# Threat Model

This page summarizes how Blekline addresses common AI agent security threats at the **execution boundary** (Layer 4).

## Assets

- Workspace policy, audit events, API keys (`blw_*`)
- Prompt and tool-call content transiting ingress/sidecar
- Trust Vault ciphertext (NHIM sidecar, in-VPC)

## Trust boundaries

See [Trust Boundaries](/docs/security/trust-boundaries). Summary:

- **Outside perimeter:** model providers, untrusted web content, user prompts
- **Inside perimeter:** Blekline control plane, sidecar, your VPC tool endpoints

## Threats & mitigations

| Threat | Mitigation |
|--------|------------|
| Secret leakage to LLM | Local mask + cloud Azure PII; Trust Vault tokenization (NHIM) |
| Prompt injection → destructive tools | Lineage Firewall + YAML/runtime policy; [simulator](/docs/playground/runtime-enforcement) |
| Over-privileged tool calls | MCP tool policy, `enforceToolCallLocally`, sidecar enforce |
| Shadow AI agents | Ingress/sidecar at agent boundary; audit events |
| Downstream MCP impersonation | [MCP identity pinning](/docs/security/mcp-identity-pinning) |

## Browser extension surface

Enterprise deployments should treat browser extensions as high-trust surfaces. Compensating controls: workspace policy, optional MDM distribution, least-privilege workspace tokens.

## Out of scope (current)

- Full CASB / network DLP replacement
- SOC 2 Type II attestation (roadmap)
- Cryptographic SPIFFE proof in OSS (roadmap — see [NHIM](/docs/definitions/nhim))

## Related

- [Procurement pack](/docs/enterprise/procurement-pack)
- [NHIM overview](/docs/introduction/nhim)