Threat model: design + strategy parent #3

New issue

Closed

opened 2026-05-23 20:55:17 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-23 20:55:17 +00:00

Owner

Originally filed by @coilysiren on 2026-05-08T12:16:39Z - https://github.com/coilysiren/otel-a2a-relay/issues/101

Parent issue for working through the o2r threat model. Authoring this is a prerequisite for the encryption / signing / key-management cluster (#77, #79, #80, #83, #85) and the cross-tenant attack tickets (#49, #52, #53).

Open questions

These need answers before any child ticket in the cluster can move autonomously.

Trust boundaries

Who's trusted: the relay operator? Each tenant agent? The OTel backend? The wire-format consumer?
Which combinations are explicitly distrusted: tenant-to-tenant? Relay-to-tenant? Backend-to-relay?

Attacker capabilities

Defending against malicious tenant attempting cross-tenant span injection?
Defending against a malicious OTel sink that scrapes attributes?
Defending against a compromised relay operator (insider threat)?
Defending against passive wire-format observers?

Out-of-scope attacks

Rubber-hose / coercion - out.
Side channels (timing, cache) - in or out?
Supply-chain attacks on dependencies - out (covered by supply-chain-audit).
Prompt injection via attributes - in scope, see #53.

Defense ordering

Which mitigations are 'must ship before public': encryption at rest? Signed spans? Tenant isolation tests?
Which are 'nice to have once primary defenses land': selective disclosure (#80), Merkle roots (#79)?

Output

A docs/threat-model.md (or section in docs/protocol.md, see #83) that:

Names the boundaries.
Names the attackers.
Names what's protected and what isn't.
Cross-links each downstream cluster ticket as 'this addresses attacker class X'.

Children unblocked once this lands

#83 - threat model section in docs/protocol.md (this issue's deliverable)
#79, #80, #85, #77 - encryption / signing / key-management
#49, #52, #53 - cross-tenant + prompt-injection attack tests

This issue stays open as the design home until the threat model doc is committed; then close and link.

_Originally filed by @coilysiren on 2026-05-08T12:16:39Z - [https://github.com/coilysiren/otel-a2a-relay/issues/101](https://github.com/coilysiren/otel-a2a-relay/issues/101)_ Parent issue for working through the o2r threat model. Authoring this is a prerequisite for the encryption / signing / key-management cluster (#77, #79, #80, #83, #85) and the cross-tenant attack tickets (#49, #52, #53). ## Open questions These need answers before any child ticket in the cluster can move autonomously. ### Trust boundaries - Who's trusted: the relay operator? Each tenant agent? The OTel backend? The wire-format consumer? - Which combinations are explicitly distrusted: tenant-to-tenant? Relay-to-tenant? Backend-to-relay? ### Attacker capabilities - Defending against malicious tenant attempting cross-tenant span injection? - Defending against a malicious OTel sink that scrapes attributes? - Defending against a compromised relay operator (insider threat)? - Defending against passive wire-format observers? ### Out-of-scope attacks - Rubber-hose / coercion - out. - Side channels (timing, cache) - in or out? - Supply-chain attacks on dependencies - out (covered by supply-chain-audit). - Prompt injection via attributes - in scope, see #53. ### Defense ordering - Which mitigations are 'must ship before public': encryption at rest? Signed spans? Tenant isolation tests? - Which are 'nice to have once primary defenses land': selective disclosure (#80), Merkle roots (#79)? ## Output A docs/threat-model.md (or section in docs/protocol.md, see #83) that: 1. Names the boundaries. 2. Names the attackers. 3. Names what's protected and what isn't. 4. Cross-links each downstream cluster ticket as 'this addresses attacker class X'. ## Children unblocked once this lands - #83 - threat model section in docs/protocol.md (this issue's deliverable) - #79, #80, #85, #77 - encryption / signing / key-management - #49, #52, #53 - cross-tenant + prompt-injection attack tests This issue stays open as the design home until the threat model doc is committed; then close and link.

coilysiren referenced this issue

2026-05-23 20:55:18 +00:00

Build an otel-a2a-relay MCP server #6

coilysiren added the

label

2026-05-31 01:55:17 +00:00

coilysiren added

and removed

labels

2026-06-04 08:16:42 +00:00

coilysiren commented

2026-06-17 08:23:57 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:57 +00:00