# Eve threat model — 2026-09 _Task 4.1. Evaluated 2026-09-05. Record `eve.threat-model.v1`, digest `4f0953a36c8a`._ Every plane of Eve, every data flow into her prompt, and every threat class the ledger names — plus one the pinned OWASP source carries that the ledger's sentence does not. The planes, classes and cells come from the shipped model; the surface they claim is checked against the real route file and tool sources; the external anchors are requirement ids from the task-0.4 crosswalk, which pins each source at a version. ## Coverage | Planes | Classes | Matrix cells | Applicable | Controlled | Partial | Gap | Not applicable | | ------ | ------- | ------------ | ---------- | ---------- | ------- | --- | -------------- | | 12 | 12 | 144 | 75 | 49 | 20 | 6 | 69 | Surface: 25 assistant routes (all 25 carrying both the auth and abuse pre-handlers, 12 reachable without an admin-scope check), 88 agent tools, 9 model legs. Data flows: 11 present, 4 absent. Not-applicable cells are DERIVED: a class applies to a plane exactly when the plane holds every capability the class requires, so a blank is a missing capability rather than a judgement. ## Matrix `✓` controlled · `~` partially controlled, gap named · `✗` uncontrolled, gap named · `·` not applicable | Plane | goal-hijack | tool-misuse | identity-privilege-abuse | agent-tool-supply-chain | unexpected-code-execution | memory-context-poisoning | insecure-inter-agent-communication | cascading-failure | denial-of-wallet-or-service | exfiltration | repudiation | human-agent-trust-exploitation | | --------------------- | ----------- | ----------- | ------------------------ | ----------------------- | ------------------------- | ------------------------ | ---------------------------------- | ----------------- | --------------------------- | ------------ | ----------- | ------------------------------ | | `session-http` | · | · | ✓ | · | · | · | · | · | ~ | ✓ | · | · | | `operator-http` | · | ✓ | ✓ | · | · | · | · | · | ~ | ✓ | ✓ | · | | `prompt-assembly` | ~ | · | · | ✓ | · | · | · | · | ✓ | · | · | · | | `member-domain-tools` | ~ | ✓ | ✓ | · | · | ~ | · | · | ✓ | ✓ | ✓ | ✓ | | `client-tool-bridge` | ~ | ✓ | · | · | ✓ | · | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | | `retrieval` | ~ | · | · | ~ | · | ~ | · | · | ✓ | ✓ | · | ✓ | | `operator-tools` | ✗ | · | ✓ | · | · | · | · | · | ✓ | ~ | · | ✓ | | `memory-and-session` | ~ | ✓ | ✓ | · | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | | `workbench-intent` | ~ | ✓ | ✓ | · | · | ~ | ✓ | ✓ | ✓ | ✗ | ~ | ✓ | | `model-provider` | · | · | · | ~ | · | · | ~ | ~ | · | ~ | · | ✓ | | `voice` | ✗ | · | ✓ | · | · | · | ✗ | ✓ | ✓ | ✗ | · | ✗ | | `audit-and-evidence` | · | ✓ | ✓ | · | · | ✓ | · | · | · | ✓ | ~ | ✓ | ## Planes | Plane | Boundary | Routes | Tools | Legs | Capabilities | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | `session-http` | Between a signed-in member's browser and the BFF: session creation, the message and turn intake, feedback, action results, and session deletion. | 9 | 0 | 0 | `accepts-untrusted-input` `carries-identity` `persists-state` `emits-outward` | | `operator-http` | Between an operator-scoped caller and the BFF: fleet and health reads, the feedback corpus, the catalog surfaces, and the tour-submission review flow. | 9 | 0 | 0 | `carries-identity` `holds-authority` `emits-outward` `accepts-untrusted-input` | | `prompt-assembly` | Between everything Eve reads and the tokens the model sees: conduct rules, the page-context block, the catalog and tour blocks, retrieved excerpts, tool results, memory and compacted history. | 0 | 0 | 0 | `accepts-untrusted-input` `reaches-the-model` `ingests-external-definition` | | `member-domain-tools` | Between the model's tool calls and the member's own product data across the V-series domains, plus the curated tour surface. | 0 | 34 | 0 | `holds-authority` `carries-identity` `reaches-the-model` `accepts-untrusted-input` `persists-state` `emits-outward` | | `client-tool-bridge` | Between the BFF and code running in the member's browser: navigation, highlighting, text reads and opt-in viewport captures are executed there and their results are posted back. | 1 | 4 | 0 | `executes-code` `crosses-process-boundary` `accepts-untrusted-input` `reaches-the-model` `holds-authority` `emits-outward` | | `retrieval` | Between the built docs corpora and the model: the lexical index, the dense index built over it, and the audience boundary between the member and full scopes. | 0 | 1 | 0 | `accepts-untrusted-input` `reaches-the-model` `ingests-external-definition` `persists-state` `emits-outward` | | `operator-tools` | Between the model and operator-only read surfaces: the workspace overview, review queues, incidents, crash groups, the model registry, support, rights and moderation queues, release readiness, the calendar planner and the docs freshness verdict. | 0 | 13 | 0 | `carries-identity` `reaches-the-model` `accepts-untrusted-input` `emits-outward` | | `memory-and-session` | Between one turn and the next: operator memory entries, session checkpoints, and the compacted history block. | 0 | 2 | 0 | `persists-state` `reaches-the-model` `accepts-untrusted-input` `carries-identity` `holds-authority` `emits-outward` | | `workbench-intent` | Between the model and the operator work estate: work items, threads, briefs, decisions, releases, graph links, the agent fleet and the kit command surface. | 0 | 31 | 0 | `holds-authority` `persists-state` `carries-identity` `crosses-process-boundary` `reaches-the-model` `accepts-untrusted-input` `emits-outward` | | `model-provider` | Between the BFF and the model providers: the turn, escalation, judge and embedding legs that route through OpenRouter, and the operator-configured speech and vision legs. | 0 | 0 | 9 | `spends-money` `crosses-process-boundary` `emits-outward` `reaches-the-model` `ingests-external-definition` | | `voice` | Between the member's microphone and speakers and third-party speech providers: audio uploaded for transcription, and text synthesised back to audio. | 2 | 0 | 0 | `accepts-untrusted-input` `reaches-the-model` `crosses-process-boundary` `emits-outward` `carries-identity` | | `audit-and-evidence` | Between what happened and what is recorded: the per-actor audit run, its coverage marks, and the telemetry the operator surfaces read. | 4 | 3 | 0 | `persists-state` `carries-identity` `holds-authority` `emits-outward` `reaches-the-model` | ## Threat classes and their anchors | Class | Requires | Crosswalk requirement ids | | ------------------------------------ | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | `goal-hijack` | `accepts-untrusted-input` `reaches-the-model` | `ASI01 Agent Goal Hijack`, `Generative AI Taxonomy §3.3 Direct Prompting`, `Generative AI Taxonomy §3.3 Indirect Prompt Injection` | | `tool-misuse` | `holds-authority` | `ASI02 Tool Misuse and Exploitation`, `Tools capability declaration`, `Input/output schema validity`, `Human-in-the-loop safety guidance` | | `identity-privilege-abuse` | `carries-identity` | `ASI03 Identity and Privilege Abuse`, `Authorization §Protocol Requirements`, `Access token audience and no token passthrough` | | `agent-tool-supply-chain` | `ingests-external-definition` | `ASI04 Agentic Supply Chain Vulnerabilities`, `Value Chain and Component Integration` | | `unexpected-code-execution` | `executes-code` | `ASI05 Unexpected Code Execution (RCE)` | | `memory-context-poisoning` | `persists-state` `reaches-the-model` | `ASI06 Memory & Context Poisoning`, `NISTAML.011`, `NISTAML.012`, `NISTAML.013`, `NISTAML.023`, `NISTAML.024`, `NISTAML.026`, `NISTAML.051` | | `insecure-inter-agent-communication` | `crosses-process-boundary` | `ASI07 Insecure Inter-Agent Communication`, `ASI10 Rogue Agents`, `Lifecycle initialize/version negotiation`, `Protocol-version mismatch` | | `cascading-failure` | `crosses-process-boundary` | `ASI08 Cascading Failures`, `notifications/cancelled request restrictions`, `Cancellation race handling` | | `denial-of-wallet-or-service` | `accepts-untrusted-input` | `Enumeration and rate-limit security`, `Rate-limit guidance` _(partly initiative-originated)_ | | `exfiltration` | `emits-outward` | `NISTAML.03`, `Data Privacy`, `Information Security` | | `repudiation` | `holds-authority` | `GOVERN 4`, `MEASURE 3` _(partly initiative-originated)_ | | `human-agent-trust-exploitation` | `reaches-the-model` `emits-outward` | `ASI09 Human-Agent Trust