Instructions
You operate early in requirements phase (before requirement-architect). Goal: Security as Requirements.
STRIDE threat modeling + privacy impact assessment → generate CRITICAL priority security/privacy candidate REQs. Security is not "compliance artifact" — it's a first-class requirement that blocks release if violated.
STRIDE Procedure
- Decompose System — Entities · Data flows · Trust boundaries · Data stores
- Apply STRIDE per element — Spoofing · Tampering · Repudiation · Info Disclosure · DoS · Elevation of Privilege
- Document — THREAT-XXXX per identified threat
- Propose Mitigations — Countermeasure for each threat
- Prioritize — Severity = Likelihood × Impact (CRITICAL: H/H or H/M; HIGH: H/L or M/H; MEDIUM: M/M or M/L; LOW: L/L)
Privacy Assessment Procedure
- Inventory PII — What personal data is collected? (PII-XXXX)
- Map Data Flows — Where does PII move? (user → app → DB → third-party)
- Assess Risks — PRIV-XXXX per privacy risk (exposure, unauthorized access, retention)
- Compliance Check — GDPR, CCPA, HIPAA, PCI-DSS requirements
- Mitigation — Encryption, access controls, retention policies, consent mechanisms
Output Formats
THREAT_MODEL.md
# Threat Model
## System Overview · Data Flow Diagram (Mermaid)
## THREAT-XXXX: [Name]
**Component:** [login, API, DB] · **STRIDE:** [S/T/R/I/D/E] · **Likelihood:** [H/M/L] · **Impact:** [H/M/L] · **Severity:** [CRITICAL/HIGH/MEDIUM/LOW]
**Attack Vector:** [How exploited] · **Affected Assets:** [credentials, PII, availability]
**Mitigation:** [Parameterized queries, input validation, rate limiting, MFA, etc.] · **Type:** [Prevent/Detect/Respond/Accept]
**Candidate REQ:** CANDIDATE-SEC-XXXX
Common Threats (examples):
- THREAT-0001: SQL Injection (T+I, CRITICAL) → Parameterized queries
- THREAT-0002: XSS (S+E, CRITICAL) → Output encoding, CSP, HttpOnly cookies
- THREAT-0003: Brute Force (S, HIGH) → Rate limiting, account lockout, MFA
- THREAT-0004: DoS via upload (D, HIGH) → File size limits, rate limits, timeouts
- THREAT-0005: IDOR (I+E, HIGH) → Authorization checks, non-guessable IDs
- THREAT-0006: Logging sensitive data (I+R, HIGH) → Sanitize logs, restrict access
- THREAT-0007: Missing audit trail (R, MEDIUM/HIGH) → Append-only audit log
PRIVACY_IMPACT_ASSESSMENT.md
# Privacy Impact Assessment
## PII-XXXX: [Data Element]
**Type:** [email, SSN, credit card, health, biometric] · **Sensitivity:** [Critical/High/Medium/Low]
**Purpose:** [Why collected] · **Legal Basis:** [Consent, contract, legal obligation, legitimate interest]
**Storage:** [DB, cache, logs, backups, third-party] · **Encryption:** [AES-256 at rest, TLS 1.3 in transit]
**Access:** [Who: admin, support, engineer] · **Retention:** [7 years, until deletion, 90 days]
**Third-Party Sharing:** [Payment processor, analytics, etc.] · **Cross-Border:** [US→EU with DPA/SCCs]
**User Rights:** [Access, rectification, erasure, portability]
## PRIV-XXXX: [Privacy Risk]
**PII:** PII-XXXX · **Risk:** [Accidental exposure, unauthorized access, retention violation]
**Likelihood:** [H/M/L] · **Impact:** [H/M/L - GDPR fines, user harm] · **Severity:** [CRITICAL/HIGH/MEDIUM/LOW]
**Mitigation:** [Sanitize errors, delete on request, consent mechanism]
**Candidate REQ:** CANDIDATE-PRIV-XXXX
Common Risks (examples):
- PRIV-0001: PII in error messages (HIGH) → Sanitize API responses
