[{"data":1,"prerenderedAt":1515},["ShallowReactive",2],{"page-\u002Fplatform\u002Fboundary-trust-zones":3,"navigation":1198},{"id":4,"title":5,"body":6,"description":19,"extension":1180,"meta":1181,"navigation":1193,"path":1194,"seo":1195,"stem":1196,"__hash__":1197},"docs\u002F01.platform\u002F07.boundary-trust-zones.md","Boundary Trust Zones",{"type":7,"value":8,"toc":1160},"minimark",[9,13,20,36,59,64,67,97,108,112,219,223,245,250,307,312,347,352,359,369,386,402,406,426,456,460,497,503,510,524,528,538,597,617,621,636,717,728,744,748,759,786,789,793,799,839,848,853,877,899,903,906,912,915,969,972,1001,1009,1012,1021,1035,1040,1061,1071,1075,1119,1123],[10,11,5],"h1",{"id":12},"boundary-trust-zones",[14,15,16],"p",{},[17,18,19],"em",{},"Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",[14,21,22,23,27,28,31,32,35],{},"Boundary zoning lets you place every security boundary on a ",[24,25,26],"strong",{},"trust gradient"," and declare which boundaries are ",[17,29,30],{},"supposed"," to talk to each other. It captures your ",[24,33,34],{},"design intent"," — the segmentation you meant to build — so later security analysis can judge the model against it.",[37,38,39],"blockquote",{},[14,40,41,44,45,48,49,52,53,58],{},[24,42,43],{},"What this does, and what it does not do."," Zoning and approved channels are ",[17,46,47],{},"declared design intent",". The platform records them; it does ",[24,50,51],{},"not"," verify or enforce them in this version. Setting a zone does not block traffic, and declaring an approved channel does not validate that the channel exists. Enforcement and validation are left to security analysis. See ",[54,55,57],"a",{"href":56},"#what-zoning-does-and-does-not-do","What zoning does and does not do",".",[60,61,63],"h2",{"id":62},"prerequisites","Prerequisites",[14,65,66],{},"Before you start:",[68,69,70,86],"ul",{},[71,72,73,74,77,78,81,82,58],"li",{},"A model open in the ",[24,75,76],{},"Data Flow Editor"," with at least one ",[24,79,80],{},"security boundary"," other than the default root boundary. To create boundaries, see ",[54,83,85],{"href":84},"\u002Fplatform\u002Fbuilding-your-first-model#set-up-security-boundaries","Building Your First Model",[71,87,88,89,92,93,96],{},"Editing rights on the model (the editor is in ",[24,90,91],{},"Edit mode",", not ",[24,94,95],{},"View mode",").",[14,98,99,100,103,104,107],{},"The ",[24,101,102],{},"Zoning"," tab is available on every boundary ",[17,105,106],{},"except"," the default root boundary.",[60,109,111],{"id":110},"terms","Terms",[113,114,120],"div",{"className":115,"tabIndex":117,"role":118,"ariaLabel":119},[116],"table-frame",0,"region","Table: Terms",[121,122,123,136],"table",{},[124,125,126],"thead",{},[127,128,129,133],"tr",{},[130,131,132],"th",{},"Term",[130,134,135],{},"Meaning",[137,138,139,150,160,174,192,209],"tbody",{},[127,140,141,147],{},[142,143,144],"td",{},[24,145,146],{},"Trust zone",[142,148,149],{},"The tier you place a boundary on, from a fixed list (Internet-facing through Restricted, plus two external tiers). It describes who can reach the boundary.",[127,151,152,157],{},[142,153,154],{},[24,155,156],{},"Zone inheritance",[142,158,159],{},"A boundary with no zone set here takes the zone of its nearest ancestor boundary that has one.",[127,161,162,167],{},[142,163,164],{},[24,165,166],{},"Unclassified boundary",[142,168,169,170,173],{},"A boundary with no zone set anywhere up its parent chain. It falls back to the default ",[24,171,172],{},"Internal"," tier and is flagged for attention.",[127,175,176,181],{},[142,177,178],{},[24,179,180],{},"Domain",[142,182,183,184,188,189,96],{},"A free-text tag naming a business function the boundary serves (for example ",[185,186,187],"code",{},"payments",", ",[185,190,191],{},"erp",[127,193,194,199],{},[142,195,196],{},[24,197,198],{},"Role (plane)",[142,200,201,202,188,205,208],{},"Whether the boundary runs application ",[24,203,204],{},"Workload",[24,206,207],{},"Management"," (admin \u002F