Phase 4: Trust Boundary Analysis
Objective
Identify where trust levels change in the system. Every crossing point is a potential attack surface that needs security controls.
Trust-boundary state starts empty. Define zones, crossing points, and boundaries
for the system under review before advancing.
Concepts
- Trust Zone: A region where components and data stores share the same trust level
- Crossing Point: Where data flows between zones (requires authentication/authorization)
- Trust Boundary: The security perimeter with specific controls
Tools Reference
Start with manage_trust_boundaries(action="describe", section=SECTION) for the
exact contract.
manage_trust_boundaries(action="add", section="zones", values=ZONE)
| Parameter |
Values |
| trust_level |
Untrusted, Low, Medium, High, Full |
manage_trust_boundaries(action="link", section="zones", values=LINK)
Assign an architecture node to exactly one trust zone. The link fields are
zone_id and node_id; a node may be either a component or a data store.
manage_trust_boundaries(action="add", section="crossing_points", values=CROSSING)
| Parameter |
Values |
| authentication_method |
Password, Multi-factor, Certificate, Token, Biometric, API Key, IAM Role, OAuth, None, Other |
| authorization_method |
Role-based, Attribute-based, Discretionary, Mandatory, Policy-based, Rule-based, None, Other |
manage_trust_boundaries(action="link", section="crossing_points", values=LINK)
Map existing connections to crossing points.
manage_trust_boundaries(action="add", section="boundaries", values=BOUNDARY)
| Parameter |
Values |
| type |
Network, Process, Physical, Container, Virtual Machine, Account, Other |
| crossing_point_ids |
List of crossing point IDs |
| controls |
List of security control names (strings) |
Other Phase 4 Tools
manage_trust_boundaries(action="list", section="all") -- Review the complete modelmanage_trust_boundaries(action="detection_plan", section="all") -- AI-powered boundary detectionmanage_trust_boundaries(action="analysis_plan", section="all") -- Security analysis guidance- CRUD actions accept
values for one record and items for a batch
Common Trust Zone Patterns
Web Application
| Zone |
Trust Level |
Architecture Nodes |
| Internet |
Untrusted |
End users, external APIs |
| DMZ |
Low |
Load balancer, CDN, WAF |
| Application |
Medium |
App servers, API services |
| Data |
High |
Databases, caches, queues |
| Admin |
Full |
Admin consoles, CI/CD |
Microservices
| Zone |
Trust Level |
Architecture Nodes |
| Public |
Untrusted |
API Gateway, public endpoints |
| Service Mesh |
Medium |
Internal microservices |
| Data Layer |
High |
Databases, object stores |
| Secrets |
Full |
KMS, secret managers |
Workflow
- Call
manage_workflow(action="guidance", phase="4")
- Call
manage_trust_boundaries(action="detection_plan", section="all") for AI-guided detection
- Create trust zones based on security domains
- Assign every component and data store to a zone with
action="link", section="zones"
- Define crossing points where data flows between zones
- Map connections to crossing points with
action="link", section="crossing_points"
- Create trust boundaries with security controls
Completion Criteria
Common Pitfalls
- Putting everything in one trust zone
- Missing the boundary between internal services and external APIs
- Not specifying authentication/authorization at crossing points
- Forgetting admin/management plane boundaries
1---2name: phase-4-trust-boundaries3description: Phase 4 Trust Boundary Analysis guide. Use when defining trust zones, crossing points, and security boundaries between architecture nodes.4---56# Phase 4: Trust Boundary Analysis78## Objective9Identify where trust levels change in the system. Every crossing point is a potential attack surface that needs security controls.1011Trust-boundary state starts empty. Define zones, crossing points, and boundaries12for the system under review before advancing.1314## Concepts1516- **Trust Zone**: A region where components and data stores share the same trust level17- **Crossing Point**: Where data flows between zones (requires authentication/authorization)18- **Trust Boundary**: The security perimeter with specific controls1920## Tools Reference2122Start with `manage_trust_boundaries(action="describe", section=SECTION)` for the23exact contract.2425### manage_trust_boundaries(action="add", section="zones", values=ZONE)26| Parameter | Values |27|---|---|28| trust_level | Untrusted, Low, Medium, High, Full |2930### manage_trust_boundaries(action="link", section="zones", values=LINK)31Assign an architecture node to exactly one trust zone. The link fields are32`zone_id` and `node_id`; a node may be either a component or a data store.3334### manage_trust_boundaries(action="add", section="crossing_points", values=CROSSING)35| Parameter | Values |36|---|---|37| authentication_method | Password, Multi-factor, Certificate, Token, Biometric, API Key, IAM Role, OAuth, None, Other |38| authorization_method | Role-based, Attribute-based, Discretionary, Mandatory, Policy-based, Rule-based, None, Other |3940### manage_trust_boundaries(action="link", section="crossing_points", values=LINK)41Map existing connections to crossing points.4243### manage_trust_boundaries(action="add", section="boundaries", values=BOUNDARY)44| Parameter | Values |45|---|---|46| type | Network, Process, Physical, Container, Virtual Machine, Account, Other |47| crossing_point_ids | List of crossing point IDs |48| controls | List of security control names (strings) |4950### Other Phase 4 Tools51- `manage_trust_boundaries(action="list", section="all")` -- Review the complete model52- `manage_trust_boundaries(action="detection_plan", section="all")` -- AI-powered boundary detection53- `manage_trust_boundaries(action="analysis_plan", section="all")` -- Security analysis guidance54- CRUD actions accept `values` for one record and `items` for a batch5556## Common Trust Zone Patterns5758### Web Application59| Zone | Trust Level | Architecture Nodes |60|---|---|---|61| Internet | Untrusted | End users, external APIs |62| DMZ | Low | Load balancer, CDN, WAF |63| Application | Medium | App servers, API services |64| Data | High | Databases, caches, queues |65| Admin | Full | Admin consoles, CI/CD |6667### Microservices68| Zone | Trust Level | Architecture Nodes |69|---|---|---|70| Public | Untrusted | API Gateway, public endpoints |71| Service Mesh | Medium | Internal microservices |72| Data Layer | High | Databases, object stores |73| Secrets | Full | KMS, secret managers |7475## Workflow76771. **Call `manage_workflow(action="guidance", phase="4")`**782. **Call `manage_trust_boundaries(action="detection_plan", section="all")`** for AI-guided detection793. **Create trust zones** based on security domains804. **Assign every component and data store** to a zone with `action="link", section="zones"`815. **Define crossing points** where data flows between zones826. **Map connections** to crossing points with `action="link", section="crossing_points"`837. **Create trust boundaries** with security controls8485## Completion Criteria86- [ ] All trust zones defined87- [ ] Every architecture node assigned to exactly one zone88- [ ] Every inter-zone connection mapped to exactly one matching crossing point89- [ ] Every crossing point assigned to a trust boundary90- [ ] No crossing points created when all communication remains within one zone91- [ ] Call `manage_workflow(action="advance")` to proceed to Phase 59293## Common Pitfalls94- Putting everything in one trust zone95- Missing the boundary between internal services and external APIs96- Not specifying authentication/authorization at crossing points97- Forgetting admin/management plane boundaries
awslabs