Add Assumption
add_assumptionCreate a model assumption to document external security properties or resolve indeterminate CO verdicts by attaching exclusion predicates for deterministic unreachable assessments.
Instructions
Add an assumption. Creates a new model version. Returns {model, entities, ...}: the model's id, version and title, and
entities.assumptions the assumption as created.
Assumptions represent security properties outside the system owner's trust boundary. When linked to COs and attested, they mitigate those COs in the assessment.
Optionally attach a structured exclusion predicate (the
exclusion_* params). The reachability composer matches active
attested assumptions with predicates against COs deterministically — class-3 (deterministic computation) evidence in addition to the operator-attested class-1 evidence. Pass any subset of the fields; unspecified fields default to wildcard ("*"). When
exclusion_co_idsis non-empty, it takes precedence over the match fields.
Use this to resolve a CO whose composer verdict is
indeterminate because no structural primitive backs an
operator non-applicability claim: set exclusion_co_ids=<co_id>
(and optionally the attacker/asset/property fields), and the
composer will derive unreachable / reason: assumption_excludes
on subsequent loads, with the assumption's structured predicate as
the audit-trail cause.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| model_id | Yes | ID of the threat model. | |
| description | Yes | What is assumed (e.g., "Customer restricts CI runner egress"). | |
| linked_co_ids | No | Optional comma-separated CO IDs this assumption covers. | |
| server_version | Yes | ||
| assumption_type | No | "external" (default, allows manual attestation) or "non_applicability" (requires CI verification, no manual attestation). | external |
| exclusion_co_ids | No | Comma-separated CO IDs the predicate matches explicitly. When non-empty, overrides the match fields. | |
| exclusion_asset_id | No | "*" or concrete asset ID. | |
| exclusion_attacker_id | No | Predicate match — "*" wildcard (default when any other exclusion_* param is set) or concrete attacker ID. | |
| exclusion_property_match | No | "C" | "I" | "A" | "U" | "*". | |
| exclusion_attacker_vector | No | One of "Network" | "Adjacent" | "Local" | "Physical" | "*". | |
| exclusion_asset_component_id | No | "*" or concrete component ID. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||