Threat model

Français : ../threat-model.md

Assets

Asset	Where
Tenant data (conversations, documents, memory, embeddings)	PostgreSQL (RLS), Qdrant, S3 storage
Secrets (LLM provider keys, connector OAuth tokens, API keys)	OpenBao, or encrypted with EAI_MASTER_KEY
System prompts and canaries	Control Plane, eai.domains.llm.guard
Audit chain	PostgreSQL, verified by eai.domains.observability.audit_api.verify
Budget and quotas (LLM cost)	Control Plane, LiteLLM
Images and delivery chain	Harbor, Forgejo and GitLab CI, GitOps

Trust boundaries

1. Internet to portal and APISIX gateway (TLS, Coraza WAF + OWASP CRS).
2. Gateway to Control Plane API (only peers in EAI_TRUSTED_PROXIES may set X-Forwarded-For and X-SPIFFE-ID).
3. Control Plane to databases (TLS, sslmode=verify-full, per tenant RLS).
4. Control Plane to LLM providers, tools, MCP, connectors (egress filtered by eai.security.egress and Cilium).
5. Untrusted content (documents, tool results, web pages) to the model (injection detection, nonce wrapping).
6. Model output to the user (link and image filtering, canary).
7. Source code to production (CI, signing, SBOM, Kyverno).

Attacker profiles

Profile	Typical goal	Main controls
Anonymous internet	Denial of service, brute force, scanning	WAF, AnonymousRateLimitMiddleware, EAI_RATE_LIMIT_AUTH_FAILURES_PER_MINUTE, LimitsMiddleware
Malicious tenant user	IDOR, role escalation, SSRF through a tool, cross tenant access	RLS, require_role, set_clause with allowed columns, EgressPolicy
Compromised agent or tool	Exfiltration, internal calls	Egress guard, per tenant egress_allowed_hosts, secrets outside prompts, safe_exec.run
Poisoned document or prompt	Indirect injection, exfiltration through markdown link	eai.domains.privacy.injection.detect, guard.wrap_messages, OutputGuard, StreamGuard
Compromised provider	Malicious answers, leakage	Output treated as untrusted, OutputGuard, Cilium deploy/cilium/egress-providers.yaml
Insider	Reading secrets, tampering with audit	OpenBao, verifiable audit chain, Kyverno, code review and CI

STRIDE per layer

S = spoofing, T = tampering, R = repudiation, I = information disclosure, D = denial of service, E = elevation of privilege.

Layer	Main threats	Controls
Portal	S: session theft; T/I: XSS; E: open redirect	portal/src/middleware.ts (CSP with nonce), buildCsp, safeHref, safeReturnTo, SECURITY_HEADERS in portal/src/lib/security.ts
API gateway and WAF	D: flooding; T: injection payloads	deploy/apisix/apisix.yaml, deploy/apisix/config.yaml, waf-gateway
Control Plane API	S: forged JWT; E: IDOR; D: huge bodies; I: error leakage	eai.auth, eai.security.limits, eai.security.ratelimit, eai.security.headers, eai.errors
LLM gateway and providers	I: system prompt leakage; D: cost	guard.add_canary, quotas, EAI_RATE_LIMIT_GATEWAY_PER_MINUTE
Agent runtime	E: hijack through injection; I: exfiltration	prompt_injection_mode, untrusted_content_wrapping, output_links
Tools, MCP and connectors	I/E: SSRF, DNS rebinding; T: forged webhooks	eai.integrations.outbound, eai.security.egress.GuardedTransport, signatures (connectors.service._parse_signature, channels.service._check_signature)
Data	I: cross tenant access; T: SQL injection	RLS through eai.db.tx, ident, qualified, frag, set_clause, like_pattern, int_limit
RAG and memory	T: poisoned documents	Injection detection at ingestion (test_rag_injection_risk_and_ingestion_flag)
Multimodal and realtime	E: command injection through ffmpeg	safe_exec.media_input, safe_exec.run (argument list, no shell)
Network and DNS	I: DNS tunneling, cloud metadata; S: ARP/DNS spoofing	Cilium default deny and DNS L7, network-dns-hardening, pod-security
Supply chain and CI/CD	T: trapped image or dependency	Trivy, SBOM and signing (sbom-sign), Kyverno, ci-security-gates