Two modes, not averaged
A transferable pattern from the agentic-workflow threat model, worth its own page: a refusal to average two things that look similar from the outside.
The two modes look similar from the outside (both produce a download link) but have radically different security properties.
The two modes
Mode A — symmetric, key in the URL fragment
- The key IS in the URL. Anyone who has the full URL can decrypt.
- Security = secrecy of the URL, full stop — one shared secret, one channel to protect.
Mode B — PKI
- The key is NOT in the URL.
- Security = possession of the recipient's private key — a fundamentally different trust anchor from a shared link.
Why averaging them would be the error
Both modes produce the same visible artefact — a download link — so a threat model that scores "sharing a file" as one number would collapse two different security postures into a figure that describes neither. The two-modes pattern is the discipline of keeping them as separate rows all the way through: separate threats, separate likelihoods, separate residual risk, never merged into a single average score for "the feature."
The risk matrix that resulted
Scoring both modes separately produced eight threats across the two, each carrying likelihood, impact, and — the detail worth naming — residual risk after mitigations, not just the raw score. Recommendations were prioritised P0 through P3, each with a named owner (DevOps, Dev, Designer, DPO, Sherpa), which turns a threat model from an analysis into an assignable backlog.
Two recommendations notable for a threat model to produce
Publish the honest entity list in user documentation
A threat model recommending disclosure to end users, not just an internal fix — the same instinct this whole site is built on, appearing inside a single agentic-workflow review.
Document Anthropic log retention policy in the DPO register
A threat model treating an AI provider's own data-handling policy as part of the attack surface — not the model's behaviour, the vendor's retention posture.
Prompt injection via file content
Among the eight threats: prompt injection via file content, scored Medium likelihood / High impact for the agentic workflow. This is this site's clearest evidence that the estate threat-models AI systems specifically, not only conventional web surfaces — the subject /agentic/ covers in full.