control) infrastructure, or both.",[127,210,211,216],{},[142,212,213],{},[24,214,215],{},"Approved channel (conduit)",[142,217,218],{},"A peer boundary you intend this boundary to communicate with, in a chosen direction, with an optional justification.",[60,220,222],{"id":221},"trust-zones-and-the-inheritance-model","Trust zones and the inheritance model",[14,224,225,226,229,230,233,234,236,237,240,241,244],{},"A ",[24,227,228],{},"trust zone"," answers one question: ",[17,231,232],{},"who can reach this boundary?"," You pick one from the ",[24,235,146],{}," dropdown. The zones, grouped as ",[24,238,239],{},"Your tiers"," and ",[24,242,243],{},"Outside",", are:",[14,246,247,249],{},[24,248,239],{}," (ordered outermost-first by exposure):",[113,251,254],{"className":252,"tabIndex":117,"role":118,"ariaLabel":253},[116],"Table: Trust zones and the inheritance model",[121,255,256,266],{},[124,257,258],{},[127,259,260,263],{},[130,261,262],{},"Zone",[130,264,265],{},"Reachable by",[137,267,268,278,288,297],{},[127,269,270,275],{},[142,271,272],{},[24,273,274],{},"Internet-facing",[142,276,277],{},"Reachable directly from the internet",[127,279,280,285],{},[142,281,282],{},[24,283,284],{},"Behind the front door (DMZ)",[142,286,287],{},"Reachable only through a public edge",[127,289,290,294],{},[142,291,292],{},[24,293,172],{},[142,295,296],{},"Reachable only from trusted zones — no untrusted ingress",[127,298,299,304],{},[142,300,301],{},[24,302,303],{},"Restricted",[142,305,306],{},"CDE, secrets, domain controllers, regulated-data stores",[14,308,309],{},[24,310,311],{},"Outside:",[113,313,315],{"className":314,"tabIndex":117,"role":118,"ariaLabel":253},[116],[121,316,317,325],{},[124,318,319],{},[127,320,321,323],{},[130,322,262],{},[130,324,265],{},[137,326,327,337],{},[127,328,329,334],{},[142,330,331],{},[24,332,333],{},"Open internet",[142,335,336],{},"Anonymous, hostile — the open internet",[127,338,339,344],{},[142,340,341],{},[24,342,343],{},"Trusted external",[142,345,346],{},"Vetted vendor \u002F partner",[348,349,351],"h3",{"id":350},"inheritance","Inheritance",[14,353,354,355,358],{},"You do not have to set a zone on every boundary. A boundary with no zone of its own ",[24,356,357],{},"inherits"," the zone of its nearest ancestor boundary that has one:",[360,361,366],"pre",{"className":362,"code":364,"language":365},[363],"language-text","Edge Network        →  Internet-facing      (set here — \"declared\")\n└── App Tier        →  Internal             (set here — \"declared\")\n    └── Cache       →  Internal             (no zone set — inherited from App Tier)\n        └── Worker  →  Internal             (no zone set — inherited from App Tier)\n","text",[185,367,364],{"__ignoreMap":368},"",[14,370,371,372,375,376,378,379,382,383,58],{},"If nothing up the chain is set, the boundary is ",[24,373,374],{},"unclassified",": it falls back to the default ",[24,377,172],{}," tier and is flagged so you can review it later. In the dropdown, an unset boundary shows a muted, italic placeholder naming the value it would resolve to — for example ",[17,380,381],{},"Internal (inherited from App Tier)"," or ",[17,384,385],{},"Internal (default)",[37,387,388],{},[14,389,390,393,394,397,398,401],{},[24,391,392],{},"Structural containers span tiers — zone the leaves, not the wrapper."," A boundary that mainly ",[17,395,396],{},"groups"," other boundaries — a VPC, a Kubernetes cluster, a cloud account — usually spans several trust levels at once (a public front end and a restricted data store can live under the same VPC), so no single zone is correct for it. Model the trust on the ",[24,399,400],{},"leaf"," boundaries inside it, each of which maps to one trust level, and leave the structural wrapper unset — it stays transparent to inheritance, and its child segments carry the real classification. Declare a zone on such a container only when you deliberately want the whole subtree to inherit one.",[348,403,405],{"id":404},"how-zones-appear-on-the-canvas","How