Threat Model, Tests, and Rollout

Enterprise problem: A plausible authorization architecture can still ship creator privilege, cross-team credential leaks, confused-deputy calls, prompt-driven tool escalation, stale grants, or public-agent access because happy-path demos do not exercise hostile boundary crossings.

Whole-course context: The incoming evidence is an immutable deployment, two-key runtime path, independently revocable app/provider grants, and complete redacted decision lineage; today converts those artifacts into executable release gates.

Today’s slice: We build a threat model and negative-test matrix across provider control plane, hosted runtime, generated application, connectors, agent delegation, and downstream authorities, then stage canary, production, rollback, and retirement.

End-of-day evidence: A signed release dossier maps each named attack to a control and observed test, proves positive controls, records exact artifact and policy digests, and includes canary promotion or rollback plus residual-risk acceptance.

Still unsolved: Organization-specific legal approvals, production credentials, capacity targets, incident staffing, and irreversible final deletion require accountable owner gates outside this course.

Thesis: Production authorization is a falsification problem, not a checklist problem: release only the immutable build whose independent boundaries survived named attacks through normal product paths and can be rolled back or retired with equally strong evidence.

Smallest complete mental model: name the attack, observe the control under the exact candidate, and make the release decision from signed evidence.

Boundary: This day proves the shared platform envelope across provider, hosted runtime, generated application, connectors, delegated agents, and downstream systems. It does not waive customer-specific legal, staffing, credential, capacity, or irreversible deletion approvals.

The customer outcome is a reliable, reviewable implementation of 12 threat model tests and rollout. This day introduces the mechanism before policy detail and evidence review; it does not repeat the same customer stories in prose, tables, and diagrams.

Authorization policy service owns decisions; the connector/runtime gateway owns enforcement. Compute: API and isolated worker processes. Storage: PostgreSQL is authoritative for grants and state; Redis is a versioned cache; vault owns secrets; object storage retains redacted evidence only.

Implement the day’s boundary with a current, explicit decision before privileged compute or a downstream call. Bind every effect to a tenant, subject or workload, deployment, resource, and short-lived evidence ID; a cache or model response never grants authority.

Release programs fail when coverage is broad but shallow, or when a flaky test is ignored until an attacker supplies the same timing. The consequence is security theatre: many green checks with no reliable claim about the candidate actually serving customers.

A threat matrix is useful only when it drives a reproducible candidate evaluation and a real rollout state machine. Start with the HelixWorks Supplier Onboarding Agent plus contrasting Workboard, revenue-dashboard, and public-intake fixtures so the shared invariants are tested outside one application shape.

1. Version the threat-control-test manifest and give every threat a protected asset, precondition, control owner, expected enforcement point, positive control, residual, and fixture digest.
2. Provision isolated organizations, teams, app tenants, users, connectors, documents, workloads, agents, and downstream rows with the least authority required by each case.
3. Execute mandatory identity, sharing, row, knowledge, connector, MCP, argument, approval, delegation, workload, prompt-injection, and revocation probes through normal product surfaces.
4. Seal redacted observations only when every probe contains actor, resource, scope, precondition, expected result, observed result, environment, timestamp, source fixture, trace/decision ID, and exact digest tuple.
5. Require independent release approval, deploy that tuple to canary, rerun boundary and audit probes, compare observed revisions, and promote only by immutable pointer.
6. Rehearse rollback without restoring app data; then rehearse retirement by disabling entry points before export, retention, connector revocation, secret/artifact cleanup, app-data deletion, and signed residual evidence.

Falsifiable evidence: the release claim fails if any unexpected allow occurs, a positive control fails without explanation, a probe bypasses normal enforcement, a threat lacks an owner or evidence join, a secret canary appears, served digests differ from the dossier, rollback corrupts app data, or retirement deletes before required export/retention.

Static architecture sketches can look like empirical models when their source and adaptation limits are hidden, causing readers to infer precision or dynamics that the article never supplied. The primary source here is an unpaginated text attachment, so printed-page and PDF-page fields are unavailable; the canonical inventory uses exact source-line anchors and records every substantive diagram detected by the course parser’s visual-art rule.

All 17 source visuals are conceptual reconstructions, not transcriptions, calibrated simulations, or interactive labs. They preserve topology, ordering, trust boundaries, and allow/deny arguments as Mermaid diagrams in the mapped lessons. They are explicitly excluded from the interactive-lab registry because the source provides no data series, algorithm, or parameter semantics: inventing three controls would invent unsupported behaviour rather than reveal the source. This exclusion would be falsified if a source dataset, algorithm, or parameterized state model were supplied; that evidence would require atomic labs, controls, readouts, protocols, and responsive browser proof.

A complete course still produces no assurance until one real candidate is attacked, so freeze the HelixWorks Supplier Onboarding Agent artifact/policy/schema/infrastructure tuple and run the mandatory suite in an isolated production-equivalent environment. Review the first counterexample rather than the aggregate pass rate: verify its actor, boundary, intended enforcement point, downstream non-call or call, positive control, and immutable lineage.

Promote only if the signed dossier covers all named threats, all 17 source-visual arguments remain traceable as documented conceptual reconstructions, canary and production serve the approved tuple, and rollback preserves generated-app data. Otherwise block the release, assign the failing control to its owner, and rerun from the changed digest; that observable sequence is the final evidence that the platform treats authorization as a living system rather than a static diagram.

This evidence is falsifiable: any unexpected allow, missing positive control, untraceable source argument, digest drift, or destructive rollback rejects the release claim.

Run the cross-service adversarial path in tests/smoke-product.ts. Its release probe rejects a canary and verifies reconciliation:

canaries.decision = { approved: false, reason: 'error budget exceeded' };
await assert.rejects(
  promote.execute({
    tenantId,
    releaseId,
    environment: 'local',
    artifactDigest,
    expectedPreviousArtifactDigest: priorDigest,
    correlationId,
    causationId: completedEvent.eventId,
  }),
  CanaryRejectedError,
);
assert.deepEqual(deployments.operations.at(-1), {
  action: 'rollback',
  tenantId,
  releaseId,
  environment: 'local',
  artifactDigest: priorDigest,
});

The intent is “promote only observed-safe bytes.” Node, the release use case, and injected adapters interpret it; release state returns to the previous digest; CPU, memory, and test I/O run the scenario; the PASS dossier and rollback operation are evidence. The use case owns promotion (SRP), ports provide IoC/DI, shared contracts remain DRY, and PubSub feeds evidence without coupling services.

pnpm verify
pnpm smoke:product

The suite also checks one side effect under duplicate delivery, cross-tenant denial, revocation denial, and secret-free evidence. Any unexpected allow, two supplier writes, failed rollback, missing fact, or aws-sm:// in evidence rejects the candidate.