Threat model attacked before the design is built

The decision tree

5 typed decisions, each with an action for every answer

At fixed moments in a run, the engine puts one narrow question to a decision model. The decision model never writes text: it answers yes or no with a probability, picks from listed options, or gives a score, about a small slice of the material. The engine then does exactly what this tree says, which is what makes the run auditable. The thresholds are the template's design values, not measured results.

1. 1

   Planner, while planning

   Split or keep serialYes or no, with a probability

   While planning

   Does this data flow cross a trust boundary, such as browser to service or service to a third party, so that it deserves its own attack and defence pair?

   Sees only: One data flow description and the list of trust boundaries

   Why: Spends adversarial pairs on boundaries and leaves internal plumbing to one pass.

   00.25 and 0.551

   • Yes: 0.55 or higher→thenSplit the work
   • Unsure: 0.25 up to 0.55→thenSplit the work
   • No: below 0.25→thenKeep serial
2. 2

   After workers, the judge checks

   Evidence checkYes or no, with a probability

   After a worker answers

   Does the cited design section permit the attacker's step, for example by taking a record identifier from the client with no stated ownership check?

   Sees only: The attack's claimed step and the cited design section

   Why: Attacks resting on facts the documents do not contain become questions, not findings.

   00.50 and 0.851

   • Yes: 0.85 or higher→thenAccept
   • Unsure: 0.50 up to 0.85→thenMark unresolved
   • No: below 0.50→thenReject and retry
3. 3

   Evidence checkYes or no, with a probability

   After a worker answers

   Is the mitigation the defence relies on written in the design or the baseline in words that cover this attack path, rather than assumed?

   Sees only: The defence's cited passage and the attack path it answers

   Why: Assumed mitigations are exactly what a threat model written by the designers hides.

   00.50 and 0.851

   • Yes: 0.85 or higher→thenAccept
   • Unsure: 0.50 up to 0.85→thenEscalate to a strong model
   • No: below 0.50→thenReject and retry
4. 4

   Reconciler, while merging

   Conflict checkA choice among options

   While reconciling

   Set against the documented mitigation, does the attack still succeed?

   Sees only: The verified attack step and the verified mitigation passage

   Why: Only threats that survive a ruling from a third family reach the architect.

   • The mitigation answers the attack→thenAccept
   • The mitigation is partial or covers another path→thenEscalate to a strong model
   • It depends on a fact the documents do not state→thenMark unresolved
5. 5

   Accountable person, before anything is settled

   Person decidesYes or no, with a probability

   Before anything is reported as settled

   Would this surviving threat expose customer data, credentials or another tenant's resources if the design were built as written?

   Sees only: One surviving threat with its cited design section

   Why: Accepting, mitigating or blocking on a threat is the security architect's decision.

   Accountable: The security architect decides which surviving threats are accepted, mitigated or block the launch.

   00.10 and 0.351

   • Yes: 0.35 or higher→thenAsk a person
   • Unsure: 0.10 up to 0.35→thenAsk a person
   • No: below 0.10→thenAccept