Security Overview
A system-level threat model for an agent: draw the trust boundaries, run STRIDE on each crossing, name the 2026 OWASP risks, put each control on the boundary where it runs, and state what the provider keeps.
Last updated
After this section you can
- Draw the trust boundaries of an agent and name the control that runs at each one
- Run STRIDE on each crossing and map every risk to its 2026 OWASP ID
- State what a model provider keeps, and name the owner of each residual risk
11
Security Overview
Draw the trust boundaries, run STRIDE on each crossing, name the 2026 OWASP risks, and state what the provider keeps.
Key idea
A fooled model is survivable only when code outside it bounds what it can do. Name each trust boundary, the control that runs there, and the owner who answers for it.
Every crossing has one control and one owner
Dashed teal rules are trust boundaries; each chip names the control that runs there and the section that owns it.