Vord

Architecture Decision Record

0041. Privacy threat model (LINDDUN) and privacy-by-design

Context

ADR-0027 §5 reserved a LINDDUN-style privacy pass, and architecture §12.7 carries it as a residual. The STRIDE pass treats the directory's PII as a single asset class but does not analyze privacy threats — linkability, identifiability, non-repudiation as harm, detectability, disclosure, unawareness, non-compliance. For a system whose CIAM half stores millions of consumers' PII, that is the most material deferral in the threat model. The work, as with ADR-0027, is mostly collection: the privacy mechanisms already exist — opaque internal identifiers (ADR-0011), tenant partition and residency (ADR-0012, ADR-0026), envelope encryption (ADR-0011), right-to-erasure (ADR-0034), consent (ADR-0037), DSAR export (proposal 0010). What is missing is the adversarial frame that ties them together and the by-design commitments that constrain new surfaces — exactly what STRIDE/ADR-0027 did for security. This ADR takes up the reserved pass.

Decision

  1. Adopt LINDDUN as the privacy-threat taxonomy, recorded as a living privacy section in architecture §12, parallel to the STRIDE pass, each threat mapped to the decision that mitigates it. It is reviewed on the same cadence and triggers as the security model (ADR-0027 §4).

  2. The LINDDUN pass, mapped to existing decisions.

    • Linkability / Identifiability — opaque internal principal id distinct from external identifiers (ADR-0011); per-tenant partition (ADR-0012); minimal token claims (claims customization is gated, proposal 0008); and pairwise subject identifiers reserved (decision 4) so one user is not correlatable across relying parties.
    • Non-repudiation (as harm) / Detectability — uniform responses and enumeration defenses (ADR-0009); the audit/event stream is operator-facing (ADR-0022), not a user-surveillance surface.
    • Disclosure of information — envelope encryption at rest (ADR-0011), least-claim tokens, egress allowlists against SSRF (ADR-0017, ADR-0018, ADR-0019), and secret handling (proposal 0004).
    • Unawareness — consent is explicit, granular, versioned, and withdrawable (ADR-0037); self-service visibility of profile, sessions, connected apps, and consents (proposal 0010); and a pinned consent-receipt format (closing a proposal 0010 open question).
    • Non-compliance — right-to-erasure via crypto-shredding (ADR-0034); per-tenant data residency (ADR-0012, ADR-0026); per-realm retention policy (ADR-0034); and an operator-facing records-of-processing / sub-processor posture.

  3. Privacy-by-design commitments that constrain new surfaces — the durable artifact, as ADR-0027's discipline is for security: data minimization (collect and claim only what a flow needs); purpose limitation (an attribute is mapped into a token only where the flow justifies it, proposal 0008); pseudonymity by default for external subject identifiers; and a privacy review in each milestone's definition of done and on each triggering event (a new PII field, a new external data flow, a new federation or upstream IdP) — the privacy counterpart to the cadenced/event-triggered security review.

  4. Pairwise subject identifiers get a reserved structural seat. The OIDC pairwise subject type changes the sub a relying party sees, so — like DPoP (ADR-0014) and biscuit attenuation (ADR-0003) — retrofitting it later would break RP user-matching. The seat is reserved now; public (shared) sub is the v1 default, and per-client pairwise sub is built when CIAM non-correlation is required.

  5. Privacy regressions are abuse-case tests where mechanizable (ADR-0028): an un-minimized claim leaking an attribute a scope did not grant, or a correlation handle exposed across relying parties, is asserted not to occur — the privacy analog of the security abuse-case suite.

Consequences

  • The reserved privacy pass (ADR-0027 §5, architecture §12.7) is taken: privacy stops being "flagged but not built" and becomes a living, mapped model with by-design commitments that gate new surfaces.
  • The existing privacy mechanisms (ADR-0011, ADR-0012, ADR-0034, ADR-0037, proposal 0010) gain the adversarial frame that argues why they suffice and where they do not.
  • Pairwise subject identifiers reserved now keeps cross-RP non-correlation buildable without a sub break later — the same reserved-seat discipline as DPoP and biscuit.
  • CIAM gets a privacy posture proportionate to its data, closing the most material deferral the threat model carried.
  • Refines ADR-0027; relates to ADR-0011, ADR-0012, ADR-0034, ADR-0037, and proposal 0010.