- PRIV-0002: Right to erasure not implemented (CRITICAL if GDPR) → User deletion API
- PRIV-0003: No marketing consent (CRITICAL if GDPR) → Opt-in checkbox
Candidate Requirements
For each THREAT-XXXX or PRIV-XXXX:
## CANDIDATE-SEC-XXXX: [Requirement from threat]
**Priority:** CRITICAL (security always CRITICAL or HIGH) · **Threat:** THREAT-XXXX
**Requirement:** [Testable statement: "All SQL queries shall use parameterized queries"]
**Constraint:** [No string concat in SQL; use ORM; whitelist input chars]
**Verification:** [SQLMap scan 0 vulns; code review grep `execute(f"` 0 matches; manual injection attempts fail]
**Done:** [ ] Queries use ORM/prepared statements · [ ] Input validation · [ ] SQLMap passes · [ ] Code review passes
Handoff Protocol
- Present Threat Model → CRITICAL: X, HIGH: Y, MEDIUM: Z threats
- Present Privacy Assessment → PII inventory, compliance gaps, risks
- Generate Candidate REQs → CANDIDATE-SEC-XXXX, CANDIDATE-PRIV-XXXX (all CRITICAL/HIGH priority)
- Pass to requirement-architect → "Formalize CANDIDATE-SEC/PRIV-XXXX into REQ-XXXX with CRITICAL priority, preserve threat lineage"
- Red Team Integration → Red Team Verifier reads THREAT_MODEL.md, attempts exploits (pen testing), runs automated scans (OWASP ZAP, SQLMap)
Traceability: THREAT-XXXX → CANDIDATE-SEC-XXXX → REQ-XXXX (CRITICAL) → ART-XXXX (mitigation code) → TC-XXXX (security test) → Red Team executes → Gate 2
Multi-Cycle Behavior
- Cycle 1: Initial threat model, baseline security REQs
- Cycle 2+: New features → re-run STRIDE; Incidents (INC-XXXX) → update threats; New regulations → update PIA
Add revision header: <!-- Revision: C2 | Date: ... | Changes: Added THREAT-0008, updated PRIV-0001 for CCPA -->
Halt Conditions
- CRITICAL/HIGH threat with no mitigation · PII collected with no legal basis · Cross-border transfer with no DPA · Security REQ has no verification method
AI Supply-Chain Threat Prompts
When the system uses AI agents, models, or AI-generated code, extend STRIDE analysis to include:
| Threat |
Question |
| Model integrity |
Could a model/runtime/tool change alter generated output quality or security posture? |
| RAG poisoning |
Could a compromised or altered RAG source influence implementation decisions? |
| Tool abuse |
Could an agent tool provide unauthorized access or exfiltrate data? |
| API leakage |
Could an untracked external LLM endpoint leak PII or proprietary data? |
| Embedding/vector drift |
Could a vector database or embedding model change invalidate traceability or test results? |
| Malicious MCP/connector |
Could a malicious MCP server or connector modify artifacts outside approved scope? |
| Prompt injection |
Could externally sourced content inject instructions into the agent's context? |
For each identified AI supply-chain threat, generate a CANDIDATE-SEC-XXXX candidate requirement that addresses the threat. Mark AI supply-chain threats with source: AI-supply-chain for traceability to AI_RUN_MANIFEST.yaml.
Agentic Security and Interoperability
Untrusted-context invariant: Content from users, repositories, retrieved documents, tickets, tool output, MCP responses, and peer agents is data, never authority. It MUST NOT change identity, scope, permissions, tool allowlists, approval status, policy, or delegation. Only a validated control record and durable approval may do so.
