,402,938,465],{},[75,936,937],{},"Permission Scope Minimized",[404,939,940],{},"permission_scope_minimized",[394,942,943],{},[404,944,432],{},[394,946,892],{},[374,948,949,951,959,963],{},[394,950,576],{},[394,952,953,402,956,465],{},[75,954,955],{},"Handoff Permission Mode Not Widened",[404,957,958],{},"handoff_permission_mode_not_widened",[394,960,961],{},[404,962,432],{},[394,964,965],{},"Whether a hand-off widens the permissions",[374,967,968,971,979,983],{},[394,969,970],{},"Agent Server",[394,972,973,402,976,885],{},[75,974,975],{},"Server Secrets Readable by Tool Code",[404,977,978],{},"server_secrets_readable_by_tool_code",[394,980,981],{},[404,982,412],{},[394,984,985],{},"Whether tool code can read the server's secrets",[374,987,988,990,998,1002],{},[394,989,970],{},[394,991,992,402,995,789],{},[75,993,994],{},"Runtime API Authentication Enforced",[404,996,997],{},"api_authentication_enforced",[394,999,1000],{},[404,1001,432],{},[394,1003,1004],{},"How an outsider gets a first foothold",[374,1006,1007,1010,1019,1023],{},[394,1008,1009],{},"Langflow",[394,1011,1012,402,1015,1018],{},[75,1013,1014],{},"Custom Components Allowed",[404,1016,1017],{},"allow_custom_components",", under Code Execution)",[394,1020,1021],{},[404,1022,412],{},[394,1024,1004],{},[374,1026,1027,1029,1037,1041],{},[394,1028,1009],{},[394,1030,1031,402,1034,789],{},[75,1032,1033],{},"Auto-Login Enabled",[404,1035,1036],{},"langflow_auto_login",[394,1038,1039],{},[404,1040,412],{},[394,1042,1004],{},[374,1044,1045,1047,1056,1060],{},[394,1046,612],{},[394,1048,1049,402,1052,1055],{},[75,1050,1051],{},"Launcher Package Version Pinned",[404,1053,1054],{},"launcher_package_version_pinned",", under Supply Chain Integrity)",[394,1057,1058],{},[404,1059,432],{},[394,1061,1004],{},[374,1063,1064,1066,1074,1078],{},[394,1065,612],{},[394,1067,1068,402,1071,1055],{},[75,1069,1070],{},"Server Package Provenance Vetted",[404,1072,1073],{},"server_package_provenance_vetted",[394,1075,1076],{},[404,1077,432],{},[394,1079,1004],{},[374,1081,1082,1084,1092,1096],{},[394,1083,612],{},[394,1085,1086,402,1089,524],{},[75,1087,1088],{},"mcp-remote Bridge Used",[404,1090,1091],{},"mcp_remote_bridge_used",[394,1093,1094],{},[404,1095,412],{},[394,1097,1004],{},[374,1099,1100,1102,1110,1114],{},[394,1101,612],{},[394,1103,1104,402,1107,524],{},[75,1105,1106],{},"mcp-remote Version Patched",[404,1108,1109],{},"mcp_remote_version_patched",[394,1111,1112],{},[404,1113,432],{},[394,1115,1004],{},[360,1117,1119],{"className":1118,"tabIndex":364,"role":365,"ariaLabel":366},[363],[368,1120,1121,1131],{},[371,1122,1123],{},[374,1124,1125,1128],{},[377,1126,1127],{},"Harness approval mode",[377,1129,1130],{},"The agent it runs",[389,1132,1133,1142,1150,1160,1169,1178,1187,1196,1205],{},[374,1134,1135,1139],{},[394,1136,1137],{},[404,1138,668],{},[394,1140,1141],{},"waits for approval",[374,1143,1144,1148],{},[394,1145,1146],{},[404,1147,671],{},[394,1149,1141],{},[374,1151,1152,1157],{},[394,1153,1154],{},[404,1155,1156],{},"acceptEdits",[394,1158,1159],{},"acts without approval",[374,1161,1162,1167],{},[394,1163,1164],{},[404,1165,1166],{},"auto",[394,1168,1159],{},[374,1170,1171,1176],{},[394,1172,1173],{},[404,1174,1175],{},"dontAsk",[394,1177,1159],{},[374,1179,1180,1185],{},[394,1181,1182],{},[404,1183,1184],{},"bypassPermissions",[394,1186,1159],{},[374,1188,1189,1194],{},[394,1190,1191],{},[404,1192,1193],{},"never",[394,1195,1159],{},[374,1197,1198,1202],{},[394,1199,1200],{},[404,1201,674],{},[394,1203,1204],{},"does not decide: also answer the agent's own approval facts",[374,1206,1207,1211],{},[394,1208,1209],{},[404,1210,677],{},[394,1212,1204],{},[24,1214,1216],{"id":1215},"_6-leave-what-you-do-not-know-open","6. Leave what you do not know open",[14,1218,1219],{},"Write a value only when someone who knows has stated it, or you found it in evidence you can point to. Leave every other fact unanswered, on purpose. This holds for both answers: guessing that a tool exists is as much a guess as guessing that it does not.",[14,1221,1222,1224],{},[75,1223,77],{}," An unanswered fact comes back as a question that names what would settle it. A guess makes the question go away without settling anything.",[14,1226,1227],{},"What a guess does:",[360,1229,1232],{"className":1230,"tabIndex":364,"role":365,"ariaLabel":1231},[363],"Table: 