Threat modelling an agentic feature
Half an hour with a whiteboard that saves an incident review.
Draw the feature as a graph: inputs, the model, each tool, each credential, each destination. Anything a third party can influence gets marked untrusted — that includes web pages, uploaded files, and email bodies.
For each tool, ask what the worst legitimate call looks like if the attacker is writing it. Not "could the model be tricked" — assume it is. What does the trick get them?
Then reduce. Downgrade write tools to read tools, split one broad credential into several narrow ones, insert an approval step before irreversible actions, and put a rate limit and a spend cap on the loop.
The shape of it
- 01
Map
Inputs, tools, credentials, destinations — one diagram.
- 02
Mark
Every source a third party can influence is untrusted.
- 03
Assume compromise
For each tool: what does an attacker gain by calling it?
- 04
Reduce
Narrow scopes, add gates, cap the loop, log everything.
Want this applied to your situation?
Sessions are direct and specific — you leave with a decision, not a reading list.
Book a session