actshield 0.9.0__py3-none-any.whl

actshield/threatmodel/actors.py

@@ -0,0 +1,210 @@
+"""Threat actors — who can attack the agent system and how."""
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+
+class ActorType(str, Enum):
+    """Classification of threat actor origin."""
+    EXTERNAL_ATTACKER = "EXTERNAL_ATTACKER"
+    MALICIOUS_USER = "MALICIOUS_USER"
+    COMPROMISED_AGENT = "COMPROMISED_AGENT"
+    MALICIOUS_MCP_SERVER = "MALICIOUS_MCP_SERVER"
+    POISONED_DOCUMENT = "POISONED_DOCUMENT"
+    POISONED_RAG_SOURCE = "POISONED_RAG_SOURCE"
+    COMPROMISED_TOOL = "COMPROMISED_TOOL"
+    SUPPLY_CHAIN_ATTACKER = "SUPPLY_CHAIN_ATTACKER"
+    INSIDER_THREAT = "INSIDER_THREAT"
+    PROMPT_INJECTOR = "PROMPT_INJECTOR"
+
+
+class ActorCapability(str, Enum):
+    """What the actor is capable of doing."""
+    CRAFT_PROMPTS = "CRAFT_PROMPTS"
+    INJECT_CONTEXT = "INJECT_CONTEXT"
+    POISON_DOCUMENTS = "POISON_DOCUMENTS"
+    INTERCEPT_RESPONSES = "INTERCEPT_RESPONSES"
+    COMPROMISE_TOOLS = "COMPROMISE_TOOLS"
+    IMPERSONATE_AGENT = "IMPERSONATE_AGENT"
+    EXFILTRATE_DATA = "EXFILTRATE_DATA"
+    ESCALATE_PRIVILEGES = "ESCALATE_PRIVILEGES"
+    MANIPULATE_DELEGATION = "MANIPULATE_DELEGATION"
+
+
+class ThreatActor(BaseModel):
+    """A threat actor that can attack the agent system."""
+    actor_id: str
+    name: str
+    actor_type: ActorType
+    description: str
+    capabilities: list[ActorCapability] = Field(default_factory=list)
+    entry_points: list[str] = Field(default_factory=list)
+    # MITRE ATT&CK-style sophistication: 1 (script kiddie) to 5 (nation-state)
+    sophistication: int = 2
+    # Is this actor already inside the trust boundary?
+    is_internal: bool = False
+
+    def to_dict(self) -> dict[str, Any]:
+        return self.model_dump(mode="json")
+
+
+class ActorRegistry:
+    """Catalog of threat actors relevant to autonomous AI systems."""
+
+    _DEFAULTS: list[dict[str, Any]] = [
+        {
+            "actor_id": "act_ext_attacker",
+            "name": "External Attacker",
+            "actor_type": ActorType.EXTERNAL_ATTACKER,
+            "description": (
+                "Adversary with no authenticated access who interacts with the "
+                "agent system through public-facing interfaces or indirect channels."
+            ),
+            "capabilities": [
+                ActorCapability.CRAFT_PROMPTS,
+                ActorCapability.POISON_DOCUMENTS,
+                ActorCapability.EXFILTRATE_DATA,
+            ],
+            "entry_points": ["public_api", "user_input", "web_content", "external_mcp"],
+            "sophistication": 3,
+            "is_internal": False,
+        },
+        {
+            "actor_id": "act_mal_user",
+            "name": "Malicious User",
+            "actor_type": ActorType.MALICIOUS_USER,
+            "description": (
+                "Authenticated user who attempts to manipulate agent behavior "
+                "to access resources beyond their authorization."
+            ),
+            "capabilities": [
+                ActorCapability.CRAFT_PROMPTS,
+                ActorCapability.ESCALATE_PRIVILEGES,
+                ActorCapability.EXFILTRATE_DATA,
+            ],
+            "entry_points": ["user_input", "task_description", "file_upload"],
+            "sophistication": 2,
+            "is_internal": False,
+        },
+        {
+            "actor_id": "act_compromised_agent",
+            "name": "Compromised Agent",
+            "actor_type": ActorType.COMPROMISED_AGENT,
+            "description": (
+                "A sub-agent that has been manipulated (via prompt injection or "
+                "tool poisoning) to act outside its delegated authority."
+            ),
+            "capabilities": [
+                ActorCapability.INJECT_CONTEXT,
+                ActorCapability.ESCALATE_PRIVILEGES,
+                ActorCapability.MANIPULATE_DELEGATION,
+                ActorCapability.EXFILTRATE_DATA,
+            ],
+            "entry_points": ["sub_agent_context", "delegation_chain", "tool_response"],
+            "sophistication": 4,
+            "is_internal": True,
+        },
+        {
+            "actor_id": "act_mal_mcp",
+            "name": "Malicious MCP Server",
+            "actor_type": ActorType.MALICIOUS_MCP_SERVER,
+            "description": (
+                "An external MCP server that returns crafted responses designed "
+                "to inject malicious instructions into the agent context."
+            ),
+            "capabilities": [
+                ActorCapability.INJECT_CONTEXT,
+                ActorCapability.POISON_DOCUMENTS,
+                ActorCapability.INTERCEPT_RESPONSES,
+            ],
+            "entry_points": ["mcp_response", "external_api_response", "tool_output"],
+            "sophistication": 4,
+            "is_internal": False,
+        },
+        {
+            "actor_id": "act_poisoned_doc",
+            "name": "Poisoned Document",
+            "actor_type": ActorType.POISONED_DOCUMENT,
+            "description": (
+                "A document (web page, PDF, email) that contains embedded "
+                "instructions targeting an agent that will process it."
+            ),
+            "capabilities": [
+                ActorCapability.CRAFT_PROMPTS,
+                ActorCapability.INJECT_CONTEXT,
+            ],
+            "entry_points": ["web_content", "file_system", "email", "rag_source"],
+            "sophistication": 1,
+            "is_internal": False,
+        },
+        {
+            "actor_id": "act_poisoned_rag",
+            "name": "Poisoned RAG Source",
+            "actor_type": ActorType.POISONED_RAG_SOURCE,
+            "description": (
+                "A vector database or document store that has been poisoned "
+                "with adversarial content designed to influence agent reasoning."
+            ),
+            "capabilities": [
+                ActorCapability.INJECT_CONTEXT,
+                ActorCapability.POISON_DOCUMENTS,
+            ],
+            "entry_points": ["rag_retrieval", "vector_db_query", "knowledge_base"],
+            "sophistication": 3,
+            "is_internal": False,
+        },
+        {
+            "actor_id": "act_supply_chain",
+            "name": "Supply Chain Attacker",
+            "actor_type": ActorType.SUPPLY_CHAIN_ATTACKER,
+            "description": (
+                "Attacker who compromises a dependency, tool, or external service "
+                "used by the agent system."
+            ),
+            "capabilities": [
+                ActorCapability.COMPROMISE_TOOLS,
+                ActorCapability.INTERCEPT_RESPONSES,
+                ActorCapability.EXFILTRATE_DATA,
+            ],
+            "entry_points": ["package_dependency", "external_service", "third_party_api"],
+            "sophistication": 5,
+            "is_internal": False,
+        },
+        {
+            "actor_id": "act_insider",
+            "name": "Insider Threat",
+            "actor_type": ActorType.INSIDER_THREAT,
+            "description": (
+                "A trusted internal actor (employee, contractor) who misuses "
+                "legitimate access to agent capabilities or data."
+            ),
+            "capabilities": [
+                ActorCapability.ESCALATE_PRIVILEGES,
+                ActorCapability.EXFILTRATE_DATA,
+                ActorCapability.MANIPULATE_DELEGATION,
+            ],
+            "entry_points": ["authenticated_api", "admin_interface", "direct_db_access"],
+            "sophistication": 3,
+            "is_internal": True,
+        },
+    ]
+
+    def __init__(self) -> None:
+        self._actors: dict[str, ThreatActor] = {
+            d["actor_id"]: ThreatActor(**d) for d in self._DEFAULTS
+        }
+
+    def register(self, actor: ThreatActor) -> None:
+        self._actors[actor.actor_id] = actor
+
+    def get(self, actor_id: str) -> ThreatActor | None:
+        return self._actors.get(actor_id)
+
+    def all(self) -> list[ThreatActor]:
+        return list(self._actors.values())
+
+    def count(self) -> int:
+        return len(self._actors)

actshield/threatmodel/analyzer.py

@@ -0,0 +1,131 @@
+"""ThreatAnalyzer — orchestrates analysis of the full threat model."""
