phase-5-asset-flows

name	phase-5-asset-flows
description	Phase 5 Asset Flow Analysis guide. Use when identifying valuable assets, tracking data flows, or analyzing how sensitive data moves through the system.

Phase 5: Asset Flow Analysis

Objective

Identify every valuable asset in the system and track how it moves between components. This reveals where assets are exposed and what protections exist.

Tools Reference

Call manage_asset_flows(action="describe", section=SECTION) for the exact contract and enum values.

manage_asset_flows(action="add", section="assets", values=ASSET)

Parameter	Required	Values
name	Yes	e.g., "Credit Card Numbers"
type	Yes	Data, Credential, Process, Configuration, Cryptographic Key, Token, Session, Other
classification	Yes	Public, Internal, Confidential, Restricted
lifecycle_state	No	Active, Archived, Pending deletion, Quarantined
data_states	No	At rest, In transit, In use (multiple allowed)
owner	No	Team or person responsible
criticality	No	1-5 scale (5 = most critical). Business importance only; data sensitivity is classification.

manage_system_context(action="update", section="data_assets", item_id=PROFILE_ID, values={"asset_id": ASSET_ID, ...})

Link each data classification profile created in Phase 1 to the matching asset ID. Complete every applicable Data Classification dimension during this update. Use action="add", section="data_assets" only for data first discovered in this phase.

manage_asset_flows(action="add", section="flows", values=FLOW)

Parameter	Required	Values
asset_id	Yes	Asset ID from the asset add response
source_id	Yes	Component or data-store node ID
destination_id	Yes	Component or data-store node ID
transformation_type	No	Encryption, Decryption, Processing, Aggregation, Anonymization, Pseudonymization, Tokenization, Hashing, Signing, Verification, Redaction, Other
controls	No	List of: Encryption, Access Control, Authentication, Authorization, Audit Logging, Input Validation, Output Encoding, Integrity Check, Rate Limiting, Monitoring, Other
encryption	No	true/false
authenticated	No	true/false
authorized	No	true/false
validated	No	true/false
risk_level	No	1-5 scale (5 = highest risk)

Other Phase 5 Tools

• manage_asset_flows(action="list", section="all") -- Review current state
• manage_asset_flows(action="get", section=SECTION, item_id=ID) -- Detailed view
• manage_asset_flows(action="update", section=SECTION, item_id=ID, values=UPDATES) -- Atomically update
• manage_asset_flows(action="delete", section=SECTION, item_id=ID) -- Remove a record
• manage_asset_flows(action="clear", section="all") -- Clear all assets and flows
• manage_system_context(action="list", section="data_assets") -- Match Phase 1 profiles to asset IDs

To clear nullable values, pass clear_fields to an update. Asset fields that can be cleared are lifecycle_state, description, owner, criticality, and metadata. Flow fields are transformation_type, description, protocol, and risk_level.

Asset Identification Guide

Look for these in the codebase:

What to Find	Asset Type	Typical Classification
Passwords, API keys, tokens	Credential	Restricted
PII (names, emails, addresses)	Data	Confidential
Payment data (credit cards)	Data	Restricted
Session tokens, JWTs	Token	Confidential
Encryption keys, certificates	Cryptographic Key	Restricted
Config files, env vars	Configuration	Internal
Audit/access logs	Data	Internal
Public content, marketing	Data	Public

Risk Level Guide for Flows

Risk Level	Criteria
5 (Critical)	Restricted data, crosses trust boundary, no encryption
4 (High)	Confidential data crossing trust boundary
3 (Medium)	Confidential data within same zone, or internal data crossing boundary
2 (Low)	Internal data within same zone with controls
1 (Minimal)	Public data with standard controls

Workflow

1. Call manage_workflow(action="guidance", phase="5")
2. Identify assets from code analysis (env vars, database schemas, API payloads)
3. Add each asset with action="add", section="assets" and include classification, data states, and criticality
4. Link data profiles with manage_system_context(action="update", section="data_assets", item_id=PROFILE_ID, values={"asset_id": ASSET_ID, ...}); use action="add" only when no Phase 1 profile exists
5. Map flows with action="add", section="flows" showing how each asset moves between component or data-store nodes
6. Document controls on each flow (encryption, auth, validation)
7. Assign risk levels based on the classification tier and protection gaps

Completion Criteria

• All valuable assets identified and classified
• Data asset profiles linked to matching asset IDs without duplicates
• At least one flow exists and every asset participates in a flow
• Security controls documented on each flow
• Risk levels assigned to all flows
• High-risk flows (unprotected sensitive data) flagged
• Call manage_workflow(action="advance") to proceed to Phase 6