# Phase 5 Asset Flows

> Phase 5 Asset Flow Analysis guide. Use when identifying valuable assets, tracking data flows, or analyzing how sensitive data moves through the system.

- Skill: `awslabs/phase-5-asset-flows` (Agent Skill)
- Install (CLI): `npx skillmds@latest add awslabs/phase-5-asset-flows`
- Raw SKILL.md: https://api.skillmd.com/api/skills/awslabs/phase-5-asset-flows/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: awslabs (https://skillmd.com/u/awslabs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/awslabs/phase-5-asset-flows

---


# Phase 5: Asset Flow Analysis

## Objective
Identify every valuable asset in the system and track how it moves between components. This reveals where assets are exposed and what protections exist.

## Tools Reference

Call `manage_asset_flows(action="describe", section=SECTION)` for the exact
contract and enum values.

### manage_asset_flows(action="add", section="assets", values=ASSET)
| Parameter | Required | Values |
|---|---|---|
| name | Yes | e.g., "Credit Card Numbers" |
| type | Yes | Data, Credential, Process, Configuration, Cryptographic Key, Token, Session, Other |
| classification | Yes | Public, Internal, Confidential, Restricted |
| lifecycle_state | No | Active, Archived, Pending deletion, Quarantined |
| data_states | No | At rest, In transit, In use (multiple allowed) |
| owner | No | Team or person responsible |
| criticality | No | 1-5 scale (5 = most critical). Business importance only; data sensitivity is `classification`. |

### manage_system_context(action="update", section="data_assets", item_id=PROFILE_ID, values={"asset_id": ASSET_ID, ...})
Link each data classification profile created in Phase 1 to the matching asset ID.
Complete every applicable Data Classification dimension during this update. Use
`action="add", section="data_assets"` only for data first discovered in this phase.

### manage_asset_flows(action="add", section="flows", values=FLOW)
| Parameter | Required | Values |
|---|---|---|
| asset_id | Yes | Asset ID from the asset add response |
| source_id | Yes | Component or data-store node ID |
| destination_id | Yes | Component or data-store node ID |
| transformation_type | No | Encryption, Decryption, Processing, Aggregation, Anonymization, Pseudonymization, Tokenization, Hashing, Signing, Verification, Redaction, Other |
| controls | No | List of: Encryption, Access Control, Authentication, Authorization, Audit Logging, Input Validation, Output Encoding, Integrity Check, Rate Limiting, Monitoring, Other |
| encryption | No | true/false |
| authenticated | No | true/false |
| authorized | No | true/false |
| validated | No | true/false |
| risk_level | No | 1-5 scale (5 = highest risk) |

### Other Phase 5 Tools
- `manage_asset_flows(action="list", section="all")` -- Review current state
- `manage_asset_flows(action="get", section=SECTION, item_id=ID)` -- Detailed view
- `manage_asset_flows(action="update", section=SECTION, item_id=ID, values=UPDATES)` -- Atomically update
- `manage_asset_flows(action="delete", section=SECTION, item_id=ID)` -- Remove a record
- `manage_asset_flows(action="clear", section="all")` -- Clear all assets and flows
- `manage_system_context(action="list", section="data_assets")` -- Match Phase 1 profiles to asset IDs

To clear nullable values, pass `clear_fields` to an update. Asset fields that can be
cleared are `lifecycle_state`, `description`, `owner`, `criticality`, and `metadata`.
Flow fields are `transformation_type`, `description`, `protocol`, and `risk_level`.

## Asset Identification Guide

Look for these in the codebase:

| What to Find | Asset Type | Typical Classification |
|---|---|---|
| Passwords, API keys, tokens | Credential | Restricted |
| PII (names, emails, addresses) | Data | Confidential |
| Payment data (credit cards) | Data | Restricted |
| Session tokens, JWTs | Token | Confidential |
| Encryption keys, certificates | Cryptographic Key | Restricted |
| Config files, env vars | Configuration | Internal |
| Audit/access logs | Data | Internal |
| Public content, marketing | Data | Public |

## Risk Level Guide for Flows

| Risk Level | Criteria |
|---|---|
| 5 (Critical) | Restricted data, crosses trust boundary, no encryption |
| 4 (High) | Confidential data crossing trust boundary |
| 3 (Medium) | Confidential data within same zone, or internal data crossing boundary |
| 2 (Low) | Internal data within same zone with controls |
| 1 (Minimal) | Public data with standard controls |

## Workflow

1. **Call `manage_workflow(action="guidance", phase="5")`**
2. **Identify assets** from code analysis (env vars, database schemas, API payloads)
3. **Add each asset** with `action="add", section="assets"` and include classification, data states, and criticality
4. **Link data profiles** with `manage_system_context(action="update", section="data_assets", item_id=PROFILE_ID, values={"asset_id": ASSET_ID, ...})`; use `action="add"` only when no Phase 1 profile exists
5. **Map flows** with `action="add", section="flows"` showing how each asset moves between component or data-store nodes
6. **Document controls** on each flow (encryption, auth, validation)
7. **Assign risk levels** based on the classification tier and protection gaps

## Completion Criteria
- [ ] All valuable assets identified and classified
- [ ] Data asset profiles linked to matching asset IDs without duplicates
- [ ] At least one flow exists and every asset participates in a flow
- [ ] Security controls documented on each flow
- [ ] Risk levels assigned to all flows
- [ ] High-risk flows (unprotected sensitive data) flagged
- [ ] Call `manage_workflow(action="advance")` to proceed to Phase 6