Task 4.1. Evaluated 2026-09-05. Record eve.threat-model.v1, digest
4f0953a36c8a.
Every plane of Eve, every data flow into her prompt, and every threat class the ledger names — plus one the pinned OWASP source carries that the ledger's sentence does not. The planes, classes and cells come from the shipped model; the surface they claim is checked against the real route file and tool sources; the external anchors are requirement ids from the task-0.4 crosswalk, which pins each source at a version.
Coverage#
| Planes | Classes | Matrix cells | Applicable | Controlled | Partial | Gap | Not applicable |
|---|---|---|---|---|---|---|---|
| 12 | 12 | 144 | 75 | 49 | 20 | 6 | 69 |
Surface: 25 assistant routes (all 25 carrying both the auth and abuse pre-handlers, 12 reachable without an admin-scope check), 88 agent tools, 9 model legs. Data flows: 11 present, 4 absent.
Not-applicable cells are DERIVED: a class applies to a plane exactly when the plane holds every capability the class requires, so a blank is a missing capability rather than a judgement.
Matrix#
✓ controlled · ~ partially controlled, gap named · ✗ uncontrolled, gap
named · · not applicable
| Plane | goal-hijack | tool-misuse | identity-privilege-abuse | agent-tool-supply-chain | unexpected-code-execution | memory-context-poisoning | insecure-inter-agent-communication | cascading-failure | denial-of-wallet-or-service | exfiltration | repudiation | human-agent-trust-exploitation |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
session-http |
· | · | ✓ | · | · | · | · | · | ~ | ✓ | · | · |
operator-http |
· | ✓ | ✓ | · | · | · | · | · | ~ | ✓ | ✓ | · |
prompt-assembly |
~ | · | · | ✓ | · | · | · | · | ✓ | · | · | · |
member-domain-tools |
~ | ✓ | ✓ | · | · | ~ | · | · | ✓ | ✓ | ✓ | ✓ |
client-tool-bridge |
~ | ✓ | · | · | ✓ | · | ✓ | ✓ | ✓ | ~ | ✓ | ✓ |
retrieval |
~ | · | · | ~ | · | ~ | · | · | ✓ | ✓ | · | ✓ |
operator-tools |
✗ | · | ✓ | · | · | · | · | · | ✓ | ~ | · | ✓ |
memory-and-session |
~ | ✓ | ✓ | · | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ |
workbench-intent |
~ | ✓ | ✓ | · | · | ~ | ✓ | ✓ | ✓ | ✗ | ~ | ✓ |
model-provider |
· | · | · | ~ | · | · | ~ | ~ | · | ~ | · | ✓ |
voice |
✗ | · | ✓ | · | · | · | ✗ | ✓ | ✓ | ✗ | · | ✗ |
audit-and-evidence |
· | ✓ | ✓ | · | · | ✓ | · | · | · | ✓ | ~ | ✓ |
Planes#
| Plane | Boundary | Routes | Tools | Legs | Capabilities |
|---|---|---|---|---|---|
session-http |
Between a signed-in member's browser and the BFF: session creation, the message and turn intake, feedback, action results, and session deletion. | 9 | 0 | 0 | accepts-untrusted-input carries-identity persists-state emits-outward |
operator-http |
Between an operator-scoped caller and the BFF: fleet and health reads, the feedback corpus, the catalog surfaces, and the tour-submission review flow. | 9 | 0 | 0 | carries-identity holds-authority emits-outward accepts-untrusted-input |
prompt-assembly |
Between everything Eve reads and the tokens the model sees: conduct rules, the page-context block, the catalog and tour blocks, retrieved excerpts, tool results, memory and compacted history. | 0 | 0 | 0 | accepts-untrusted-input reaches-the-model ingests-external-definition |
member-domain-tools |
Between the model's tool calls and the member's own product data across the V-series domains, plus the curated tour surface. | 0 | 34 | 0 | holds-authority carries-identity reaches-the-model accepts-untrusted-input persists-state emits-outward |
client-tool-bridge |
Between the BFF and code running in the member's browser: navigation, highlighting, text reads and opt-in viewport captures are executed there and their results are posted back. | 1 | 4 | 0 | executes-code crosses-process-boundary accepts-untrusted-input reaches-the-model holds-authority emits-outward |
retrieval |
