advanced
Threat Model: Payment System
High-integrity payment intents, provider calls, webhooks, ledger and reconciliation.
UserLLMAgentToolDataDecisionHumanGuardrail
Assets
Money movementhighly-sensitive
Loss of money movement harms users and the system’s core promise.
Ledger integrityconfidential
Loss of ledger integrity harms users and the system’s core promise.
Provider credentialsconfidential
Loss of provider credentials harms users and the system’s core promise.
Actors and capabilities
| Actor | Trust | Starting capability |
|---|---|---|
| Anonymous visitor | untrusted | Can send arbitrary public requests. |
| Authenticated user | semi-trusted | Can exercise product APIs within an account or tenant. |
| Backend service | trusted | Can read and modify scoped production data. |
| Administrator | privileged | Can perform exceptional cross-user operations. |
Entry points & trust boundaries
Attack surface
public Public API and login
Rate-limit, parse and authenticate at the first boundary.
authenticated Product resources
Every object needs a resource-level authorization decision.
privileged Admin operations
Step-up, separate authorization and audit.
public Webhook
Verify exact provider, body freshness and event identity.
Boundary validation
Browser ┃ TRUST ┃ API
origin where relevant · session/token · shape and limits
API ┃ TRUST ┃ Backend
principal · action · resource authorization
Backend ┃ TRUST ┃ Database
restricted role · tenant scope
Threats
A valid payment or webhook is processed twice.
IMPACT · Compromise of money movement.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
A general application identity can issue refunds.
IMPACT · Compromise of ledger integrity.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
Provider and internal state diverge without detection.
IMPACT · Compromise of provider credentials.
PREVENT · Enforce the boundary-specific control. Limit the responsible identity.
DETECT · Record principal, action and resource.
Residual risk & unknowns
Residual risks
- • Privileged insiders and control-plane compromise remain high-impact.
- • Business abuse can use technically valid operations.
Explicitly out of scope
- • Physical facilities and provider-internal controls.