+from __future__ import annotations
+
+from typing import Optional
+
+from actshield.threatmodel.assets import AssetRegistry
+from actshield.threatmodel.actors import ActorRegistry
+from actshield.threatmodel.boundaries import BoundaryRegistry
+from actshield.threatmodel.threats import ThreatCatalog, Threat
+from actshield.threatmodel.scenarios import get_builtin_scenarios
+from actshield.threatmodel.mitigations import build_control_coverage_map, get_all_controls
+from actshield.threatmodel.models import (
+    ThreatModel,
+    AnalysisResult,
+    ThreatSeverity,
+)
+from actshield.threatmodel.scoring import ThreatScorer
+
+
+class ThreatAnalyzer:
+    """Main threat analysis engine.
+
+    Aggregates assets, actors, boundaries, threats, and scenarios into
+    a structured AnalysisResult that can be rendered or exported.
+    """
+
+    def __init__(
+        self,
+        system_name: str = "ActShield-Monitored Agent System",
+        asset_registry: Optional[AssetRegistry] = None,
+        actor_registry: Optional[ActorRegistry] = None,
+        boundary_registry: Optional[BoundaryRegistry] = None,
+        threat_catalog: Optional[ThreatCatalog] = None,
+    ) -> None:
+        self.system_name = system_name
+        self.assets = asset_registry or AssetRegistry()
+        self.actors = actor_registry or ActorRegistry()
+        self.boundaries = boundary_registry or BoundaryRegistry()
+        self.threats = threat_catalog or ThreatCatalog()
+        self.scorer = ThreatScorer()
+
+    def get_model(self) -> ThreatModel:
+        """Return a summary ThreatModel snapshot."""
+        all_threats = self.threats.all()
+        all_scenarios = get_builtin_scenarios()
+        return ThreatModel(
+            system_name=self.system_name,
+            asset_count=self.assets.count(),
+            actor_count=self.actors.count(),
+            boundary_count=self.boundaries.count(),
+            threat_count=self.threats.count(),
+            scenario_count=len(all_scenarios),
+        )
+
+    def get_threat(self, threat_id: str) -> Threat:
+        threat = self.threats.get(threat_id)
+        if threat is None:
+            raise ValueError(f"Threat not found: {threat_id}")
+        return threat
+
+    def list_threats(self, severity_filter: Optional[str] = None) -> list[Threat]:
+        all_threats = self.threats.all()
+        if severity_filter:
+            try:
+                sev = ThreatSeverity(severity_filter.upper())
+                return [t for t in all_threats if t.severity == sev]
+            except ValueError:
+                pass
+        return all_threats
+
+    def analyze(self) -> AnalysisResult:
+        """Run the full threat analysis and return a structured result."""
+        all_threats = self.threats.all()
+        all_scenarios = get_builtin_scenarios()
+
+        # Build model summary
+        model = self.get_model()
+
+        # Group threats by severity
+        threats_by_severity: dict[str, list[dict]] = {s.value: [] for s in ThreatSeverity}
+        for threat in all_threats:
+            threats_by_severity[threat.severity.value].append(threat.to_dict())
+
+        # Collect all control IDs referenced across all threats
+        all_control_ids: list[str] = []
+        for threat in all_threats:
+            all_control_ids.extend(threat.actshield_controls)
+
+        # Build coverage map
+        control_coverage = build_control_coverage_map(all_control_ids)
+
+        # Residual risks: threats where controls don't prevent
+        from actshield.threatmodel.models import ControlEffectiveness
+        residual_risks = [
+            {
+                "threat_id": t.threat_id,
+                "name": t.name,
+                "severity": t.severity.value,
+                "residual_score": self.scorer.residual_score(t),
+                "residual_risk": t.residual_risk,
+                "control_effectiveness": t.control_effectiveness.value,
+            }
+            for t in all_threats
+            if t.control_effectiveness not in (
+                ControlEffectiveness.PREVENTS,
+            )
+        ]
+
+        # Build attack paths from scenarios
+        attack_paths = [
+            {
+                "scenario_id": s.scenario_id,
+                "name": s.name,
+                "severity": s.severity.value,
+                "step_count": len(s.steps),
+                "enforcement": s.actshield_enforcement,
+                "threat_ids": s.threat_ids,
+            }
+            for s in all_scenarios
+        ]
+
+        overall_risk_score = self.scorer.overall_risk_score(all_threats)
+
+        return AnalysisResult(
+            model=model,
+            threats_by_severity=threats_by_severity,
+            control_coverage=control_coverage,
+            residual_risks=residual_risks,
+            attack_paths=attack_paths,
+            overall_risk_score=overall_risk_score,
+        )

actshield/threatmodel/assets.py

@@ -0,0 +1,167 @@
+"""Threat model assets — sensitive resources that must be protected."""