6. Leave what you do not know open",[368,1233,1234,1244],{},[371,1235,1236],{},[374,1237,1238,1241],{},[377,1239,1240],{},"If you guess",[377,1242,1243],{},"What happens",[389,1245,1246,1255,1271,1282,1293,1304,1322,1336,1345,1353,1361,1369,1377,1385,1393,1402,1414,1431,1440,1448,1456],{},[374,1247,1248,1253],{},[394,1249,1250],{},[75,1251,1252],{},"Answers on components",[394,1254],{},[374,1256,1257,1265],{},[394,1258,1259,1261,1262,1264],{},[404,1260,427],{}," = ",[404,1263,432],{}," (Agent Service)",[394,1266,1267,1268,1270],{},"The agent's actions read as approved through its own answer, so injection to action is no longer raised through them, unless another answer says actions run unapproved: ",[404,1269,447],{}," = false on the agent, a chat frontend or a source that approves automatically, or a drawn path answered unapproved. With consequential tools answered false, the answer covers nothing the agent runs and does not count.",[374,1272,1273,1279],{},[394,1274,1275,1261,1277,1264],{},[404,1276,406],{},[404,1278,412],{},[394,1280,1281],{},"With code execution also answered false, and no MCP server it calls answering destructive tools true, the agent reads as holding no tools that act: the question about them closes, and injection to action cannot be raised through its own tools. With code execution open, the question stays; with code execution true, or such a server, it is raised as before. The agent's own approval answer then counts only toward actions running unapproved.",[374,1283,1284,1290],{},[394,1285,1286,1261,1288,1264],{},[404,1287,523],{},[404,1289,412],{},[394,1291,1292],{},"The agent reads as running no code: with consequential tools also false, injection to action is no longer raised through its own tools. Whether it reads files stays open: the question moves to the harness that might read them for it.",[374,1294,1295,1301],{},[394,1296,1297,1261,1299,1264],{},[404,1298,563],{},[404,1300,432],{},[394,1302,1303],{},"The agent's own undrawn ways out read as closed. A drawn flow from it that reaches an outsider still counts.",[374,1305,1306,1316],{},[394,1307,1308,1261,1310,1312,1313,1315],{},[404,1309,663],{},[404,1311,668],{}," or ",[404,1314,671],{}," (Agent Harness)",[394,1317,1318,1319,1321],{},"Every agent the harness runs reads as waiting for approval, so injection to action is no longer raised for them through the harness, unless the agent's own approval answer, or ",[404,1320,693],{}," on the harness, says otherwise.",[374,1323,1324,1333],{},[394,1325,1326,1261,1328,1312,1330,1332],{},[404,1327,639],{},[404,1329,645],{},[404,1331,649],{}," (Agent Chat Frontend)",[394,1334,1335],{},"Every undrawn way out through images rendered in the chat frontend reads as closed. A drawn flow from it still counts.",[374,1337,1338,1343],{},[394,1339,1340],{},[75,1341,1342],{},"Answers on data items",[394,1344],{},[374,1346,1347,1350],{},[394,1348,1349],{},"Sensitivity = Public (data item)",[394,1351,1352],{},"With Credential = No, the item no longer counts as private, and an element that handles only it no longer counts as a sensitive target or as something a credential unlocks.",[374,1354,1355,1358],{},[394,1356,1357],{},"Credential = No (data item)",[394,1359,1360],{},"The item is no longer treated as a credential: no credential chain starts from it. An item whose class is a credential class counts as one while the answer is open; another item counts only once it is answered Yes.",[374,1362,1363,1366],{},[394,1364,1365],{},"Origin = Authenticated first party (data item)",[394,1367,1368],{},"The item no longer counts as untrusted, unless the flow carrying it comes from an Untrusted zone or an untrusted source class.",[374,1370,1371,1374],{},[394,1372,1373],{},"Origin = Curated internal (data item)",[394,1375,1376],{},"The item counts as trusted, as for first party. For a knowledge base fed from outside, the knowledge route loses it, unless the ingestion is drawn: a pipeline's Knowledge Write carries the least trusted origin it ingests, whatever origin is stated.",[374,1378,1379,1382],{},[394,1380,1381],{},"Origin = Agent relayed (data item)",[394,1383,1384],{},"The item counts as trusted on the agent's own routes, so injection to action loses it as untrusted input. If the relaying agent and its hand-off are drawn, the relayed route still carries the relayer's untrusted input to the