// Phase 4 Trust Boundary Analysis guide. Use when defining trust zones, crossing points, and security boundaries between system components.
| name | phase-4-trust-boundaries |
| description | Phase 4 Trust Boundary Analysis guide. Use when defining trust zones, crossing points, and security boundaries between system components. |
Identify where trust levels change in the system. Every crossing point is a potential attack surface that needs security controls.
| Parameter | Values |
|---|---|
| trust_level | Untrusted, Low, Medium, High, Full |
Assign a component to exactly one trust zone.
| Parameter | Values |
|---|---|
| authentication_method | Password, Multi-factor, Certificate, Token, Biometric, API Key, IAM Role, OAuth, None, Other |
| authorization_method | Role-based, Attribute-based, Discretionary, Mandatory, Policy-based, Rule-based, None, Other |
Map existing connections to crossing points.
| Parameter | Values |
|---|---|
| type | Network, Process, Physical, Container, Virtual Machine, Account, Other |
| crossing_point_ids | List of crossing point IDs |
| controls | List of security control names (strings) |
list_trust_zones(), list_crossing_points(), list_trust_boundaries()get_trust_boundary_detection_plan() -- AI-powered boundary detectionget_trust_boundary_analysis_plan() -- Security analysis guidance| Zone | Trust Level | Components |
|---|---|---|
| Internet | Untrusted | End users, external APIs |
| DMZ | Low | Load balancer, CDN, WAF |
| Application | Medium | App servers, API services |
| Data | High | Databases, caches, queues |
| Admin | Full | Admin consoles, CI/CD |
| Zone | Trust Level | Components |
|---|---|---|
| Public | Untrusted | API Gateway, public endpoints |
| Service Mesh | Medium | Internal microservices |
| Data Layer | High | Databases, object stores |
| Secrets | Full | KMS, secret managers |
get_phase_4_guidance()get_trust_boundary_detection_plan() for AI-guided detectionadd_component_to_zone()add_conn_to_crossing()advance_phase() to proceed to Phase 5Phase 1 Business Context Analysis guide. Use when starting a threat model, setting business context, or configuring business features like industry sector, data sensitivity, and regulatory requirements.
Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling.
Phase 3 Threat Actor Analysis guide. Use when identifying threat actors, setting relevance and priority, or analyzing who might attack the system.
Phase 5 Asset Flow Analysis guide. Use when identifying valuable assets, tracking data flows, or analyzing how sensitive data moves through the system.
Phase 6 Threat Identification guide with STRIDE methodology reference. Use when identifying threats, categorizing security issues, applying STRIDE analysis, or assessing threat severity and likelihood.
Phase 7.5 Code Validation guide. Use when validating threats against actual code, checking which security controls are implemented, or generating remediation reports.