Between the built docs corpora and the model: the lexical index, the dense index built over it, and the audience boundary between the member and full scopes. | 0 | 1 | 0 | accepts-untrusted-input reaches-the-model ingests-external-definition persists-state emits-outward |
operator-tools |
Between the model and operator-only read surfaces: the workspace overview, review queues, incidents, crash groups, the model registry, support, rights and moderation queues, release readiness, the calendar planner and the docs freshness verdict. | 0 | 13 | 0 | carries-identity reaches-the-model accepts-untrusted-input emits-outward |
memory-and-session |
Between one turn and the next: operator memory entries, session checkpoints, and the compacted history block. | 0 | 2 | 0 | persists-state reaches-the-model accepts-untrusted-input carries-identity holds-authority emits-outward |
workbench-intent |
Between the model and the operator work estate: work items, threads, briefs, decisions, releases, graph links, the agent fleet and the kit command surface. | 0 | 31 | 0 | holds-authority persists-state carries-identity crosses-process-boundary reaches-the-model accepts-untrusted-input emits-outward |
model-provider |
Between the BFF and the model providers: the turn, escalation, judge and embedding legs that route through OpenRouter, and the operator-configured speech and vision legs. | 0 | 0 | 9 | spends-money crosses-process-boundary emits-outward reaches-the-model ingests-external-definition |
voice |
Between the member's microphone and speakers and third-party speech providers: audio uploaded for transcription, and text synthesised back to audio. | 2 | 0 | 0 | accepts-untrusted-input reaches-the-model crosses-process-boundary emits-outward carries-identity |
audit-and-evidence |
Between what happened and what is recorded: the per-actor audit run, its coverage marks, and the telemetry the operator surfaces read. | 4 | 3 | 0 | persists-state carries-identity holds-authority emits-outward reaches-the-model |
Threat classes and their anchors#
| Class | Requires | Crosswalk requirement ids |
|---|---|---|
goal-hijack |
accepts-untrusted-input reaches-the-model |
ASI01 Agent Goal Hijack, Generative AI Taxonomy §3.3 Direct Prompting, Generative AI Taxonomy §3.3 Indirect Prompt Injection |
tool-misuse |
holds-authority |
ASI02 Tool Misuse and Exploitation, Tools capability declaration, Input/output schema validity, Human-in-the-loop safety guidance |
identity-privilege-abuse |
carries-identity |
ASI03 Identity and Privilege Abuse, Authorization §Protocol Requirements, Access token audience and no token passthrough |
agent-tool-supply-chain |
ingests-external-definition |
ASI04 Agentic Supply Chain Vulnerabilities, Value Chain and Component Integration |
unexpected-code-execution |
executes-code |
ASI05 Unexpected Code Execution (RCE) |
memory-context-poisoning |
persists-state reaches-the-model |
ASI06 Memory & Context Poisoning, NISTAML.011, NISTAML.012, NISTAML.013, NISTAML.023, NISTAML.024, NISTAML.026, NISTAML.051 |
insecure-inter-agent-communication |
crosses-process-boundary |
ASI07 Insecure Inter-Agent Communication, ASI10 Rogue Agents, Lifecycle initialize/version negotiation, Protocol-version mismatch |
cascading-failure |
crosses-process-boundary |
ASI08 Cascading Failures, notifications/cancelled request restrictions, Cancellation race handling |
denial-of-wallet-or-service |
accepts-untrusted-input |
Enumeration and rate-limit security, Rate-limit guidance (partly initiative-originated) |
exfiltration |
emits-outward |
NISTAML.03, Data Privacy, Information Security |
repudiation |
holds-authority |
GOVERN 4, MEASURE 3 (partly initiative-originated) |
human-agent-trust-exploitation |
reaches-the-model emits-outward |
ASI09 Human-Agent Trust Exploitation, Confabulation, Information Integrity |
Taxonomy requirements carried by no class, each excused by name in the model:
NISTAML.022, NISTAML.025. Every other one of the 22 requirements in the two
threat-taxonomy sources is cited by a class.