trifecta.",[374,1386,1387,1390],{},[394,1388,1389],{},"Origin = Model generated (data item)",[394,1391,1392],{},"Content the model wrote counts as trusted on the agent's own routes, even when it wrote it from untrusted content: the taint is laundered there. Read back from the agent's own memory it reads undetermined instead, and Facts to establish says second-order poisoning is not analysed. Through a store another agent reads, the writer's untrusted input still reaches the reader when the same item is drawn on the write and on the read.",[374,1394,1395,1400],{},[394,1396,1397],{},[75,1398,1399],{},"Answers on paths",[394,1401],{},[374,1403,1404,1411],{},[394,1405,1406,1261,1408,1410],{},[404,1407,750],{},[404,1409,432],{}," (Agent Tool Call)",[394,1412,1413],{},"That path reads as approved. Injection to action is no longer raised only when every path into and out of the agent is approved, untrusted content reaches it no other way (a tool server, a knowledge item), and it runs no code off its drawn calls.",[374,1415,1416,1428],{},[394,1417,1418,1261,1420,1422,1423,1261,1425,1427],{},[404,1419,713],{},[404,1421,432],{},", or ",[404,1424,732],{},[404,1426,412],{}," (Context Ingress)",[394,1429,1430],{},"As for an approved tool call, for the path the untrusted content comes in on.",[374,1432,1433,1438],{},[394,1434,1435],{},[75,1436,1437],{},"Zones and assertions",[394,1439],{},[374,1441,1442,1445],{},[394,1443,1444],{},"Assert outbound flows complete (on an element)",[394,1446,1447],{},"Every undrawn way out of that element reads as closed; its drawn flows are still followed. It is the user's answer to give, never a shortcut.",[374,1449,1450,1453],{},[394,1451,1452],{},"Zone = Internal for a boundary drawn Untrusted (Open internet) or Public (Internet-facing)",[394,1454,1455],{},"Content from it no longer counts as untrusted by zone, and what reaches it no longer counts as a way out: untrusted input and the trifecta's way out can both fall, and a public-facing foothold goes.",[374,1457,1458,1461],{},[394,1459,1460],{},"Zone = Internal for a boundary drawn Vendor (Trusted external)",[394,1462,1463],{},"What reaches the vendor reads as staying inside: the analysis stops asking whether an untrusted party can read it.",[24,1465,1467],{"id":1466},"_7-draw-where-each-credential-sits-and-what-it-opens","7. Draw where each credential sits and what it opens",[14,1469,1470],{},"Draw each credential where it really sits: on the container or host that holds it, on every flow that presents it, and the store or service it opens at the end of that flow. A cloud role that a host's metadata endpoint serves sits on the host: draw the agent's container inside the host and the role on the host, with no arrow to the endpoint. Answer a credential's own facts (expiry, rotation, scope) and the host's metadata settings only as the team states them.",[14,1472,1473,1475],{},[75,1474,77],{}," A credential is a chain: an injected agent runs where a credential can be reached, takes it, and opens something with it. The analysis follows the chain through what you draw, and finds a metadata endpoint's role with no arrow drawn. A credential drawn in the wrong place, or not at all, hides the chain.",[14,1477,1478],{},[75,1479,83],{},[29,1481,1482,1485,1488,1491,1494],{},[32,1483,1484],{},"Which credentials sit where the agent runs: in its container, or on its host, served by the host's metadata endpoint?",[32,1486,1487],{},"What does each credential open, and over which flow?",[32,1489,1490],{},"Can the agent run code, or fetch an address it is given, where a credential can be reached?",[32,1492,1493],{},"Is the host's metadata endpoint limited (IMDSv2, a hop limit), and does the agent's container share the host's PID, IPC or network namespace?",[32,1495,1496],{},"Does the agent's approval answer still cover the tool it just gained?",[14,1498,1499,1501],{},[75,1500,99],{}," Agent Credential, EC2 Instance, STS Temporary Credentials, Container.",[14,1503,1504],{},[75,1505,105],{},[29,1507,1508],{},[32,1509,1510],{},"A cloud credential a host's metadata endpoint serves: STS Temporary Credentials, and 1 more in modules you may have installed.",[14,1512,1513,358],{},[75,1514,357],{},[360,1516,1519],{"className":1517,"tabIndex":364,"role":365,"ariaLabel":1518},[363],"Table: 7. Draw where each credential sits and what it