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+
+class AssetSensitivity(str, Enum):
+    CRITICAL = "CRITICAL"   # Breach = catastrophic impact
+    HIGH = "HIGH"           # Breach = significant harm
+    MEDIUM = "MEDIUM"       # Breach = moderate harm
+    LOW = "LOW"             # Breach = limited harm
+
+
+class Asset(BaseModel):
+    """A sensitive resource in the agent system that requires protection."""
+    asset_id: str
+    name: str
+    description: str
+    sensitivity: AssetSensitivity
+    owner: str = "system"
+    allowed_agents: list[str] = Field(default_factory=list)
+    allowed_operations: list[str] = Field(default_factory=list)
+    trust_boundary: str = "internal"
+    # Business impact if compromised
+    impact_confidentiality: str = "unknown"
+    impact_integrity: str = "unknown"
+    impact_availability: str = "unknown"
+    # ActShield tool name that protects this asset (if any)
+    protected_by_tool: str | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        return self.model_dump(mode="json")
+
+
+class AssetRegistry:
+    """Registry of known sensitive assets in the monitored system."""
+
+    # Default built-in assets for a typical enterprise agent deployment
+    _DEFAULTS: list[dict[str, Any]] = [
+        {
+            "asset_id": "ast_creds",
+            "name": "Credentials & API Keys",
+            "description": "Service account tokens, API keys, OAuth secrets used by agents",
+            "sensitivity": AssetSensitivity.CRITICAL,
+            "owner": "platform",
+            "allowed_agents": ["orchestrator"],
+            "allowed_operations": ["read"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "Full system compromise possible",
+            "impact_integrity": "Attacker can issue authenticated requests",
+            "impact_availability": "Token revocation required",
+        },
+        {
+            "asset_id": "ast_customer_db",
+            "name": "Customer Database",
+            "description": "PII, financial data, and customer records",
+            "sensitivity": AssetSensitivity.CRITICAL,
+            "owner": "data-team",
+            "allowed_agents": ["analysis-agent"],
+            "allowed_operations": ["read"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "Regulatory breach, customer harm",
+            "impact_integrity": "Data corruption or fraud",
+            "impact_availability": "Service disruption",
+        },
+        {
+            "asset_id": "ast_sys_prompts",
+            "name": "System Prompts & Agent Instructions",
+            "description": "Confidential agent instructions, personas, and behavioral constraints",
+            "sensitivity": AssetSensitivity.HIGH,
+            "owner": "platform",
+            "allowed_agents": ["orchestrator"],
+            "allowed_operations": ["read"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "Enables adversarial prompt engineering",
+            "impact_integrity": "Behavioral manipulation possible",
+            "impact_availability": "Low",
+        },
+        {
+            "asset_id": "ast_internal_docs",
+            "name": "Internal Documents & Source Code",
+            "description": "Proprietary documentation, source code, and internal knowledge bases",
+            "sensitivity": AssetSensitivity.HIGH,
+            "owner": "engineering",
+            "allowed_agents": ["research-agent", "analysis-agent"],
+            "allowed_operations": ["read"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "IP theft, competitive harm",
+            "impact_integrity": "Sabotage possible",
+            "impact_availability": "Medium",
+        },
+        {
+            "asset_id": "ast_cloud_resources",
+            "name": "Cloud Infrastructure Resources",
+            "description": "AWS/GCP/Azure APIs, compute, storage, networking",
+            "sensitivity": AssetSensitivity.CRITICAL,
+            "owner": "infrastructure",
+            "allowed_agents": ["orchestrator"],
+            "allowed_operations": ["read", "limited-write"],
+            "trust_boundary": "cloud-boundary",
+            "impact_confidentiality": "Data exfiltration at scale",
+            "impact_integrity": "Infrastructure destruction",
+            "impact_availability": "Full service outage",
+        },
+        {
+            "asset_id": "ast_agent_authority",
+            "name": "Agent Authority Grants",
+            "description": "Delegated permissions and authority scopes assigned to agents",
+            "sensitivity": AssetSensitivity.HIGH,
+            "owner": "platform",
