Generate Threat Model
generate_threat_modelGenerate a threat model from a feature description: trust boundaries, assets (Confidentiality, Integrity, Availability, Usage), capability-defined attackers, the control objective matrix and assumptions.
Instructions
Generate a threat model from a feature description: trust boundaries, assets (Confidentiality, Integrity, Availability, Usage), capability-defined attackers, the control objective matrix and assumptions. A multi-step pipeline; progress is reported automatically.
Similar models: where an existing model of the workspace overlaps
the description, nothing is generated: {"similar_models": [{"id", "title", "reason"}], "suggestion"}. Refine a candidate with
refine_threat_model (usually right: it keeps controls and history),
or retry with force=True once the operator confirms it is distinct.
Saved first: where the platform models what the system does, the
model is saved holding the description and generated from it later.
extracting: true (model_id, job): its behaviour is extracted
in the background. needs_answers: true (model_id,
questions): RELAY THE QUESTIONS TO THE PERSON and answer them with
answer_behavioural_questions. Then poll get_behavioural_model
until generation_ready is true and call
generate_from_behavioural_model with the model_id (next says
so). No control build is proposed until then. Deprecated: model_id
here; with an empty description it does the same, with one it is
refused (resume_takes_no_description).
Answer: {model_id, version, title, asset_count, attacker_count, control_objective_count, controls_status, ...}. proposed: a build
is proposed (proposal: what it builds, estimated_credits, the
model_version, set_revision and scope_revision a start
names); review it with the user, then start_control_build with
confirm_estimate=True. none_owed: nothing is owed;
unavailable / error: read get_control_generation_status. A
governor at warning or exhausted: relay it; queued work
resumes at resets_at, never dropped.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Skip the similar-model detection and always create a new model. Default False: the check fires unless the operator or agent has explicit reason to bypass it. | |
| model_id | No | Deprecated: use ``generate_from_behavioural_model``. With an empty ``feature_description`` it does the same; with a description it is refused (``resume_takes_no_description``). | |
| parent_id | No | Optional ID of an existing model to wire the new model under as a child on the recursive composition tree. The child then inherits the parent's topology and participates in composition (delta / inherited control credit). Default None: the model is created flat. | |
| provenance_ref | No | Branch or tag name at that commit (optional). | |
| server_version | Yes | ||
| provenance_kind | No | Where the description came from, one of ``code``, ``ticket``, ``document``, ``manual``, ``mixed``. Empty (default) records nothing. For an existing repository pass ``provenance_kind="code"`` with ``provenance_repo_url`` and ``provenance_commit_sha`` (the HEAD you gathered from): the code is then authoritative and the model follows it. Any other kind means the description is intent and the code is measured against it. The same record can be set later with ``update_threat_model``. | |
| feature_description | Yes | Description of the feature or system to threat model. Can be a few sentences or a detailed spec. | |
| provenance_repo_url | No | Repository URL the description was gathered from (``code`` kind). | |
| provenance_commit_sha | No | Commit SHA the description was gathered at (``code`` kind). | |
| provenance_source_ref | No | Identifier of the ticket or document the description came from (``ticket`` / ``document`` kinds). | |
| provenance_source_url | No | URL of that ticket or document. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||