zones appear on the canvas",[14,407,408,409,412,413,415,416,188,419,421,422,425],{},"Each boundary can show a small ",[24,410,411],{},"pill"," with its zone word (",[185,414,274],{}," shows as ",[24,417,418],{},"Public",[185,420,284],{}," as ",[24,423,424],{},"DMZ",", and so on):",[68,427,428,438,447],{},[71,429,430,433,434,437],{},[24,431,432],{},"Solid pill"," — the zone is ",[24,435,436],{},"declared"," on this boundary.",[71,439,440,433,443,446],{},[24,441,442],{},"Dimmed \u002F outlined pill",[24,444,445],{},"inherited"," from an ancestor.",[71,448,449,452,453,455],{},[24,450,451],{},"No pill"," — the boundary is ",[24,454,374],{}," (no zone anywhere in its chain). Unclassified boundaries stay uncluttered rather than carrying a default pill everywhere.",[60,457,459],{"id":458},"set-a-boundarys-trust-zone","Set a boundary's trust zone",[461,462,463,469,475,485,491],"ol",{},[71,464,465,466,468],{},"In the ",[24,467,76],{},", double-click the boundary to open its settings.",[71,470,471,472,474],{},"Click the ",[24,473,102],{}," tab (the shield icon) in the left tab rail.",[71,476,477,478,480,481,484],{},"Open the ",[24,479,146],{}," dropdown and pick a tier. Each option shows its ",[17,482,483],{},"reachable by"," hint as a subtitle.",[71,486,487,488,490],{},"Read the consequence line directly under the field — it restates the ",[17,489,483],{}," meaning of your choice.",[71,492,493,494,58],{},"Click ",[24,495,496],{},"Save",[14,498,499,502],{},[24,500,501],{},"Result:"," the boundary now shows a solid zone pill on the canvas, and any child boundary without its own zone inherits this one.",[14,504,505,506,509],{},"To ",[24,507,508],{},"clear"," a zone and fall back to inheritance, use the clear (✕) control on the field. The boundary then shows the inherited (or default) value as a muted placeholder.",[37,511,512],{},[14,513,514,517,518,520,521,523],{},[24,515,516],{},"Tip — overriding an inherited zone."," When a boundary is inheriting a zone, the tab names the source (\"Inherited from App Tier. Set it here if this boundary differs.\"). Set a zone explicitly whenever a child is genuinely stricter than its parent — for example a ",[24,519,303],{}," data store nested inside an ",[24,522,172],{}," app tier. Leaving it to inherit a coarser parent zone can understate the boundary's true exposure.",[60,525,527],{"id":526},"add-domains-and-a-role","Add domains and a role",[14,529,530,531,534,535,58],{},"Domains and role are optional tags that describe ",[17,532,533],{},"what"," a boundary is for, separate from ",[17,536,537],{},"who can reach it",[461,539,540,550,562,593],{},[71,541,542,543,545,546,549],{},"On the ",[24,544,102],{}," tab, click ",[24,547,548],{},"+ Add tags",". (The tags row opens automatically if either field is already set.)",[71,551,552,553,556,557,188,559,561],{},"In ",[24,554,555],{},"Business function",", type one or more domain tags and press Enter after each — for example ",[185,558,187],{},[185,560,191],{},". These are free-text; use whatever names your organization uses for business functions.",[71,563,552,564,567,568],{},[24,565,566],{},"Role",", choose the boundary's operational plane:\n",[68,569,570,576,581,587],{},[71,571,572,575],{},[24,573,574],{},"Undecided"," — not yet classified (the default; distinct from an affirmative \"just workload\").",[71,577,578,580],{},[24,579,204],{}," — runs application workload only.",[71,582,583,586],{},[24,584,585],{},"Management (admin \u002F control)"," — runs admin \u002F control-plane infrastructure.",[71,588,589,592],{},[24,590,591],{},"Workload + Management"," — runs both. The dropdown shows this option with a ⚠ marker, because mixing planes on one boundary is worth a second look (see the Tip below).",[71,594,493,595,58],{},[24,596,496],{},[37,598,602],{"className":599},[600,601],"callout","callout-tip",[14,603,604,607,608,610,611,613,614,616],{},[24,605,606],{},"Tip."," Treat ",[24,609,204],{}," as the default and reserve ",[24,612,207],{}," for boundaries that