Threat model

Status and methodCopy Anchor Link

This is the initial threat model for buffered v1 evaluation. It uses trust boundaries and abuse cases informed by STRIDE, privacy, supply-chain, and ML failure analysis. It is not a completed security assessment. Streaming, a dynamic control plane, external plugins, and production data each require a phase-specific update before release.

Assets and security objectivesCopy Anchor Link

Trust boundariesCopy Anchor Link

Untrusted caller/provider payload
          │
          ▼
┌────────────────────┐ authenticated integration ┌──────────────────────┐
│ Gateway / app PEP  │──────────────────────────▶│ HTTP + adapter       │
└────────────────────┘                           └──────────┬───────────┘
                                                         │ canonical event
                              ┌───────────────────────────▼─────────────┐
                              │ Evaluator + immutable trusted snapshot │
                              └─────────┬───────────┬───────────────────┘
                                        │           │ future boundaries
                                  audit sink   local/remote/WASM detector

Portkey metadata and forwarded headers are adapter-supplied attributes, not trusted tenant identity unless an authenticated allowlisted server-side binding makes them so. A policy block is a successful evaluation; a transport/service failure is not.

Initial threat registerCopy Anchor Link

Portkey-specific controlsCopy Anchor Link

The initial adapter accepts the documented before/after webhook envelope, maps beforeRequestHook to input and afterRequestHook to output, and preserves unknown payload objects needed for full reconstruction. It returns HTTP 200 with verdict:false for a policy block. Malformed/authentication failures are 4xx; service failures are 5xx. Portkey's default timeout is approximately three seconds, so Groundskeeper's total deadline and check budgets must leave gateway margin.

The gateway's timeout/network/non-200 behavior is configured outside Groundskeeper and is not equivalent to an internal detector failure. Enforcement owners must resolve OD-005 and verify actual gateway configuration.

Deferred threat-model workCopy Anchor Link

Before streaming: model incremental UTF-8/SSE decoding, chunk-spanning matches, bounded reassembly, partial disclosure, backpressure, cancellation, tool-call withholding, and transformations after bytes have escaped.

Before external plugins: model supervisor/socket spoofing, local privilege and filesystem/network escape, remote workload identity, tenancy, retries, model/data exfiltration, WASM host calls, cache poisoning, update and revocation races.

Before a control plane: model authorization/RLS, approval separation, confused deputies, trust-root/key rotation, rollout targeting, rollback authorization, audit immutability, deletion, backup/restore, and supply-chain compromise.

Before payload retention or reversible tokenisation: complete a privacy impact and key-management design covering access, purpose, jurisdiction, re-identification, retention, deletion, backups, and breach response.

Residual risk and acceptanceCopy Anchor Link

Detectors are probabilistic and bypasses/false positives remain possible. A signed policy proves provenance, not safety. Numerical risk tolerances, SLOs, failure postures, external processing, and retention require named owners in the open-decisions register; engineering defaults do not accept those risks.