Trace a red-team path through identity, data, and tool trust boundaries before selecting tests.
Trust boundary The support KB agent accepts prompts from employees, retrieves documents with a service account, and can draft ticket comments. A chat-only test will miss whether user permissions, retrieved content, and tool authority line up. STRIDE lens Follow identity, data, proof, disclosure, availability, and privilege. Use STRIDE as a route map. You do not need every category in every test, but you do need to notice where a model crosses identity, data, and action boundaries. Chat only Looks at output, misses authority. A boundary-led test points to the control that failed. If the model uses a credential, retriever, or…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in