genuinely run admin or control infrastructure. Mixing both (",[24,615,591],{},") on one boundary is worth a second look — it often signals an admin plane that should be segmented out.",[60,618,620],{"id":619},"declare-approved-channels","Declare approved channels",[14,622,623,624,627,628,631,632,635],{},"An ",[24,625,626],{},"approved channel"," (also called a ",[17,629,630],{},"conduit",") records that this boundary is ",[17,633,634],{},"meant"," to communicate with a peer boundary, in a chosen direction, with an optional reason. You author channels from the boundary picker.",[461,637,638,655,670,673,701,712],{},[71,639,542,640,642,643,646,647,650,651,654],{},[24,641,102],{}," tab, expand ",[24,644,645],{},"Approved channels"," and click ",[24,648,649],{},"Add",". The ",[24,652,653],{},"Add approved channel"," drawer opens from the right.",[71,656,657,658,661,662,665,666,669],{},"Find the peer boundary. Browse the hierarchy or use ",[24,659,660],{},"Search boundaries"," to filter by name. The current boundary is marked ",[24,663,664],{},"this boundary"," and cannot be selected. A peer that already has a channel is marked ",[24,667,668],{},"Added",", and each row shows the peer's resolved zone pill.",[71,671,672],{},"Click the peer to select it. A preview of the peer appears below the list.",[71,674,675,676,679,680,694,697,698,700],{},"Choose one or both ",[24,677,678],{},"directions"," — you can author a two-way channel in a single step:",[68,681,682,688],{},[71,683,684,687],{},[24,685,686],{},"Outbound (this → peer)"," — this boundary initiates to the peer.",[71,689,690,693],{},[24,691,692],{},"Inbound (peer → this)"," — the peer initiates to this boundary.",[695,696],"br",{},"A direction that is already approved shows checked and read-only with an ",[24,699,668],{}," chip; you cannot re-add it here.",[71,702,703,704,707,708,711],{},"(Optional) In ",[24,705,706],{},"Why",", add a short justification — for example ",[17,709,710],{},"card-data flow to the payments store",". If you ticked both directions, the same reason is recorded on each.",[71,713,493,714,58],{},[24,715,716],{},"Add channel",[14,718,719,721,722,724,725,727],{},[24,720,501],{}," the channel rows appear under ",[24,723,645],{}," on the tab, each showing a direction arrow (→ out, ← in), the peer name, and your reason. Remove a row with its ✕ button. Click ",[24,726,496],{}," to commit.",[14,729,730,731,733,734,188,737,740,741,58],{},"If ",[24,732,716],{}," is disabled, the drawer states why — for example ",[17,735,736],{},"Pick a peer boundary first",[17,738,739],{},"A boundary can't connect to itself",", or ",[17,742,743],{},"Both directions already approved",[348,745,747],{"id":746},"the-nesting-warning","The nesting warning",[14,749,750,751,754,755,758],{},"If you pick a peer that ",[24,752,753],{},"contains",", or is ",[24,756,757],{},"contained by",", the current boundary, the drawer shows a non-blocking advisory. It never stops you from adding the channel — it only flags that the channel may be redundant:",[68,760,761,776],{},[71,762,763,764,767,768,771,772,775],{},"Connecting a ",[24,765,766],{},"child to a containing parent"," (or to a peer that resolves to the ",[24,769,770],{},"same trust zone",") is ",[17,773,774],{},"likely redundant with inheritance",". The warning suggests you approve it only if this boundary overrides to a different tier.",[71,777,763,778,781,782,785],{},[24,779,780],{},"parent to a nested child"," models ",[17,783,784],{},"controlled ingress","; the advisory suggests modeling the ingress source as its own sibling boundary for a cleaner picture.",[14,787,788],{},"The warning advises — it never blocks.",[60,790,792],{"id":791},"use-the-zoning-overview","Use the Zoning overview",[14,794,99,795,798],{},[24,796,797],{},"Zoning overview"," is a model-wide companion to the per-boundary tab. It shows every boundary, its resolved zone, and lets you edit zones inline or in bulk.",[461,800,801,812],{},[71,802,542,803,805,806,809,810,96],{},[24,804,76],{}," canvas toolbar, click the ",[24,807,808],{},"shield"," button (tooltip ",[24,811,797],{},[71,813,814,815,818,819,821,822,188,825,740,828,831,832,834,835,838],{},"The overview opens as a tree of every boundary, nested by containment. Each row shows the ",[24,816,817],{},"Boundary"," name, its ",[24,820,146],{}," (with a caption reading ",[24,823,824],{},"Declared",[17,826,827],{},"Inherited from …",[17,829,830],{},"Unset → default Internal","), its ",[24,833,566],{},", and its ",[24,836,837],{},"Channels"," count.",[14,840,841,844,845,847],{},[24,842,843],{},"Edit one zone inline."," Change the ",[24,846,146],{}," dropdown in any row. The change is saved immediately.",[14,849,850],{},[24,851,852],{},"Set a zone on many boundaries at once:",[461,854,855,858,867,870],{},[71,856,857],{},"Tick the checkbox on each boundary you want to change.",[71,859,493,860,863,864,96],{},[24,861,862],{},"Set zone for N selected"," and pick a zone (or ",[24,865,866],{},"Clear (inherit)",[71,868,869],{},"The change is applied to every selected boundary immediately.",[71,871,872,873,876],{},"A toast confirms the result with an ",[24,874,875],{},"Undo"," button — click it to revert the whole batch.",[14,878,879,882,883,886,887,890,891,894,895,898],{},[24,880,881],{},"Find the gaps."," The toolbar shows an ",[24,884,885],{},"N unclassified"," count. Turn on ",[24,888,889],{},"Show only unclassified"," to filter the list down to boundaries that have no zone anywhere in their chain, so you can work through them. A collapsed parent in the tree carries a roll-up badge (\"N unclassified inside\") so a fold never hides outstanding work. Use ",[24,892,893],{},"Expand all"," \u002F ",[24,896,897],{},"Collapse all"," to navigate large models.",[60,900,902],{"id":901},"worked-example-a-three-tier-web-application","Worked example: a three-tier web application",[14,904,905],{},"Suppose your model has an edge, an application tier, and a data tier, nested like this:",[360,907,910],{"className":908,"code":909,"language":365},[363],"Edge Network                Internet-facing   (declared)\n└── Application Tier        Internal          (declared)\n    └── Data Tier           Restricted        (declared)\n        └── Backup Store    Restricted        (inherited from Data Tier)\n",[185,911,909],{"__ignoreMap":368},[14,913,914],{},"To build this out:",[461,916,917,932,943,959],{},[71,918,919,922,923,925,926,928,929,931],{},[24,920,921],{},"Edge Network"," — open its ",[24,924,102],{}," tab and set ",[24,927,146],{}," to ",[24,930,274],{},". It faces the public internet.",[71,933,934,937,938,928,940,942],{},[24,935,936],{},"Application Tier"," — set ",[24,939,146],{},[24,941,172],{},". It is reachable only from trusted zones, never directly from the internet.",[71,944,945,937,948,928,950,952,953,955,956,958],{},[24,946,947],{},"Data Tier",[24,949,146],{},[24,951,303],{},". It holds regulated data, so it is stricter than its ",[24,954,172],{}," parent. Setting it explicitly is what keeps the data tier from silently inheriting the coarser ",[24,957,172],{}," zone.",[71,960,961,964,965,968],{},[24,962,963],{},"Backup Store"," (nested in Data Tier) — leave its zone unset. It ",[24,966,967],{},"inherits Restricted"," from the Data Tier, which is correct, so there is nothing to declare.",[14,970,971],{},"Then declare the channels you intend:",[68,973,974,990],{},[71,975,976,977,979,980,983,984,986,987,58],{},"On ",[24,978,936],{},", add an ",[24,981,982],{},"Outbound"," approved channel to ",[24,985,947],{},", with the reason ",[17,988,989],{},"application reads\u002Fwrites regulated records",[71,991,976,992,979,994,983,996,986,998,58],{},[24,993,921],{},[24,995,982],{},[24,997,936],{},[17,999,1000],{},"front-end forwards requests to the app tier",[14,1002,477,1003,1005,1006,58],{},[24,1004,797],{}," to confirm the tree resolves as expected: three declared rows, one inherited row, and ",[24,1007,1008],{},"0 unclassified",[60,1010,57],{"id":1011},"what-zoning-does-and-does-not-do",[14,1013,1014,1017,1018,1020],{},[24,1015,1016],{},"Zoning