Repository navigation
docs: add capability-token threat model and misuse cases #122
Description
Add a capability-token threat model for agent-kernel. Cover assets and trust boundaries around tokens, principals, handles, driver output, policy decisions, and audit traces. Include misuse cases such as token replay, confused deputy, wrong principal binding, unsafe handle expansion, driver tampering, audit-log gaps, and host-code policy bypass. State non-goals clearly: agent-kernel is not a sandbox, not a host authentication system, and not a network isolation layer. Acceptance: document is linked from README/security docs, includes mitigations/test
Activity
dgenio commentedon Aug 11, 2026
Closing as completed/consolidated by merged PR #276.
docs/security-contract.md+ the rewrittendocs/security.mdnow cover the requested assets/trust boundaries and misuse/non-goal cases: principal authenticity, token scope/replay/constraints, complete-mediation/host bypass, handle expansion, driver/output boundary, audit trust assumptions, multi-worker state, sandbox/network/authentication non-goals, and links to executable/security hardening issues. The named invariant suite from merged PR #281 now supplies the executable I-01/I-02/I-06 regression layer. Future threat-model findings belong in those canonical documents rather than a second token-specific threat-model page.