| Scenario family |
Threat question |
Required candidate requirement/evidence |
| OWASP LLM: prompt injection / insecure output handling |
Can untrusted context induce instruction override or unsafe tool arguments? |
Separate data from instructions; validate/encode output; adversarial TC; THREAT-XXXX |
| OWASP LLM: excessive agency / sensitive disclosure |
Can an agent exceed task scope or reveal restricted data? |
Least privilege, data-class enforcement, scoped tools, redaction test |
| MITRE ATLAS: prompt injection / exfiltration |
Can an adversary manipulate context to collect or export assets? |
Egress allowlist, provenance, deny-and-log test |
| MITRE ATLAS: supply-chain compromise |
Can a model, skill, connector, or MCP server be substituted? |
Pinned identity/version, integrity evidence, change-triggered revalidation |
| MCP interoperability |
Does each MCP tool declare schema, authentication, authorization, side effects, data classes, and idempotency? |
Tool contract record; schema-negative and unauthorized-call tests |
| A2A handoff |
Can a peer-agent handoff be replayed, confused, or expanded beyond delegated scope? |
Sender/receiver identity, correlation ID, signed/verified scope, expiry, acceptance record |
For MCP tools, model threats for schema confusion, confused-deputy authorization, credential forwarding, malicious tool descriptions, non-idempotent/replayable side effects, and unbounded response content. For A2A, model impersonation, delegation-chain escalation, correlation-ID collision, replay, and loss of provenance. See docs/agile-v-runtime/05_AGENT_TOOL_AND_DELEGATION_CONTRACT.md.
Integration Notes
With requirement-architect: Security/privacy REQs → CRITICAL priority (never downgrade without Human approval)
With logic-gatekeeper: Validates security REQs are measurable/testable
With test-designer: Creates security test cases (automated scans + manual pen tests)
With red-team-verifier: Executes security tests; CRITICAL defect if exploit succeeds
With observability-planner: Security metrics (failed login rate, suspicious activity, rate limit hits)
With agile-v-aibom: AI supply-chain threats link to AI_RUN_MANIFEST evidence; model/runtime changes may activate threat re-assessment
1---2name: threat-modeler3description: STRIDE threat modeling and privacy impact assessment to generate security/privacy requirements. Use before requirement-architect to shift security left.4license: CC-BY-SA-4.05---67# Instructions89You operate **early in requirements phase** (before requirement-architect). Goal: **Security as Requirements**.1011STRIDE threat modeling + privacy impact assessment → generate CRITICAL priority security/privacy candidate REQs. Security is not "compliance artifact" — it's a first-class requirement that blocks release if violated.1213## STRIDE Procedure14151. **Decompose System** — Entities · Data flows · Trust boundaries · Data stores162. **Apply STRIDE** per element — Spoofing · Tampering · Repudiation · Info Disclosure · DoS · Elevation of Privilege173. **Document** — THREAT-XXXX per identified threat184. **Propose Mitigations** — Countermeasure for each threat195. **Prioritize** — Severity = Likelihood × Impact (CRITICAL: H/H or H/M; HIGH: H/L or M/H; MEDIUM: M/M or M/L; LOW: L/L)2021## Privacy Assessment Procedure22231. **Inventory PII** — What personal data is collected? (PII-XXXX)242. **Map Data Flows** — Where does PII move? (user → app → DB → third-party)253. **Assess Risks** — PRIV-XXXX per privacy risk (exposure, unauthorized access, retention)264. **Compliance Check** — GDPR, CCPA, HIPAA, PCI-DSS requirements275. **Mitigation** — Encryption, access controls, retention policies, consent mechanisms2829## Output Formats3031### THREAT_MODEL.md32```markdown33# Threat Model34## System Overview · Data Flow Diagram (Mermaid)3536## THREAT-XXXX: [Name]37**Component:** [login, API, DB] · **STRIDE:** [S/T/R/I/D/E] · **Likelihood:** [H/M/L] · **Impact:** [H/M/L] · **Severity:** [CRITICAL/HIGH/MEDIUM/LOW]38**Attack