+            "allowed_agents": ["orchestrator"],
+            "allowed_operations": ["read", "delegate"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "Low",
+            "impact_integrity": "Privilege escalation possible",
+            "impact_availability": "Low",
+        },
+        {
+            "asset_id": "ast_rag_sources",
+            "name": "RAG Knowledge Sources",
+            "description": "Vector databases, document stores used for retrieval-augmented generation",
+            "sensitivity": AssetSensitivity.MEDIUM,
+            "owner": "ai-team",
+            "allowed_agents": ["research-agent", "analysis-agent"],
+            "allowed_operations": ["read", "query"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "Sensitive doc exposure",
+            "impact_integrity": "Poisoned retrieval results affect agent reasoning",
+            "impact_availability": "Degraded agent quality",
+        },
+        {
+            "asset_id": "ast_audit_logs",
+            "name": "Security Audit Logs",
+            "description": "ActShield event logs, forensic traces, and security evidence",
+            "sensitivity": AssetSensitivity.HIGH,
+            "owner": "security-team",
+            "allowed_agents": [],
+            "allowed_operations": ["read"],
+            "trust_boundary": "internal",
+            "impact_confidentiality": "Attacker can study detection patterns",
+            "impact_integrity": "Evidence tampering breaks forensics",
+            "impact_availability": "Incident response compromised",
+        },
+    ]
+
+    def __init__(self) -> None:
+        self._assets: dict[str, Asset] = {
+            d["asset_id"]: Asset(**d) for d in self._DEFAULTS
+        }
+
+    def register(self, asset: Asset) -> None:
+        self._assets[asset.asset_id] = asset
+
+    def get(self, asset_id: str) -> Asset | None:
+        return self._assets.get(asset_id)
+
+    def all(self) -> list[Asset]:
+        return list(self._assets.values())
+
+    def by_sensitivity(self, sensitivity: AssetSensitivity) -> list[Asset]:
+        return [a for a in self._assets.values() if a.sensitivity == sensitivity]
+
+    def count(self) -> int:
+        return len(self._assets)

actshield/threatmodel/boundaries.py

@@ -0,0 +1,165 @@
+"""Trust and authority boundaries for the agent system threat model."""
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+
+class BoundaryType(str, Enum):
+    TRUST = "TRUST"           # Who/what is trusted at this boundary
+    AUTHORITY = "AUTHORITY"   # What operations are permitted
+    DATA = "DATA"             # What data can cross this boundary
+    NETWORK = "NETWORK"       # Network-level isolation
+    EXECUTION = "EXECUTION"   # Sandbox / runtime isolation
+
+
+class TrustBoundary(BaseModel):
+    """A boundary in the agent system that separates trust zones."""
+    boundary_id: str
+    name: str
+    boundary_type: BoundaryType
+    description: str
+    # Zones on either side
+    trusted_zone: str
+    untrusted_zone: str
+    # Controls enforced at this boundary by ActShield
+    controls: list[str] = Field(default_factory=list)
+    # Entry points that cross this boundary
+    crossing_entry_points: list[str] = Field(default_factory=list)
+
+    def to_dict(self) -> dict[str, Any]:
+        return self.model_dump(mode="json")
+
+
+class BoundaryRegistry:
+    """Registry of trust boundaries in the agent system."""
+
+    _DEFAULTS: list[dict[str, Any]] = [
+        {
+            "boundary_id": "bnd_ext_int",
+            "name": "External → Internal",
+            "boundary_type": BoundaryType.TRUST,
+            "description": (
+                "Primary boundary between external internet and internal agent "
+                "infrastructure. All external MCP responses, web content, and "
+                "user inputs cross this boundary."
+            ),
+            "trusted_zone": "internal",
+            "untrusted_zone": "external",
+            "controls": ["provenance_tracking", "taint_marking", "mcp_gateway", "http_gateway"],
+            "crossing_entry_points": [
+                "external_mcp_response", "web_content", "user_input", "external_api"
+            ],
+        },
+        {
+            "boundary_id": "bnd_agent_agent",
+            "name": "Agent → Sub-Agent Delegation",
+            "boundary_type": BoundaryType.AUTHORITY,
+            "description": (
+                "Authority boundary enforced when an orchestrator agent delegates "
+                "tasks to sub-agents. Authority cannot be escalated beyond the "
+                "delegating agent's effective authority."