opens",[368,1520,1521,1533],{},[371,1522,1523],{},[374,1524,1525,1527,1529,1531],{},[377,1526,379],{},[377,1528,382],{},[377,1530,357],{},[377,1532,387],{},[389,1534,1535,1555,1580,1601,1623,1643,1661],{},[374,1536,1537,1540,1548,1552],{},[394,1538,1539],{},"STS Temporary Credentials",[394,1541,1542,402,1545,564],{},[75,1543,1544],{},"IMDS HTTP Endpoint Enabled",[404,1546,1547],{},"imds_http_endpoint_enabled",[394,1549,1550],{},[404,1551,412],{},[394,1553,1554],{},"Whether the host's metadata endpoint is cut off from the agent, or the credential is kept where it can read it",[374,1556,1557,1559,1567,1578],{},[394,1558,1539],{},[394,1560,1561,402,1564,789],{},[75,1562,1563],{},"IMDSv2 Required (HttpTokens=required)",[404,1565,1566],{},"imdsv2_required",[394,1568,1569,1571,1572,1261,1575],{},[404,1570,432],{},", and only together with ",[404,1573,1574],{},"imds_hop_limit",[404,1576,1577],{},"1",[394,1579,1554],{},[374,1581,1582,1584,1591,1599],{},[394,1583,1539],{},[394,1585,1586,402,1589,564],{},[75,1587,1588],{},"IMDS PUT Response Hop Limit",[404,1590,1574],{},[394,1592,1593,1571,1595,1261,1597],{},[404,1594,1577],{},[404,1596,1566],{},[404,1598,432],{},[394,1600,1554],{},[374,1602,1603,1606,1613,1621],{},[394,1604,1605],{},"EC2 Instance, EKS Node Group",[394,1607,1608,402,1611,789],{},[75,1609,1610],{},"IMDSv2 Required",[404,1612,1566],{},[394,1614,1615,1571,1617,1261,1619],{},[404,1616,432],{},[404,1618,1574],{},[404,1620,1577],{},[394,1622,1554],{},[374,1624,1625,1627,1633,1641],{},[394,1626,1605],{},[394,1628,1629,402,1631,789],{},[75,1630,1588],{},[404,1632,1574],{},[394,1634,1635,1571,1637,1261,1639],{},[404,1636,1577],{},[404,1638,1566],{},[404,1640,432],{},[394,1642,1554],{},[374,1644,1645,1647,1655,1659],{},[394,1646,1539],{},[394,1648,1649,402,1652,885],{},[75,1650,1651],{},"Credentials Materialized in Logs \u002F Env",[404,1653,1654],{},"credentials_materialized_in_logs_or_env",[394,1656,1657],{},[404,1658,412],{},[394,1660,1554],{},[374,1662,1663,1666,1675,1679],{},[394,1664,1665],{},"Container",[394,1667,1668,402,1671,1674],{},[75,1669,1670],{},"Host PID\u002FIPC\u002Fnetwork namespaces not shared",[404,1672,1673],{},"container_host_namespaces_not_shared",", under Host Isolation)",[394,1676,1677],{},[404,1678,432],{},[394,1680,1681],{},"A container whose isolation from its host decides whether a hop limit cuts the metadata reach",[24,1683,1685],{"id":1684},"_8-draw-how-knowledge-and-memory-get-in","8. Draw how knowledge and memory get in",[14,1687,1688],{},"Draw an ingestion pipeline with what it reads, and its write into the knowledge base as a Knowledge Write carrying the items it writes. Draw what the agent remembers as a memory service it writes to and reads from, and set the origin of what it keeps to the least trusted origin of what it read when it wrote it, never Model generated. Answer who can write to each store only as the team states it.",[14,1690,1691,1693],{},[75,1692,77],{}," What the agent reads tomorrow can come from what an attacker wrote today. A Knowledge Write carries the least trusted origin its pipeline ingested, whatever the stored item is stated as; a generic flow carries nothing, and the stored item's stated origin decides alone.",[14,1695,1696],{},[75,1697,83],{},[29,1699,1700,1703,1706],{},[32,1701,1702],{},"What feeds the knowledge base, and through which pipeline?",[32,1704,1705],{},"What does the agent keep in memory, and what did it write it from?",[32,1707,1708],{},"Who can write to each store the agent reads?",[14,1710,1711,1713],{},[75,1712,99],{}," RAG Ingestion Pipeline, Knowledge Write, Vector Database, Agent Memory Service, Knowledge Item.",[14,1715,1716],{},[75,1717,105],{},[29,1719,1720],{},[32,1721,1722],{},"A write that carries what an ingestion pipeline took in: Knowledge Write.",[24,1724,1726],{"id":1725},"_9-draw-tools-from-others-and-agents-handing-work-to-agents","9. Draw tools from others and agents handing work to agents",[14,1728,1729],{},"Draw a tool server another party runs (an MCP server) as its own element, in that party's boundary, with the facts its tools carry, and the agent's call to it as an Agent Tool Call. Draw a hand-off to another agent as an Agent Tool Call and what comes back as a Context Ingress. Draw every way the receiving agent takes content in, and state each item's origin from where it really comes