Threat Model
Governance Failure & Attack Surfaces
Governance systems must assume bypass attempts, identity compromise, policy manipulation, and ledger tampering. This page defines the primary threat surface for Layer-7 and the mitigation posture that preserves enforceability, traceability, and accountability under pressure.
Threat Model Objective
The Layer-7 threat model is designed to protect a single invariant: execution must not bypass governance. Everything else—availability, performance, convenience—must remain subordinate to enforceability and audit integrity.
What we defend
- Authority integrity — approvals cannot be forged or impersonated.
- Policy integrity — policies cannot be silently modified or rolled back.
- Ledger integrity — events cannot be deleted, mutated, or replayed without detection.
- Gateway enforceability — tools cannot execute without governance confirmation.
What we assume
- Internal actors can be adversarial or negligent.
- Execution systems may attempt bypass for speed.
- Policy drift is inevitable without strict versioning.
- Audits occur under time pressure and incomplete information.
Primary Threat Categories
Authority Compromise
Stolen credentials, impersonation, forged approvals, compromised approver devices.
Policy Manipulation
Unauthorized edits, “rollback to permissive policy,” unsigned policy injection.
Ledger Tampering
Deletion, mutation, truncation, or replay of historical decision events.
Execution Bypass
Direct tool invocation that avoids the gateway or governance engine decision path.
Risk Model Poisoning
Manipulating inputs to downgrade risk bands, hide action class severity, or mask context.
Denial of Governance
Taking the engine/ledger offline to force shadow execution or bypass controls.
Attack Surface Mapping
Attack surfaces are categorized by Layer-7 boundaries: identity, policy, ledger, gateway, and network. Mitigations must be structural, not “best effort.”
| Surface | Representative vectors | Structural mitigations |
|---|---|---|
| Identity | Credential theft, session hijack, impersonation, replay | MFA, short-lived tokens, device binding, approval signatures |
| Authority | Forged approvals, delegated approvals without trace, “rubber-stamp” behavior | Role-based routing, explicit approver identity, structured approval reasons, approval TTL |
| Policy Store | Unauthorized edits, version rollback, unsigned policy injection | Signed bundles, immutable versions, hash addressing, controlled release workflow |
| Governance Engine | Parameter tampering, config drift, disabled gates | Config attestation, policy hash requirements, runtime integrity checks |
| Decision Ledger | Event deletion/mutation, truncation, replay | Append-only design, hash-chained events, periodic anchoring, restricted writes |
| Execution Gateway | Direct tool calls, bypass routes, “shadow endpoints” | Network segmentation, gateway-only tool access, deny on missing governance confirmation |
| Network | MITM, lateral movement, exposed services | mTLS, least-privilege networking, private service planes, IP allowlists |
| Observability | Missing logs, altered metrics, blind spots | Ledger as truth source, export chain-of-custody, integrity alerts |
Fail-Closed Enforcement
Layer-7 is designed to fail closed for governed actions. If governance cannot be confirmed, execution must not proceed. This protects against denial-of-governance attacks and “temporary bypass” behavior.
Fail-closed triggers
- Ledger unavailable — cannot write state transitions.
- Policy unavailable — cannot confirm the governing ruleset.
- Identity degraded — cannot validate approver or requestor.
- Gateway cannot confirm — execution outcome not verifiable.
Expected system behavior
- Low-risk: queue or deny per policy (configurable).
- High/critical: deny with required remediation steps.
- All actions: emit an incident-ready event.
- No silent publish: “assumed execution” is disallowed.
Common Bypass Scenarios
The most common governance failures are operational, not theoretical. This section documents known bypass patterns and the structural countermeasures required to prevent them.
Shadow tooling
Teams call tools directly outside the gateway “just this once.”
Policy drift
Different environments run different policy versions without detection.
Approval dilution
Approvals become routine, fast, and unreasoned—high risk slips through.
Ledger gaps
Decisions execute but ledger write fails; history becomes incomplete.
Risk downgrading
Inputs are shaped to reduce risk band classification.
Rollback attack
System is forced onto older permissive policy versions.
Break-Glass Protocol
Break-glass is an emergency override mechanism. It is permitted only under strict constraints and must be fully recorded in the decision ledger. Break-glass is not a “skip approval” feature.
Break-glass constraints
- Time-limited — expires automatically (TTL).
- Scope-limited — only specific action classes allowed.
- Identity-bound — cannot be shared or delegated.
- Reason-required — structured reason code + free text.
Mandatory follow-up
- Post-event review within defined window.
- Policy remediation if override indicates systemic misfit.
- Executive visibility in the Executive Panel.
- Audit export readiness with chain-of-custody.
Compromise Scenarios & Deterministic Response
Layer-7 compromise response must be deterministic: when integrity is threatened, behavior becomes more restrictive, not more permissive. The goal is to preserve audit survivability and prevent silent bypass.
| Scenario | Detection signal | System response |
|---|---|---|
| Ledger integrity failure | Hash chain mismatch / missing anchor / write errors | Enter restricted mode; deny high-risk; queue low-risk; alert owners |
| Policy store compromise | Unsigned policy detected / version drift / rollback attempt | Reject unsigned bundles; rollback to last signed version; halt governed execution if unresolved |
| Authority breach | Anomalous approvals / impossible travel / token misuse | Revoke sessions; require re-auth; freeze approvals until identity validated |
| Gateway bypass detected | Tool invocation without ledger-confirmed governance | Block tool access; trigger incident; require remediation before re-enable |
| Denial of governance attempt | Repeated engine outages correlated with high-risk execution | Fail closed; force manual executive review path; disable break-glass if abused |
Scope & Non-Goals
In scope
- Governance integrity under adversarial conditions
- Bypass prevention at execution boundaries
- Immutable decision reconstruction
- Authority and approval integrity
Out of scope
- Solving all endpoint security for downstream tools
- Replacing enterprise IAM systems
- Guaranteeing model correctness or truth
- Preventing all social engineering (only reducing blast radius)