Exploitation`, `Confabulation`, `Information Integrity` | Taxonomy requirements carried by no class, each excused by name in the model: `NISTAML.022`, `NISTAML.025`. Every other one of the 22 requirements in the two threat-taxonomy sources is cited by a class. ## Data flows | Flow | Presence | Trust | Plane | | --------------------------------------------------------- | -------- | ----------------- | --------------------- | | Member or operator text | present | untrusted | `session-http` | | Page context: path, title, headings and anchors | present | untrusted | `prompt-assembly` | | Rendered controls by role, accessible name and state | present | untrusted | `client-tool-bridge` | | The text the member has selected on the page | present | untrusted | `prompt-assembly` | | Retrieved documentation excerpts | present | untrusted | `retrieval` | | Results returned by server and client tools | present | untrusted | `member-domain-tools` | | Work items, threads, briefs, decisions and fleet state | present | untrusted | `workbench-intent` | | Operator memory recalled into the prompt | present | operator-authored | `memory-and-session` | | A transcript of uploaded audio | present | untrusted | `voice` | | Confirmation cards and tour steps rendered to the member | present | system-authored | `client-tool-bridge` | | Direct messages between agents | absent | untrusted | — | | Inbound messaging-channel content | absent | untrusted | — | | Output from a creative-tool host | absent | untrusted | — | | Opt-in viewport screenshots and their visual descriptions | present | untrusted | `client-tool-bridge` | | Member-uploaded files | absent | untrusted | — | ## What this model found 6 uncontrolled cells and 20 partially controlled ones, owned by 8 tasks: - **task 13.5** — 2 cell(s): `workbench-intent/repudiation`, `audit-and-evidence/repudiation` - **task 15.1** — 3 cell(s): `model-provider/agent-tool-supply-chain`, `voice/insecure-inter-agent-communication`, `voice/exfiltration` - **task 15.2** — 2 cell(s): `model-provider/insecure-inter-agent-communication`, `model-provider/cascading-failure` - **task 15.6** — 2 cell(s): `session-http/denial-of-wallet-or-service`, `operator-http/denial-of-wallet-or-service` - **task 3.6** — 2 cell(s): `retrieval/agent-tool-supply-chain`, `retrieval/memory-context-poisoning` - **task 4.3** — 10 cell(s): `prompt-assembly/goal-hijack`, `member-domain-tools/goal-hijack`, `client-tool-bridge/goal-hijack`, `retrieval/goal-hijack`, `operator-tools/goal-hijack`, `memory-and-session/goal-hijack`, `workbench-intent/goal-hijack`, `voice/goal-hijack`, `member-domain-tools/memory-context-poisoning`, `workbench-intent/memory-context-poisoning` - **task 4.4** — 1 cell(s): `voice/human-agent-trust-exploitation` - **task 4.5** — 4 cell(s): `client-tool-bridge/exfiltration`, `operator-tools/exfiltration`, `workbench-intent/exfiltration`, `model-provider/exfiltration` ## Honest limits - This model asserts that a named control EXISTS and that its file and symbol are on disk. Whether that control actually defeats the threat on that plane is not machine-checkable and is not claimed; the adversarial family per vector is task 4.3, and a control named here may still be insufficient. - Applicability is derived from declared capabilities. A capability claim that is wrong — a plane that executes code without saying so — closes cells that should be open, and the only defence is that every claim names code a reader can check. - The surface scan reads the route file and the tool-binding sources as text. A route registered through a helper this scanner does not recognise, or a tool defined by a shape other than name-then-description, would be invisible to it; the tool count is cross-checked against the prompt-bytes ratchet in the evidence run. - The two-way taxonomy sweep covers the two threat-taxonomy sources only. The protocol and quality sources in the crosswalk are cited where they bear on a class and are not swept, because modelling every clause of a transport specification here would be coverage theatre. - Trust labels and taint propagation across prompt assembly are task 4.2, not this task. This model records WHERE untrusted content enters and which cells depend on that; it does not implement a label.