records declared design intent."," It documents how you ",[17,1019,634],{}," to segment the system:",[68,1022,1023,1026,1029],{},[71,1024,1025],{},"Trust zones say which exposure tier each boundary belongs to.",[71,1027,1028],{},"Domains and role say what each boundary is for.",[71,1030,1031,1032,1034],{},"Approved channels say which boundaries are ",[17,1033,30],{}," to communicate, and why.",[14,1036,1037],{},[24,1038,1039],{},"Zoning does not verify or enforce anything in this version:",[68,1041,1042,1048,1054],{},[71,1043,1044,1045,1047],{},"Setting a zone does ",[24,1046,51],{}," block, filter, or shape traffic.",[71,1049,1050,1051,1053],{},"Declaring an approved channel does ",[24,1052,51],{}," confirm that the channel exists, nor does the absence of a channel prevent a flow from being modeled or analyzed.",[71,1055,1056,1057,1060],{},"The nesting warning ",[24,1058,1059],{},"advises","; it never blocks an action.",[14,1062,1063,1064,1067,1068,1070],{},"That judgement — whether the real or modeled flows match your declared intent — is the job of ",[24,1065,1066],{},"security analysis",", which reads your zoning as the baseline of how things are ",[17,1069,634],{}," to be. Keep your zones honest: an over-broad parent zone inherited by a sensitive child can understate risk in later analysis.",[60,1072,1074],{"id":1073},"best-practices","Best practices",[68,1076,1077,1083,1089,1095,1104,1113],{},[71,1078,1079,1082],{},[24,1080,1081],{},"Declare the outer tiers first, then let the inside inherit."," Set zones on the boundaries that face the world (Internet-facing, DMZ) and on each tier where the trust level genuinely changes. Leave boundaries that share their parent's trust level unset and let inheritance do the work.",[71,1084,1085,1088],{},[24,1086,1087],{},"Always override when a child is stricter."," A Restricted store inside an Internal tier must be declared Restricted — inheritance would otherwise understate it.",[71,1090,1091,1094],{},[24,1092,1093],{},"Zone leaf segments, not structural containers."," A boundary that only nests other boundaries (a VPC, cluster, or account) spans several trust levels — classify the leaves inside it and leave the wrapper unset rather than forcing one zone onto the whole subtree.",[71,1096,1097,1100,1101,1103],{},[24,1098,1099],{},"Drive the unclassified count to zero."," Use the Zoning overview's ",[24,1102,889],{}," filter as a worklist.",[71,1105,1106,1109,1110,1112],{},[24,1107,1108],{},"Write a reason on every approved channel."," The ",[17,1111,706],{}," is what makes the declared intent reviewable later.",[71,1114,1115,1118],{},[24,1116,1117],{},"Heed, but don't fear, the nesting warning."," A flagged channel is usually redundant with inheritance — but it is allowed when a child genuinely overrides to a different tier.",[60,1120,1122],{"id":1121},"next-steps","Next steps",[68,1124,1125,1133,1142,1151],{},[71,1126,1127,1132],{},[24,1128,1129],{},[54,1130,85],{"href":1131},"\u002Fplatform\u002Fbuilding-your-first-model"," — create the boundaries you zone here.",[71,1134,1135,1141],{},[24,1136,1137],{},[54,1138,1140],{"href":1139},"\u002Fplatform\u002Fsecurity-analysis-workflow","Security Analysis Workflow"," — run analysis that reads your declared zoning as its baseline.",[71,1143,1144,1150],{},[24,1145,1146],{},[54,1147,1149],{"href":1148},"\u002Fplatform\u002Fcomponent-configuration-guide","Component Configuration Guide"," — configure the components that live inside each boundary.",[71,1152,1153,1159],{},[24,1154,1155],{},[54,1156,1158],{"href":1157},"\u002Fplatform\u002Fmanaging-findings","Managing Findings"," — record decisions on the exposures analysis