probectl threat model

This is the system-wide threat model: what probectl protects, who might attack it, and — boundary by boundary — what stops them and what honestly does not yet. It is versioned with the code and should be reviewed on any change to a trust boundary and at each release. Every mitigation cites the code, CI gate, or document that enforces it, so you can verify rather than trust.

Companion docs: agent-whitepaper.md (the agent in depth), incident-response.md (what happens when something breaks), ../hardening.md, ../isolation.md, and the project non-negotiables.

1. What we protect (assets)

2. Trust boundaries

[tenant user] --TLS/session--> [control plane] <--mTLS+SPIFFE--> [agents]
      |                          |       ^  ^                      (CAP_BPF hosts)
 [provider operator]             |       |  +--TLS/auth-- [OTLP/webhook senders]
  (separate domain,              v       |
   break-glass only)        [bus (Kafka, TLS)]--> [stores: PG(RLS)/CH(row policy)/TSDB]
                                 |
                            [AI adapter] --three-gated TLS--> (optional remote LLM)
                            [MCP server] --tenant-then-RBAC--> callers

B1 tenant↔tenant (inside every shared component) · B2 agent↔control plane · B3 ingest surfaces (bus, OTLP, webhooks) · B4 control plane↔stores · B5 operator/provider plane↔tenant data · B6 AI/MCP↔models and callers · B7 build/release↔deployments · B8 agent↔monitored host.

3. Attacker profiles

1. External unauthenticated — internet/intranet reach to exposed listeners.
2. Malicious tenant (the defining multi-tenant adversary) — valid credentials, hostile intent, aims at B1.
3. On-path network attacker — can intercept/inject between components.
4. Compromised monitored host — controls traffic the agent observes and the local libssl the L7 probe attaches to.
5. Compromised agent node — has the agent's identity and CAP_BPF.
6. Malicious/compelled provider operator — legitimate provider-plane access, wants silent tenant-data reach (B5).
7. Supply-chain attacker — targets deps, CI, artifacts (B7).
8. Prompt-injection attacker — plants payloads in telemetry that the AI layer will read (B6); needs no credentials at all.

4. STRIDE by boundary — mitigations (evidence) and gaps (register IDs)

B1 — Tenant ↔ tenant (the outermost boundary)

This is the boundary that matters most: a malicious tenant with valid credentials trying to reach another tenant's data. The full storage-layer mechanism is in tenant-isolation.md; the summary by threat:

B2 — Agent ↔ control plane

B3 — Ingest surfaces (bus, OTLP, webhooks)

B4 — Control plane ↔ stores

B5 — Provider/operator plane ↔ tenant data

B6 — AI / MCP

B7 — Supply chain (build → release → deploy)

B8 — Agent ↔ monitored host

5. Known gaps (the honest list — tracked, not hidden)

A threat model that claims no gaps is not honest. These are the open items as of this revision:

6. Review log