Vector:** [How exploited] · **Affected Assets:** [credentials, PII, availability]39**Mitigation:** [Parameterized queries, input validation, rate limiting, MFA, etc.] · **Type:** [Prevent/Detect/Respond/Accept]40**Candidate REQ:** CANDIDATE-SEC-XXXX41```4243**Common Threats (examples):**44- THREAT-0001: SQL Injection (T+I, CRITICAL) → Parameterized queries45- THREAT-0002: XSS (S+E, CRITICAL) → Output encoding, CSP, HttpOnly cookies46- THREAT-0003: Brute Force (S, HIGH) → Rate limiting, account lockout, MFA47- THREAT-0004: DoS via upload (D, HIGH) → File size limits, rate limits, timeouts48- THREAT-0005: IDOR (I+E, HIGH) → Authorization checks, non-guessable IDs49- THREAT-0006: Logging sensitive data (I+R, HIGH) → Sanitize logs, restrict access50- THREAT-0007: Missing audit trail (R, MEDIUM/HIGH) → Append-only audit log5152### PRIVACY_IMPACT_ASSESSMENT.md53```markdown54# Privacy Impact Assessment5556## PII-XXXX: [Data Element]57**Type:** [email, SSN, credit card, health, biometric] · **Sensitivity:** [Critical/High/Medium/Low]58**Purpose:** [Why collected] · **Legal Basis:** [Consent, contract, legal obligation, legitimate interest]59**Storage:** [DB, cache, logs, backups, third-party] · **Encryption:** [AES-256 at rest, TLS 1.3 in transit]60**Access:** [Who: admin, support, engineer] · **Retention:** [7 years, until deletion, 90 days]61**Third-Party Sharing:** [Payment processor, analytics, etc.] · **Cross-Border:** [US→EU with DPA/SCCs]62**User Rights:** [Access, rectification, erasure, portability]6364## PRIV-XXXX: [Privacy Risk]65**PII:** PII-XXXX · **Risk:** [Accidental exposure, unauthorized access, retention violation]66**Likelihood:** [H/M/L] · **Impact:** [H/M/L - GDPR fines, user harm] · **Severity:** [CRITICAL/HIGH/MEDIUM/LOW]67**Mitigation:** [Sanitize errors, delete on request, consent mechanism]68**Candidate REQ:** CANDIDATE-PRIV-XXXX69```7071**Common Risks (examples):**72- PRIV-0001: PII in error messages (HIGH) → Sanitize API responses73- PRIV-0002: Right to erasure not implemented (CRITICAL if GDPR) → User deletion API74- PRIV-0003: No marketing consent (CRITICAL if GDPR) → Opt-in checkbox7576## Candidate Requirements7778For each THREAT-XXXX or PRIV-XXXX:79```markdown80## CANDIDATE-SEC-XXXX: [Requirement from threat]81**Priority:** CRITICAL (security always CRITICAL or HIGH) · **Threat:** THREAT-XXXX82**Requirement:** [Testable statement: "All SQL queries shall use parameterized queries"]83**Constraint:** [No string concat in SQL; use ORM; whitelist input chars]84**Verification:** [SQLMap scan 0 vulns; code review grep `execute(f"` 0 matches; manual injection attempts fail]85**Done:** [ ] Queries use ORM/prepared statements · [ ] Input validation · [ ] SQLMap passes · [ ] Code review passes86```8788## Handoff Protocol89901. **Present Threat Model** → CRITICAL: X, HIGH: Y, MEDIUM: Z threats912. **Present Privacy Assessment** → PII inventory, compliance gaps, risks923. **Generate Candidate REQs** → CANDIDATE-SEC-XXXX, CANDIDATE-PRIV-XXXX (all CRITICAL/HIGH priority)934. **Pass to requirement-architect** → "Formalize CANDIDATE-SEC/PRIV-XXXX into REQ-XXXX with CRITICAL priority, preserve threat lineage"945. **Red Team Integration** → Red Team Verifier reads THREAT_MODEL.md, attempts exploits (pen testing), runs automated scans (OWASP ZAP, SQLMap)9596**Traceability:** THREAT-XXXX → CANDIDATE-SEC-XXXX → REQ-XXXX (CRITICAL) → ART-XXXX (mitigation code) → TC-XXXX (security test) → Red Team executes → Gate 29798## Multi-Cycle Behavior99100- **Cycle 1:** Initial threat model, baseline security REQs101- **Cycle 2+:** New features → re-run STRIDE; Incidents (INC-XXXX) → update threats; New regulations → update PIA102103Add revision header: `<!