surfaces.",{"title":368,"searchDepth":1161,"depth":1161,"links":1162},3,[1163,1165,1166,1170,1171,1172,1175,1176,1177,1178,1179],{"id":62,"depth":1164,"text":63},2,{"id":110,"depth":1164,"text":111},{"id":221,"depth":1164,"text":222,"children":1167},[1168,1169],{"id":350,"depth":1161,"text":351},{"id":404,"depth":1161,"text":405},{"id":458,"depth":1164,"text":459},{"id":526,"depth":1164,"text":527},{"id":619,"depth":1164,"text":620,"children":1173},[1174],{"id":746,"depth":1161,"text":747},{"id":791,"depth":1164,"text":792},{"id":901,"depth":1164,"text":902},{"id":1011,"depth":1164,"text":57},{"id":1073,"depth":1164,"text":1074},{"id":1121,"depth":1164,"text":1122},"md",{"category":1182,"position":1183,"tags":1184},"modeling",9,[1185,1186,1187,1188,1189,1190,1191,1192],"intermediate","guide","boundaries","trust-zones","zoning","segmentation","conduits","practical",true,"\u002Fplatform\u002Fboundary-trust-zones",{"title":5,"description":19},"01.platform\u002F07.boundary-trust-zones","hP6ug4U0gYI235O3gw8WkRN-2WgrCELbFajV92Ol2fU",[1199,1242,1277,1332,1366,1410,1425,1495],{"title":1200,"description":1201,"path":1202,"stem":1203,"children":1204,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1205,1209,1214,1217,1220,1223,1228,1233,1234,1239],{"title":1206,"path":1202,"stem":1207,"description":1208},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1210,"path":1211,"stem":1212,"description":1213},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":85,"path":1131,"stem":1215,"description":1216},"01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1140,"path":1139,"stem":1218,"description":1219},"01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1158,"path":1157,"stem":1221,"description":1222},"01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1224,"path":1225,"stem":1226,"description":1227},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1229,"path":1230,"stem":1231,"description":1232},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":5,"path":1194,"stem":1196,"description":19},{"title":1235,"path":1236,"stem":1237,"description":1238},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1149,"path":1148,"stem":1240,"description":1241},"01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1243,"description":1244,"path":1245,"stem":1246,"children":1247,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1248,1252,1257,1262,1267,1272],{"title":1249,"path":1245,"stem":1250,"description":1251},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1253,"path":1254,"stem":1255,"description":1256},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1258,"path":1259,"stem":1260,"description":1261},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1263,"path":1264,"stem":1265,"description":1266},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1268,"path":1269,"stem":1270,"description":1271},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1273,"path":1274,"stem":1275,"description":1276},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1278,"description":1279,"path":1280,"stem":1281,"children":1282,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1283,1287,1292,1297,1302,1307,1312,1317,1322,1327],{"title":1284,"path":1280,"stem":1285,"description":1286},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1288,"path":1289,"stem":1290,"description":1291},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1293,"path":1294,"stem":1295,"description":1296},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1298,"path":1299,"stem":1300,"description":1301},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1303,"path":1304,"stem":1305,"description":1306},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1308,"path":1309,"stem":1310,"description":1311},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1313,"path":1314,"stem":1315,"description":1316},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1318,"path":1319,"stem":1320,"description":1321},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1323,"path":1324,"stem":1325,"description":1326},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1328,"path":1329,"stem":1330,"description":1331},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1333,"description":1334,"path":1335,"stem":1336,"children":