Threat Model: STRIDE on the Governed Workflow
Reviewed: 2026-07-22 · Canon: generation 8, effective 2026-07-21 · Method: STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) applied to the core evidence-to-decision flow on the Google Cloud spine.
Status vocabulary: Designed (specified, built to), Staged (present in the deployed synthetic environment), Gate (must pass with evidence before real-data activation).
1. Trust boundaries
+--------------------------------------------------+
| Zone A: untrusted public internet |
| (worker browser, facility browser, attacker) |
+------------------------+-------------------------+
| TLS (managed certs)
v
+--------------------------------------------------+
| Zone B: edge (Cloudflare DNS, Google load |
| balancing and TLS termination) |
+------------------------+-------------------------+
v
+--------------------------------------------------+
| Zone C: Cloud Run services (platform API, apps) |
| least-privilege service identities |
+-----------+---------------+----------------------+
| |
v v
+----------------+ +----------------+ +--------------------+
| Zone D: | | Zone E: | | Zone F: |
| Cloud SQL | | Cloud Storage | | provider edge |
| (private) | | (retention | | (AI models, |
| | | controls) | | sources) gated |
+----------------+ +----------------+ +--------------------+
2. STRIDE per category
S: Spoofing
| Threat | Mitigation | Status |
|---|---|---|
| Worker identity spoofing (someone else's evidence claimed) | Verified identity binding before evidence is treated as the worker's; identity-proofing vendor gated by agreement | Gate |
| Facility user spoofing | Server-verified authentication; enterprise SSO for organization users | Staged |
| Admin spoofing | Dedicated admin surface with hardened authentication | Staged; hardening tracked |
| Credential or token theft | Secrets in Secret Manager, rotation on suspected exposure, no committed credentials | Staged |
| Inbound webhook spoofing | Signature verification on inbound integrations | Designed per integration |
T: Tampering
| Threat | Mitigation | Status |
|---|---|---|
| Audit ledger tampering | Append-only design with hash chaining; tampering breaks the chain forward | Staged |
| Source receipt tampering | Hash binding of receipts to ledger entries; immutable artifact retention | Designed; retention lock is a gate |
| Evidence-class escalation (upload silently becomes verified) | Class labels cannot upgrade without the producing authority; enforced in the domain model | Staged |
| In-transit tampering | TLS mandatory on all surfaces | Staged |
| Backup tampering | Managed backups with point-in-time recovery; restore testing | Gate |
R: Repudiation
| Threat | Mitigation | Status |
|---|---|---|
| An organization denies a decision it made | Decision Records bind actor, authority, rationale, evidence and policy versions, and time; a named human is required on every regulated decision | Staged |
| A worker denies an upload or consent grant | Attributed intake and consent events in the ledger | Staged |
| A source result is disputed | Source receipts preserve what the source returned and when | Designed |
| AI blamed for a human decision, or vice versa | Doctrine plus schema: the actor field distinguishes agent actions from human decisions, and agents cannot occupy the decision role | Staged (architectural rule) |
I: Information Disclosure
| Threat | Mitigation | Status |
|---|---|---|
| Cross-tenant read (Facility A reads Facility B) | Tenant isolation enforced below the UI in queries and authorization | Staged |
| Worker A reading worker B's data | Per-principal access control on worker surfaces | Staged |
| Access beyond consent | Consent Grants are purpose-specific and revocable; disclosure is receipted | Designed |
| PHI in logs or error tracking | PHI classification and scrubbing before any real-data activation | Gate |
| PHI in URLs | Identifier-based URL design; no PHI in paths | Designed |
| Storage misconfiguration | Default-deny bucket policies, least-privilege identities, configuration review | Staged |
| Provider-side exposure | Minimized payloads; provider gates (contract, configuration, logging) before regulated data flows | Gate |
D: Denial of Service
| Threat | Mitigation | Status |
|---|---|---|
| Public-surface DDoS | Edge DDoS protections at DNS and load-balancing layers | Staged |
| API-level abuse | Rate limiting and per-tenant fairness in dispatch | Designed; tuning tracked |
| Source-quota exhaustion | Source-specific quotas, backoff, retry queues, dead-letter handling | Designed |
| Database connection exhaustion | Connection budgeting; no provider call inside a held transaction | Designed; capacity proof is a gate |
E: Elevation of Privilege
| Threat | Mitigation | Status |
|---|---|---|
| Role escalation to admin | Role provisioning requires explicit approval; default-deny | Staged |
| Service identity abuse | Least-privilege per-service identities; separate runtime, verifier, and decision capabilities | Staged |
| SQL injection | Parameterized queries only; no raw concatenation | Staged |
| Agent exceeding authority | Typed tool calls, budgets, approval gates; agents cannot mutate regulated state outside typed commands | Staged |
3. Top residual risks, stated honestly
- Known trust-hardening work remains open in the deployed backend. It is tracked and gated ahead of any real-data activation.
- No external pentest has been performed. Scheduled target Q4 2026; until then, review is internal.
- Recovery procedures are not yet proven under test. Backup, restore, incident, and failover testing are explicit gates before production real-data use.
- Consent and monitoring surfaces are ahead of their operating evidence. Designed and partly staged; operating claims wait for a real pilot.
4. Review cadence
- Quarterly review owned by Christian Montgomery (COO), with Abhishek Jha (CTO) on architecture surfaces.
- New surfaces or integrations trigger an ad-hoc threat model addition before ship.
- Incident and rail-violation reviews are immediate, per the company operating cadence.
End of threat model.