+            ),
+            "trusted_zone": "orchestrator",
+            "untrusted_zone": "sub-agent",
+            "controls": ["delegation_tracking", "authority_containment", "effective_authority_check"],
+            "crossing_entry_points": ["delegation_request", "sub_task_creation"],
+        },
+        {
+            "boundary_id": "bnd_context_tool",
+            "name": "Context → Tool Execution",
+            "boundary_type": BoundaryType.DATA,
+            "description": (
+                "Critical boundary between agent context (which may be tainted "
+                "by external sources) and privileged tool execution."
+            ),
+            "trusted_zone": "tool_executor",
+            "untrusted_zone": "agent_context",
+            "controls": [
+                "taint_tracking", "provenance_check", "intent_analysis",
+                "policy_evaluation", "tool_interception"
+            ],
+            "crossing_entry_points": ["tool_request", "tool_call"],
+        },
+        {
+            "boundary_id": "bnd_mcp_context",
+            "name": "MCP Server → Agent Context",
+            "boundary_type": BoundaryType.DATA,
+            "description": (
+                "Boundary between external MCP server responses and the agent "
+                "context window. Malicious MCP responses can inject instructions."
+            ),
+            "trusted_zone": "agent_context",
+            "untrusted_zone": "mcp_response",
+            "controls": ["mcp_gateway", "taint_marking", "provenance_tracking", "intent_analysis"],
+            "crossing_entry_points": ["mcp_tool_response", "mcp_resource_content"],
+        },
+        {
+            "boundary_id": "bnd_agent_db",
+            "name": "Agent → Sensitive Database",
+            "boundary_type": BoundaryType.AUTHORITY,
+            "description": (
+                "Authority boundary protecting sensitive databases from unauthorized "
+                "agent access. Requires explicit authority grant and clean context."
+            ),
+            "trusted_zone": "database",
+            "untrusted_zone": "agent",
+            "controls": [
+                "authority_containment", "taint_check", "policy_evaluation",
+                "protected_tool", "audit_logging"
+            ],
+            "crossing_entry_points": ["database_tool_call"],
+        },
+        {
+            "boundary_id": "bnd_rag_context",
+            "name": "RAG Source → Agent Context",
+            "boundary_type": BoundaryType.DATA,
+            "description": (
+                "Boundary between retrieval-augmented sources and the agent context. "
+                "Poisoned documents retrieved via RAG can influence agent reasoning."
+            ),
+            "trusted_zone": "agent_context",
+            "untrusted_zone": "rag_retrieval",
+            "controls": ["provenance_tracking", "taint_marking", "source_attribution"],
+            "crossing_entry_points": ["rag_retrieval_result", "vector_db_response"],
+        },
+        {
+            "boundary_id": "bnd_internal_cloud",
+            "name": "Internal → Cloud Infrastructure",
+            "boundary_type": BoundaryType.NETWORK,
+            "description": (
+                "Network boundary between internal agent execution and cloud "
+                "infrastructure APIs. Unauthorized cloud API calls can cause "
+                "significant resource abuse."
+            ),
+            "trusted_zone": "cloud",
+            "untrusted_zone": "agent_network",
+            "controls": ["authority_containment", "policy_evaluation", "http_gateway"],
+            "crossing_entry_points": ["cloud_api_call", "infrastructure_tool"],
+        },
+    ]
+
+    def __init__(self) -> None:
+        self._boundaries: dict[str, TrustBoundary] = {
+            d["boundary_id"]: TrustBoundary(**d) for d in self._DEFAULTS
+        }
+
+    def register(self, boundary: TrustBoundary) -> None:
+        self._boundaries[boundary.boundary_id] = boundary
+
+    def get(self, boundary_id: str) -> TrustBoundary | None:
+        return self._boundaries.get(boundary_id)
+
+    def all(self) -> list[TrustBoundary]:
+        return list(self._boundaries.values())
+
+    def count(self) -> int:
+        return len(self._boundaries)
+
+    def for_entry_point(self, entry_point: str) -> list[TrustBoundary]:
+        return [
+            b for b in self._boundaries.values()
+            if entry_point in b.crossing_entry_points
+        ]