edit_trust_boundary
Edit a trust boundary's permitted attack vectors, isolation seal, and crossed assets, creating a new model version with change reason recorded for audit.
Instructions
Edit a trust boundary. Creates a new model version.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tb_id | Yes | ID of the trust boundary (e.g., "TB1"). | |
| passes | No | New comma-separated AttackVector values the boundary allows through (subset of "Network,Adjacent,Local,Physical"). Use the empty string to set "blocks all"; omit to leave unchanged. Reach-relevant — narrowing or widening this set can flip CO verdicts. | |
| sealed | No | New isolation flag. True declares NO lateral ingress (the only way in is crossing the perimeter — an air-gap / segmented enclave), which lets reachability decisively rule the boundary unreachable; False assumes a lateral pivot is possible. Reach-relevant — changing it can flip CO verdicts. Setting it records an operator attestation of the seal. Omit to leave unchanged. | |
| crosses | No | New comma-separated asset IDs. | |
| model_id | Yes | ID of the threat model. | |
| description | No | New description. | |
| seal_source | No | "attested" | "unattested". Only an operator-attested seal lets reachability decisively rule an objective unreachable past the boundary; an unattested (default/model-suggested) seal is treated as pivotable. Use "attested" to attest a boundary already marked sealed without re-toggling it; "unattested" retracts. An attested seal implies ``sealed``. Requires ``change_reason``. | |
| change_reason | No | Required when ``passes``, ``sealed``, or the seal attestation actually changes. Captured in the audit trail; documents why the boundary's vector filter, isolation claim, or attestation changed. | |
| server_version | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||