intermediate
Threat Model: E-Commerce
Accounts, catalog, checkout, payments, inventory and admin tools.
UserLLMAgentToolDataDecisionHumanGuardrail
Assets
Payment authorityhighly-sensitive
Loss of payment authority harms users and the system’s core promise.
Customer accountsconfidential
Loss of customer accounts harms users and the system’s core promise.
Orders and inventoryconfidential
Loss of orders and inventory harms users and the system’s core promise.
Actors and capabilities
| Actor | Trust | Starting capability |
|---|---|---|
| Anonymous visitor | untrusted | Can send arbitrary public requests. |
| Authenticated user | semi-trusted | Can exercise product APIs within an account or tenant. |
| Backend service | trusted | Can read and modify scoped production data. |
| Administrator | privileged | Can perform exceptional cross-user operations. |
Entry points & trust boundaries
Attack surface
public Public API and login
Rate-limit, parse and authenticate at the first boundary.
authenticated Product resources
Every object needs a resource-level authorization decision.
privileged Admin operations
Step-up, separate authorization and audit.
public Webhook
Verify exact provider, body freshness and event identity.
Boundary validation
Browser ┃ TRUST ┃ API
origin where relevant · session/token · shape and limits
API ┃ TRUST ┃ Backend
principal · action · resource authorization
Backend ┃ TRUST ┃ Database
restricted role · tenant scope
Threats
Reused credentials create a buyer session.
IMPACT · Compromise of payment authority.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
A caller reaches an admin-only stock operation.
IMPACT · Compromise of customer accounts.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
A forged payment event marks an order paid.
IMPACT · Compromise of orders and inventory.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
Residual risk & unknowns
Residual risks
- • Privileged insiders and control-plane compromise remain high-impact.
- • Business abuse can use technically valid operations.
Explicitly out of scope
- • Physical facilities and provider-internal controls.