AI tool-execution threat model

// Review injected instructions, cross-tenant retrieval, unapproved actions and unbounded recursion in AI tool execution, and who owns each control; ordinal scores and coverage are illustrative assumptions.
// Synthetic worked example: all entities, schedules and measurements are illustrative.
// Every string below is EXAMPLE text from a fictional model: replace it.
// Replace assumptions and inputs before applying this model to actual work.

threat_model assessment {
  title: "Illustrative AI tool-execution threat model"
  framework: "STRIDE"
  scope: "Design review; scores are illustrative ordinal judgements"
}

asset asset_0 {
  name: "Tool authorisations"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

asset asset_1 {
  name: "Retrieved source content"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

threat r1 {
  title: "R1 · Source-injected instruction"
  // Scenario: Retrieved text is treated as execution authority
  asset: asset_0
  category: "tampering"
  likelihood: 3
  impact: 4
}

control control_0 {
  title: "Keep source content separate from tool policies"
  mitigates: [r1]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r2 {
  title: "R2 · Cross-tenant retrieval"
  // Scenario: Vector search omits tenant filter
  asset: asset_1
  category: "info-disclosure"
  likelihood: 2
  impact: 5
}

control control_1 {
  title: "Apply tenant scope before retrieval"
  mitigates: [r2]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r3 {
  title: "R3 · Unapproved consequential action"
  // Scenario: A model bypasses an action approval boundary
  asset: asset_0
  category: "elevation"
  likelihood: 4
  impact: 3
}

control control_2 {
  title: "Bind approval to exact typed action arguments"
  mitigates: [r3]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r4 {
  title: "R4 · Unbounded tool recursion"
  // Scenario: Repeated tool calls exhaust resources
  asset: asset_1
  category: "dos"
  likelihood: 3
  impact: 2
}

control control_3 {
  title: "Enforce per-run budgets and cancellation"
  mitigates: [r4]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

view risks: risk_matrix