Security threat model

Modified synthesis of OpenAI security-threat-model; Apache-2.0. See provenance.

Produce a concise architectural threat model grounded in repository evidence. Apply during Design, or Specify for new boundaries, authentication/authorization, payments, sensitive data, uploads, code execution or significant integrations. This produces threats, not confirmed code vulnerabilities.

For systems assembling prompts, retrieving context, using persistent memory or exposing/consuming agent tools, read AI, agent and tool boundaries. Use only applicable AI, provider/consumer and protocol sections. Keep the material-assumption check-in.

For other evidenced boundaries, read only the matching model reference: