Agent Wranglers

APS-93Recommended

Draw the data flows and their trust boundaries

Keep a data-flow diagram for each app in the repository. It shows every process, data store, outside party and flow, and a line wherever trust changes.

By Agent Wranglers. Updated .

How to do it

A trust boundary is any place where data passes between parties that trust each other differently. Examples are the browser and the server, the app and a payment provider, or a public API and an internal queue. Draw the diagram as text, such as Mermaid or a threat modelling tool's file, so it changes in the same pull request as the code. Give each flow a number and name the data it carries, such as card tokens or session cookies. Every flow that crosses a boundary is where input is checked, as Find threats at every boundary with STRIDE and LINDDUN describes. The threat model in Plan attacks before building starts from this diagram.

Examples

Mermaid example

flowchart LR
  subgraph Internet
    B[Browser]
  end
  subgraph App["App servers (boundary 1)"]
    W[Web app] --> Q[(Order queue)]
  end
  subgraph Provider["Payment provider (boundary 2)"]
    P[Hosted checkout]
  end
  B -- "1: session cookie, order form" --> W
  W -- "2: order ID, amount" --> P
  P -- "3: signed webhook" --> W

How to check

A CI job fails a pull request that adds an outbound host, a queue or a data store but leaves the diagram file unchanged. Every flow in the diagram that crosses a boundary has a number and a named kind of data.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/threat-modelling/data-flow-diagram">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.