from.",[14,1731,1732,1734],{},[75,1733,77],{}," A tool server acts for the agent and sends content back to it; a hand-off carries the first agent's untrusted input to the second. Neither shows unless it is drawn as what it is.",[14,1736,1737],{},[75,1738,83],{},[29,1740,1741,1744,1747],{},[32,1742,1743],{},"Which tool servers does the agent call, who runs them, and can their tools change anything?",[32,1745,1746],{},"Does the agent hand work to another agent, and over which flow?",[32,1748,1749],{},"What does the receiving agent read, and who writes it?",[14,1751,1752,1754],{},[75,1753,99],{}," Remote MCP Server, Agent Tool Call, Context Ingress, Agent Service.",{"title":1756,"searchDepth":1757,"depth":1757,"links":1758},"",3,[1759,1761,1762,1763,1764,1765,1766,1767,1768,1769,1770],{"id":26,"depth":1760,"text":27},2,{"id":67,"depth":1760,"text":68},{"id":137,"depth":1760,"text":138},{"id":190,"depth":1760,"text":191},{"id":234,"depth":1760,"text":235},{"id":278,"depth":1760,"text":279},{"id":319,"depth":1760,"text":320},{"id":1215,"depth":1760,"text":1216},{"id":1466,"depth":1760,"text":1467},{"id":1684,"depth":1760,"text":1685},{"id":1725,"depth":1760,"text":1726},"The ten steps of the training on one page. Each lesson teaches one or two of them.","md",{},true,"\u002Fagentic-modelling\u002Frecipe-at-a-glance",{"title":5,"description":1771},"07.agentic-modelling\u002F12.recipe-at-a-glance","z7W_CuF6fwXLm4wowU3tYY0bSAXcELDKA18g_KClrz8",[1780,1835,1870,1925,1959,2003,2018,2083],{"title":1781,"description":1782,"path":1783,"stem":1784,"children":1785,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1786,1790,1795,1800,1805,1810,1815,1820,1825,1830],{"title":1787,"path":1783,"stem":1788,"description":1789},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1791,"path":1792,"stem":1793,"description":1794},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1796,"path":1797,"stem":1798,"description":1799},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1801,"path":1802,"stem":1803,"description":1804},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1806,"path":1807,"stem":1808,"description":1809},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1811,"path":1812,"stem":1813,"description":1814},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1816,"path":1817,"stem":1818,"description":1819},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1821,"path":1822,"stem":1823,"description":1824},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1826,"path":1827,"stem":1828,"description":1829},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1831,"path":1832,"stem":1833,"description":1834},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1836,"description":1837,"path":1838,"stem":1839,"children":1840,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1841,1845,1850,1855,1860,1865],{"title":1842,"path":1838,"stem":1843,"description":1844},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1846,"path":1847,"stem":1848,"description":1849},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1851,"path":1852,"stem":1853,"description":1854},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1856,"path":1857,"stem":1858,"description":1859},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1861,"path":1862,"stem":1863,"description":1864},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1866,"path":1867,"stem":1868,"description":1869},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1871,"description":1872,"path":1873,"stem":1874,"children":1875,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1876,1880,1885,1890,1895,1900,1905,1910,1915,1920],{"title":1877,"path":1873,"stem":1878,"description":1879},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1881,"path":1882,"stem":1883,"description":1884},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1886,"path":1887,"stem":1888,"description":1889},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1891,"path":1892,"stem":1893,"description":1894},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1896,"path":1897,"stem":1898,"description":1899},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1901,"path":1902,"stem":1903,"description":1904},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1906,"path":1907,"stem":1908,"description":1909},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1911,"path":1912