Watch · narrated whiteboard episodesL2
Rethinking Threat Modeling for AI Agents
Classic threat modeling assumes a separable data/control plane and static, checkable trust boundaries. Agentic AI violates both — so a STRIDE-clean threat model can be walked straight through. A red-team analysis of exactly which assumptions break, why, and what replaces per-element enumeration.
-
13 min
Episode 1Why Classic Threat Modeling Fails on AI AgentsA whiteboard session opening with the stakes, then walking the full argument: how a STRIDE-clean threat model gets walked straight through an AI agent, why each assumption breaks, the provenance-and-authority approach that replaces it, and the practitioner toolkit.
-
10 min
Episode 2Threat Modeling AI Agents by Capability and ProvenanceA whiteboard session on the constructive method: change the unit of analysis to authority and provenance, build the Agent Authority Inventory, enforce it at a broker, and gate it in CI.
-
8 min
Episode 3Modeling Agent Identity and Delegated AuthorityA whiteboard session on the three identities in every agent tool call, the Delegation Ledger that makes borrowed authority reviewable, and the token discipline and CI gates that enforce it.
-
8 min
Episode 4Threat Modeling Multi-Agent and Tool SurfacesA whiteboard session on why a multi-agent system's danger lives in the edges between agents and tools, the Trust Surface Map that makes those edges reviewable, and the provenance and CI gates that enforce it.