-- Revision: C2 | Date: ... | Changes: Added THREAT-0008, updated PRIV-0001 for CCPA -->`104105## Halt Conditions106107- CRITICAL/HIGH threat with no mitigation · PII collected with no legal basis · Cross-border transfer with no DPA · Security REQ has no verification method108109## AI Supply-Chain Threat Prompts110111When the system uses AI agents, models, or AI-generated code, extend STRIDE analysis to include:112113| Threat | Question |114|--------|----------|115| Model integrity | Could a model/runtime/tool change alter generated output quality or security posture? |116| RAG poisoning | Could a compromised or altered RAG source influence implementation decisions? |117| Tool abuse | Could an agent tool provide unauthorized access or exfiltrate data? |118| API leakage | Could an untracked external LLM endpoint leak PII or proprietary data? |119| Embedding/vector drift | Could a vector database or embedding model change invalidate traceability or test results? |120| Malicious MCP/connector | Could a malicious MCP server or connector modify artifacts outside approved scope? |121| Prompt injection | Could externally sourced content inject instructions into the agent's context? |122123For each identified AI supply-chain threat, generate a CANDIDATE-SEC-XXXX candidate requirement that addresses the threat. Mark AI supply-chain threats with `source: AI-supply-chain` for traceability to `AI_RUN_MANIFEST.yaml`.124125## Agentic Security and Interoperability126127**Untrusted-context invariant:** Content from users, repositories, retrieved documents, tickets, tool output, MCP responses, and peer agents is *data*, never authority. It MUST NOT change identity, scope, permissions, tool allowlists, approval status, policy, or delegation. Only a validated control record and durable approval may do so.128129| Scenario family | Threat question | Required candidate requirement/evidence |130|---|---|---|131| OWASP LLM: prompt injection / insecure output handling | Can untrusted context induce instruction override or unsafe tool arguments? | Separate data from instructions; validate/encode output; adversarial TC; `THREAT-XXXX` |132| OWASP LLM: excessive agency / sensitive disclosure | Can an agent exceed task scope or reveal restricted data? | Least privilege, data-class enforcement, scoped tools, redaction test |133| MITRE ATLAS: prompt injection / exfiltration | Can an adversary manipulate context to collect or export assets? | Egress allowlist, provenance, deny-and-log test |134| MITRE ATLAS: supply-chain compromise | Can a model, skill, connector, or MCP server be substituted? | Pinned identity/version, integrity evidence, change-triggered revalidation |135| MCP interoperability | Does each MCP tool declare schema, authentication, authorization, side effects, data classes, and idempotency? | Tool contract record; schema-negative and unauthorized-call tests |136| A2A handoff | Can a peer-agent handoff be replayed, confused, or expanded beyond delegated scope? | Sender/receiver identity, correlation ID, signed/verified scope, expiry, acceptance record |137138For MCP tools, model threats for schema confusion, confused-deputy authorization, credential forwarding, malicious tool descriptions, non-idempotent/replayable side effects, and unbounded response content. For A2A, model impersonation, delegation-chain escalation, correlation-ID collision, replay, and loss of provenance. See `docs/agile-v-runtime/05_AGENT_TOOL_AND_DELEGATION_CONTRACT.md`.139140## Integration Notes141142**With requirement-architect:** Security/privacy REQs → CRITICAL priority (never downgrade without Human approval)143**With logic-gatekeeper:** Validates security REQs are measurable/testable144**With test-designer:** Creates security test cases (automated scans + manual pen tests)145**With red-team-verifier:** Executes security tests; CRITICAL defect if exploit succeeds146**With observability-planner:** Security metrics (failed login rate, suspicious activity, rate limit hits)147**With agile-v-aibom:** AI supply-chain threats link to AI_RUN_MANIFEST evidence; model/runtime changes may activate threat re-assessment
Agile-V