STRIDE walk against every shipped fastpace primitive
Public artifact. Updated per release; cross-linked from the marketing site's /trust page. The complete document — including residual risks per category and what changes in the next-sprint horizon — is in the GitHub repo: THREAT-MODEL.md. The primitives analyzed here are vendor-neutral: the same hook layer, signed artifacts, and policy enforcement deploy to Claude Code, Codex, and Gemini CLI (one codebase, generated per assistant), so each STRIDE finding applies per assistant surface, not to a single runtime.
Scope
In scope
The @fastpace-ai/fp CLI binary; every shipped hook; every
shipped agent identity manifest; the local UI and its API; the
on-disk artifacts (audit log, manifests, AI-BOMs, attestations,
explanations, exceptions, corrections, redaction logs, control
monitor, data taps, audit gate, policy bundles, webhook log,
replication manifest); the optional self-hosted org dashboard;
the SAML envelope verifier; the Sigstore-style attestation bundle.
Out of scope
The AI runtimes themselves — Claude Code, Codex, Gemini CLI (your
contract with each provider; a runtime-vendor breach is their incident
response). Your git server, npm registry, container registry. Your IdP's
own security posture (we trust the IdP-signed assertion). Note that
ungoverned assistant usage is NOT out of scope — that's what
fastpace posture's shadow-AI detection surfaces.
STRIDE summary
S · Spoofing identity
F0.1 cryptographic identity, F0.2 hash-chained signed audit log, F2.4 AI-BOM signing, F1.12 sanctioned-install attestation (with Sigstore bundle), F2.11 policy bundle, F1.14 SAML envelope verifier, F2.6 trusted data taps.
T · Tampering with data
F0.2 hash chain (each entry binds to its predecessor), F1.1 signed run manifests, F2.4 AI-BOM, F2.3 provenance trailers, F2.2 explanation bundles, F2.6 data taps, F2.5 control monitor, F2.9 audit gate, F2.11 policy bundle, F0.4 agent identity manifests, F3.11 audit log replication to immutable storage.
R · Repudiation
F0.1 install identity binds every signed artifact. F0.2 audit chain is append-only with hash linkage. F1.8 exception workflow signs every grant + revoke. F2.3 provenance trailers bind commits to manifests. F1.14 RBAC + SAML capture the actor on every privileged action. F2.14 coach feedback ratings are signed.
I · Information disclosure
F0.5 prompt redactor strips secrets + PII before the prompt reaches the runtime. F1.10 sensitivity-tagged context, F2.6 trusted data taps, F1.11 approved-runtime registry, F1.7 MCP scope mediation. Plaintext is NEVER persisted in any signed artifact (sha256 digests only). Identity private key stored at 0o600 perms, never transmitted.
D · Denial of service
Hooks exit in <50ms on the happy path. F1.3 circuit breaker refuses to fire below 3 sample sessions. F1.8 exception workflow + F1.9 coach always surface a path forward. F2.13 SAST configurable block_on threshold + soft mode. F2.9 audit gate --soft for staged rollouts. F2.11 policy apply has a one-command revert backup.
E · Elevation of privilege
F0.4 agent scope (allowed_tools, allowed_paths, max_files), F1.11 approved runtimes, F1.7 MCP per-server allowed_actions, F1.6 least-privilege bootstrap (`fastpace grant`), F1.8 risk-tier exceptions (critical/irreversible/exfil require named reviewer), F1.14 RBAC, F1.14 SAML envelope verifier, F1.12 sanctioned-install attestation.
Residual risks
Three residuals are documented in THREAT-MODEL.md and tracked in the future-work register:
Host-compromised attacker
With the F0.1 private key on the same machine, an attacker with full host access can forge signatures locally. Mitigation: F3.11 replicates the audit log to immutable storage (S3 Object Lock, GCS Bucket Lock, Azure immutability, or WORM-mode self-hosted). See audit-replication docs.
Novel secret formats slipping past the redactor
Redaction is regex-based. Custom patterns extend the built-in set per repo. F2.13 SAST hook covers a different layer (post-write code). Future work: a learned redactor that flags potentially-sensitive prose.
Hook bug failing closed
Each hook ships try/catch with allow() as
the default failure mode (correct choice when the alternative is the
developer being unable to work). High-risk hooks
(runtime-guard, agent-scope-guard) fail
closed by explicit design.