,"stem":1913,"description":1914},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1916,"path":1917,"stem":1918,"description":1919},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1921,"path":1922,"stem":1923,"description":1924},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1926,"description":1927,"path":1928,"stem":1929,"children":1930,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1931,1934,1939,1944,1949,1954],{"title":1926,"path":1928,"stem":1932,"description":1933},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1935,"path":1936,"stem":1937,"description":1938},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1940,"path":1941,"stem":1942,"description":1943},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1945,"path":1946,"stem":1947,"description":1948},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1950,"path":1951,"stem":1952,"description":1953},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1955,"path":1956,"stem":1957,"description":1958},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1960,"description":1961,"path":1962,"stem":1963,"children":1964,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1965,1969,1974,1979,1984,1989,1993,1998],{"title":1966,"path":1962,"stem":1967,"description":1968},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1970,"path":1971,"stem":1972,"description":1973},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1975,"path":1976,"stem":1977,"description":1978},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1980,"path":1981,"stem":1982,"description":1983},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1985,"path":1986,"stem":1987,"description":1988},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1940,"path":1990,"stem":1991,"description":1992},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1994,"path":1995,"stem":1996,"description":1997},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1999,"path":2000,"stem":2001,"description":2002},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":2004,"description":2005,"path":2006,"stem":2007,"children":2008,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[2009,2013],{"title":2010,"path":2006,"stem":2011,"description":2012},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":2014,"path":2015,"stem":2016,"description":2017},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":2019,"description":2020,"path":20,"stem":2021,"children":2022,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","07.agentic-modelling",[2023,2027,2032,2037,2042,2047,2052,2057,2062,2067,2072,2077,2082],{"title":2024,"path":20,"stem":2025,"description":2026},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":2028,"path":2029,"stem":2030,"description":2031},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":2033,"path":2034,"stem":2035,"description":2036},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":2038,"path":2039,"stem":2040,"description":2041},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":2043,"path":2044,"stem":2045,"description":2046},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":2048,"path":2049,"stem":2050,"description":2051},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":2053,"path":2054,"stem":2055,"description":2056},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":2058,"path":2059,"stem":2060,"description":2061},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":2063,"path":2064,"stem":2065,"description":2066},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":2068,"path":2069,"stem":2070,"description":2071},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":2073,"path":2074,"stem":2075,"description":2076},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":2078,"path":2079,"stem":2080,"description":2081},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":5,"path":1775,"stem":1777,"description":1771},{"title":2084,"description":2085,"path":2086,"stem":2087,"children":2088,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[2089,2093,2098],{"title":2090,"path":2086,"stem":2091,"description":2092},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":2094,"path":2095,"stem":2096,"description":2097},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":2099,"path":2100,"stem":2101,"description":2102},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186747]