12. Threat model

A living, adversarial view of the system: what is worth attacking, where the trust boundaries are, who the adversaries are, and which attacks an identity provider must withstand — each mapped to the decision that mitigates it. The discipline — abuse-case tests, per-milestone and cadenced / event-triggered reviews, dependency-advisory hygiene, parser fuzzing, external review, and incident feedback — is ADR-0027; this section is the model itself. The frameworks are named there: STRIDE classifies (§12.4), OWASP ASVS v5.0 is the verification rubric, and OWASP Threat Dragon maintains the model as code (reserved until code begins). It is v0/evolving and hardens as surfaces are built — a threat model is never "complete."

12.1 Assets

12.2 Trust boundaries

Boundaries from least- to most-trusted; the diagram is diagrams/trust-boundaries.mermaid.

• Internet — relying parties, end-users, upstream IdPs. Untrusted.
• Edge (Vör) — least-trusted internal tier: holds only public key material and cached projections (JWKS, status list). The rule-1 hot path.
• Regional admission (Modgud) — stateful: sessions, login ceremonies, and core writes. More trusted than the edge; the front-channel attack surface lives here.
• Core — the most-trusted tier: the Wyrd identity core, the Forseti relation store, KeyCustody (HSM/KMS), and the event log.
• Admin plane — operator surface, authorized by Forseti itself (ADR-0021).
• The revocation/projection transport (NATS + projection-distribution pulls) — a named boundary of its own, mirroring ADR-0027 §2: the highest-value spoof-or-suppress target inside the perimeter, mTLS/workload-identity authenticated (ADR-0035) and integrity-protected by projection signatures and freshness (ADR-0043).
• Tenant isolation — a cross-cutting boundary; no cross-tenant strong read on any hot path (rule 3, ADR-0012).

Edge-compromise blast radius (a stated property). An attacker who fully compromises an edge (Vör) node gains no signing keys, no credentials, and no directory — only public material, caches, and one transport credential: the edge's subscribe-only NATS credential (ADR-0035). They can deny service, serve stale (never forged) revocation, or observe the revocation stream — a privacy consideration for a compromised edge — but they cannot publish or suppress on it, and the projections the edge consumes are signature- and freshness-protected (ADR-0043). This bounded blast radius is a security payoff of the constitution's edge/core split (ADR-0027).

12.3 Adversaries

Anonymous internet attacker · malicious or compromised relying party · malicious end-user (privilege escalation) · malicious or compromised tenant administrator · compromised upstream IdP · a co-tenant (isolation breach) · network MITM · compromised edge node · malicious insider / operator · supply-chain attacker.

12.4 STRIDE, per boundary

12.5 The identity attack catalog

12.6 Abuse-case tests

The catalog above is made mechanical (ADR-0027): each defended attack is asserted to fail, seed-reproducible, from the milestone where its surface exists — the security analog of the edge-independence property test (ADR-0010). Representative: a forged alg:none token is rejected (M0); a token presented to the wrong tenant is rejected (M4); a SAML assertion with a wrapped signature is rejected (M6); an authorization decision after a just-revoked grant reflects the revocation when fenced (M3, V9). A defended attack that ever succeeds becomes a permanent regression test. The full testing plan — the tiers, the CI gates, and the threat→test map — is §13 (ADR-0028).

12.7 Residual and accepted risks

• The bearer-token validity window — a stolen token is valid until expiry / status-list refresh; the deliberate cost of edge-statelessness, bounded by short TTL + DPoP (ADR-0005).
• Bounded revocation freshness — "kill now" is within a budget, not instantaneous (ADR-0005).
• Cold-start availability — a cold edge during a core outage fails closed (safe, but a stated availability cost) (ADR-0010). A warm edge's autonomy is bounded the same way: the core-outage survival window is the projection freshness budget, past which it too fails closed (ADR-0032, ADR-0039).

12.8 Gaps and their disposition

The threat model records its own holes — and tracks them to closure. The gaps a posture review surfaced are now dispositioned.

Addressed as proposals (they fit the existing architecture): account recovery & contact verification (0003), secret handling (0004), build/release integrity (0005), resource-exhaustion hardening (0006), and credential policy & breached-password protection (0013).

Decided in (Proposed) ADRs (they affect the architecture):

• Status-list freshness / replay — the verifier enforces max-age + a monotonic counter (ADR-0032).
• Clock / time-source trust — bounded skew + authenticated time + implausible-clock fail-closed (ADR-0033).
• Right-to-erasure — crypto-shredding against the immutable log (ADR-0034).
• Internal service-to-service trust — mTLS / SPIFFE for Vord's planes (ADR-0035).
• Key-compromise emergency response — wholesale kid revocation + forced re-issue (ADR-0036).
• Risk-based / adaptive auth, device trust & token-theft detection (ADR-0031).
• Consent & scope-grant enforcement (ADR-0037).
• OAuth client model — registration, confidential-client authentication and secret rotation, and exact-match redirect-URI validation (ADR-0038).
• The freshness / time-budget system — the coupled budget set, its ordering invariants, and a fail-closed config-load validation gate (ADR-0039).
• Backup, restore & disaster recovery — version-stamped per-domain backups, the cross-domain restore offset invariant, and rebuilt projections (ADR-0040).
• Privacy threat model (LINDDUN) & privacy-by-design — the privacy pass parallel to STRIDE, with data-minimization commitments and reserved pairwise subject identifiers (ADR-0041), taking up the pass ADR-0027 §5 reserved.
• Post-quantum cryptographic posture — signature-suite agility plus a reserved hybrid migration seat, the exposure framed as CRQC-time forge-all (not HNDL) and paced to NIST (ADR-0042).

Still genuinely open: the [OPEN] items inside the ADRs (the CIAM principal extension, ADR-0011; cross-tenant sharing, ADR-0012; org/crate-name availability, ADR-0001/0009), and the free-tooling CI workflow files (CodeQL, OSS-Fuzz, Scorecard), which land with code at M0 (proposal 0005). The privacy pass that was reserved is now taken up in ADR-0041.