1337,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1338,1341,1346,1351,1356,1361],{"title":1333,"path":1335,"stem":1339,"description":1340},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1342,"path":1343,"stem":1344,"description":1345},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1347,"path":1348,"stem":1349,"description":1350},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1352,"path":1353,"stem":1354,"description":1355},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1357,"path":1358,"stem":1359,"description":1360},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1362,"path":1363,"stem":1364,"description":1365},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1367,"description":1368,"path":1369,"stem":1370,"children":1371,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1372,1376,1381,1386,1391,1396,1400,1405],{"title":1373,"path":1369,"stem":1374,"description":1375},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1377,"path":1378,"stem":1379,"description":1380},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1382,"path":1383,"stem":1384,"description":1385},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1387,"path":1388,"stem":1389,"description":1390},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1392,"path":1393,"stem":1394,"description":1395},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1347,"path":1397,"stem":1398,"description":1399},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1401,"path":1402,"stem":1403,"description":1404},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1406,"path":1407,"stem":1408,"description":1409},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1411,"description":1412,"path":1413,"stem":1414,"children":1415,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1416,1420],{"title":1417,"path":1413,"stem":1418,"description":1419},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1421,"path":1422,"stem":1423,"description":1424},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1426,"description":1427,"path":1428,"stem":1429,"children":1430,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1431,1435,1440,1445,1450,1455,1460,1465,1470,1475,1480,1485,1490],{"title":1432,"path":1428,"stem":1433,"description":1434},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1436,"path":1437,"stem":1438,"description":1439},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1441,"path":1442,"stem":1443,"description":1444},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1446,"path":1447,"stem":1448,"description":1449},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1451,"path":1452,"stem":1453,"description":1454},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1456,"path":1457,"stem":1458,"description":1459},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1461,"path":1462,"stem":1463,"description":1464},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1466,"path":1467,"stem":1468,"description":1469},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1471,"path":1472,"stem":1473,"description":1474},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1476,"path":1477,"stem":1478,"description":1479},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1481,"path":1482,"stem":1483,"description":1484},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1486,"path":1487,"stem":1488,"description":1489},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1491,"path":1492,"stem":1493,"description":1494},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1496,"description":1497,"path":1498,"stem":1499,"children":1500,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1501,1505,1510],{"title":1502,"path":1498,"stem":1503,"description":1504},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1506,"path":1507,"stem":1508,"description":1509},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1511,"path":1512,"stem":1513,"description":1514},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184840]