Skip to content

Threat model v1.1: multi-agent B4 + RAG surface - #9

Merged
ChrisInvictus merged 1 commit into
mainfrom
docs/threat-model-v1.1
Jul 18, 2026
Merged

Threat model v1.1: multi-agent B4 + RAG surface#9
ChrisInvictus merged 1 commit into
mainfrom
docs/threat-model-v1.1

Conversation

@ChrisInvictus

Copy link
Copy Markdown
Owner

Two additions: B4 extended to agent-to-agent architectures (per-agent identity, signed inter-agent messaging, circuit breakers, cross-referencing the shipped exec-approval gate); and the retrieval corpus as a surface (LLM04/LLM08). Changelog + future-work section. No code, no infrastructure.

@github-actions

Copy link
Copy Markdown

Terraform plan — stack orgsuccess

Show plan
google_iam_workload_identity_pool.github: Refreshing state... [id=projects/paved-org-seed/locations/global/workloadIdentityPools/github-pool]
google_folder.workloads: Refreshing state... [id=folders/442367273223]
google_service_account.deployer: Refreshing state... [id=projects/paved-org-seed/serviceAccounts/paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_org_policy_policy.uniform_bucket_access: Refreshing state... [id=organizations/386600224156/policies/storage.uniformBucketLevelAccess]
google_org_policy_policy.disable_sa_key_creation: Refreshing state... [id=organizations/386600224156/policies/iam.disableServiceAccountKeyCreation]
google_org_policy_policy.no_default_sa_grants: Refreshing state... [id=organizations/386600224156/policies/iam.automaticIamGrantsForDefaultServiceAccounts]
google_org_policy_policy.skip_default_network: Refreshing state... [id=organizations/386600224156/policies/compute.skipDefaultNetworkCreation]
google_logging_project_bucket_config.org_audit: Refreshing state... [id=projects/paved-org-seed/locations/global/buckets/org-audit]
google_folder.sandbox: Refreshing state... [id=folders/402625647000]
google_org_policy_policy.domain_restricted_sharing: Refreshing state... [id=organizations/386600224156/policies/iam.allowedPolicyMemberDomains]
google_org_policy_policy.no_public_sql: Refreshing state... [id=organizations/386600224156/policies/sql.restrictPublicIp]
google_org_policy_policy.no_vm_external_ip: Refreshing state... [id=organizations/386600224156/policies/compute.vmExternalIpAccess]
google_organization_iam_member.deployer_logging: Refreshing state... [id=386600224156/roles/logging.configWriter/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_project_iam_member.deployer_wif_admin: Refreshing state... [id=paved-org-seed/roles/iam.workloadIdentityPoolAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_storage_bucket_iam_member.deployer_state: Refreshing state... [id=b/paved-org-tfstate-386600224156/roles/storage.admin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_iam_read: Refreshing state... [id=386600224156/roles/iam.securityReviewer/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_project_iam_member.deployer_sa_admin: Refreshing state... [id=paved-org-seed/roles/iam.serviceAccountAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_project_iam_member.deployer_logging_admin: Refreshing state... [id=paved-org-seed/roles/logging.admin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_folders: Refreshing state... [id=386600224156/roles/resourcemanager.folderAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_orgpolicy: Refreshing state... [id=386600224156/roles/orgpolicy.policyAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_service_account_iam_member.wif_binding: Refreshing state... [id=projects/paved-org-seed/serviceAccounts/paved-org-deployer@paved-org-seed.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/540939044753/locations/global/workloadIdentityPools/github-pool/attribute.repository/ChrisInvictus/paved-org]
google_iam_workload_identity_pool_provider.github: Refreshing state... [id=projects/paved-org-seed/locations/global/workloadIdentityPools/github-pool/providers/github-oidc]
google_logging_organization_sink.audit: Refreshing state... [id=organizations/386600224156/sinks/org-audit-sink]
google_project_iam_member.audit_sink_writer: Refreshing state... [id=paved-org-seed/roles/logging.bucketWriter/serviceAccount:service-org-386600224156@gcp-sa-logging.iam.gserviceaccount.com]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

@github-actions

Copy link
Copy Markdown

Terraform plan — stack demosuccess

Show plan
data.terraform_remote_state.org: Reading...
module.demo_project.random_id.suffix: Refreshing state... [id=IgU]
data.terraform_remote_state.org: Read complete after 1s
module.demo_project.google_project.this: Refreshing state... [id=projects/paved-org-demo-2205]
module.demo_project.google_project_service.baseline["iap.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/iap.googleapis.com]
module.demo_project.google_project_service.baseline["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/cloudresourcemanager.googleapis.com]
module.demo_project.google_project_service.baseline["artifactregistry.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/artifactregistry.googleapis.com]
module.demo_project.google_project_service.baseline["logging.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/logging.googleapis.com]
module.demo_project.google_project_service.baseline["cloudbuild.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/cloudbuild.googleapis.com]
module.demo_project.google_project_service.baseline["serviceusage.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/serviceusage.googleapis.com]
module.demo_project.google_project_service.baseline["iam.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/iam.googleapis.com]
module.demo_project.google_project_service.baseline["monitoring.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/monitoring.googleapis.com]
module.demo_project.google_project_service.baseline["run.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/run.googleapis.com]
module.demo_project.google_billing_budget.guard[0]: Refreshing state... [id=billingAccounts/01327E-49B005-4A311F/budgets/085c714a-bacd-4698-964e-a2fecc79e56a]
module.demo_project.google_project_service.baseline["compute.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/compute.googleapis.com]
google_artifact_registry_repository.app: Refreshing state... [id=projects/paved-org-demo-2205/locations/us-east1/repositories/demo]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

@ChrisInvictus
ChrisInvictus merged commit 3070761 into main Jul 18, 2026
5 checks passed
@ChrisInvictus
ChrisInvictus deleted the docs/threat-model-v1.1 branch July 18, 2026 23:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant