{
  "schema": "longtermcapabilities-multi-agent-threat-model/v1",
  "version": "1.64.0",
  "releaseId": "lts-1.64.0-upgrade-safe-rewrites-and-privacy-erasure-integrity",
  "generated": "2026-08-03T20:40:00Z",
  "reviewDate": "2026-08-01",
  "path": "/multi-agent-systems/threat-model/",
  "surfaces": [
    {
      "id": "discovery",
      "surface": "Agent discovery and capability claims",
      "threat": "A malicious or stale agent card overstates identity, skill, endpoint, or security support.",
      "control": "Trusted registry, signed provenance where available, exact endpoint allowlist, freshness, and human-approved counterparty."
    },
    {
      "id": "transport",
      "surface": "Transport and session",
      "threat": "Impersonation, downgrade, replay, token leakage, or webhook redirection alters the collaboration boundary.",
      "control": "HTTPS, modern TLS, audience-bound credentials, nonce or replay control, webhook verification, and short-lived sessions."
    },
    {
      "id": "delegation",
      "surface": "Delegation chain",
      "threat": "An agent delegates more authority than it received or obscures the originating principal.",
      "control": "Non-amplifying scope, explicit purpose, expiry, resource limits, chain preservation, and revocation."
    },
    {
      "id": "messages",
      "surface": "Messages and artifacts",
      "threat": "Untrusted content is treated as policy, instruction, code, or verified evidence.",
      "control": "Schema validation, trust labels, content isolation, malware/content scanning where appropriate, and no instruction promotion."
    },
    {
      "id": "shared-state",
      "surface": "Shared state and memory",
      "threat": "One agent poisons common state, overwrites another role, or creates cross-tenant leakage.",
      "control": "Writer identity, ownership rules, version checks, tenant partitioning, provenance, conflict handling, and rollback."
    },
    {
      "id": "coordination",
      "surface": "Coordination mechanism",
      "threat": "Agents deadlock, oscillate, collude, amplify a false conclusion, or overwhelm the communication channel.",
      "control": "Bounded rounds, independent evaluator, disagreement thresholds, quorum limits, timeout, and simpler fallback."
    },
    {
      "id": "tools",
      "surface": "Tools and external systems",
      "threat": "A peer induces unauthorized side effects or exploits differences between local and remote tool policies.",
      "control": "Local policy enforcement, tool contracts, least privilege, effect verification, idempotency, and no token passthrough."
    },
    {
      "id": "supply-chain",
      "surface": "Models, skills, prompts, and dependencies",
      "threat": "A compromised component changes behavior across the agent team without visible application-code change.",
      "control": "Version inventory, approved update path, compatibility tests, canary release, signature/provenance checks, and rollback."
    },
    {
      "id": "telemetry",
      "surface": "Telemetry and audit",
      "threat": "Distributed traces omit the principal, delegation, policy, peer, or effect needed to reconstruct a failure.",
      "control": "Cross-agent trace identifiers, synchronized clocks, stable event schema, minimum evidence, and protected audit retention."
    },
    {
      "id": "containment",
      "surface": "Containment and recovery",
      "threat": "The same shared service required to stop or recover the team is unavailable or compromised.",
      "control": "Independent stop, credential revocation, queue drain, counterparty isolation, durable checkpoints, and reconciliation."
    }
  ],
  "boundary": "Threat-modeling aid; does not establish the security of an implementation or counterparty."
}