Data flows#
| Flow | Presence | Trust | Plane |
|---|---|---|---|
| Member or operator text | present | untrusted | session-http |
| Page context: path, title, headings and anchors | present | untrusted | prompt-assembly |
| Rendered controls by role, accessible name and state | present | untrusted | client-tool-bridge |
| The text the member has selected on the page | present | untrusted | prompt-assembly |
| Retrieved documentation excerpts | present | untrusted | retrieval |
| Results returned by server and client tools | present | untrusted | member-domain-tools |
| Work items, threads, briefs, decisions and fleet state | present | untrusted | workbench-intent |
| Operator memory recalled into the prompt | present | operator-authored | memory-and-session |
| A transcript of uploaded audio | present | untrusted | voice |
| Confirmation cards and tour steps rendered to the member | present | system-authored | client-tool-bridge |
| Direct messages between agents | absent | untrusted | — |
| Inbound messaging-channel content | absent | untrusted | — |
| Output from a creative-tool host | absent | untrusted | — |
| Opt-in viewport screenshots and their visual descriptions | present | untrusted | client-tool-bridge |
| Member-uploaded files | absent | untrusted | — |
What this model found#
6 uncontrolled cells and 20 partially controlled ones, owned by 8 tasks:
- task 13.5 — 2 cell(s):
workbench-intent/repudiation,audit-and-evidence/repudiation - task 15.1 — 3 cell(s):
model-provider/agent-tool-supply-chain,voice/insecure-inter-agent-communication,voice/exfiltration - task 15.2 — 2 cell(s):
model-provider/insecure-inter-agent-communication,model-provider/cascading-failure - task 15.6 — 2 cell(s):
session-http/denial-of-wallet-or-service,operator-http/denial-of-wallet-or-service - task 3.6 — 2 cell(s):
retrieval/agent-tool-supply-chain,retrieval/memory-context-poisoning - task 4.3 — 10 cell(s):
prompt-assembly/goal-hijack,member-domain-tools/goal-hijack,client-tool-bridge/goal-hijack,retrieval/goal-hijack,operator-tools/goal-hijack,memory-and-session/goal-hijack,workbench-intent/goal-hijack,voice/goal-hijack,member-domain-tools/memory-context-poisoning,workbench-intent/memory-context-poisoning - task 4.4 — 1 cell(s):
voice/human-agent-trust-exploitation - task 4.5 — 4 cell(s):
client-tool-bridge/exfiltration,operator-tools/exfiltration,workbench-intent/exfiltration,model-provider/exfiltration
Honest limits#
- This model asserts that a named control EXISTS and that its file and symbol are on disk. Whether that control actually defeats the threat on that plane is not machine-checkable and is not claimed; the adversarial family per vector is task 4.3, and a control named here may still be insufficient.
- Applicability is derived from declared capabilities. A capability claim that is wrong — a plane that executes code without saying so — closes cells that should be open, and the only defence is that every claim names code a reader can check.
- The surface scan reads the route file and the tool-binding sources as text. A route registered through a helper this scanner does not recognise, or a tool defined by a shape other than name-then-description, would be invisible to it; the tool count is cross-checked against the prompt-bytes ratchet in the evidence run.
- The two-way taxonomy sweep covers the two threat-taxonomy sources only. The protocol and quality sources in the crosswalk are cited where they bear on a class and are not swept, because modelling every clause of a transport specification here would be coverage theatre.
- Trust labels and taint propagation across prompt assembly are task 4.2, not this task. This model records WHERE untrusted content enters and which cells depend on that; it does not implement a label.