STRIDE Analysis

This is Information Disclosure where the reader is authorised, so identity-based controls never fire. Answer with narrower reads — lookups scoped to an open case, only the fields needed — plus per-agent volume detection, and record what remains as accepted risk.

Element type decides which rows you get, so a contested type is a signal that the component has two roles. Model it as both, take the union of the threats, write down the typing convention, and timebox the argument.

When the risk lives on the crossings: a shared component invoked by callers at different trust levels, external fan-in, or authorization that depends on the calling path. Rows scale with edges, so mandating it everywhere produces rows nobody examines.

It buys fleet membership, not device identity: the backend learns only that the caller holds the fleet key. Anyone who extracts that key from a single unit they own can pose as any unit, and revocation is all-or-nothing across the whole fleet.

Stop on saturation and coverage, not the clock: two full rounds with no newly accepted threat, every category played against the flows that matter, and each raised threat accepted, rejected with a reason, or parked against a named unknown.