threat_family: Unauthorized execution

affected_asset: Runtime executor

control_principle: Identity-first authorization

residual_risk_statement: Stale authority data can still create timing windows until revalidation occurs.


threat_family: Policy bypass

affected_asset: Policy engine

control_principle: Policy before execution

residual_risk_statement: Incorrect policy logic can still deny or allow incorrectly if not reviewed.


threat_family: Approval bypass

affected_asset: Approval service

control_principle: Human approval for high-impact actions

residual_risk_statement: Approver fatigue can weaken review quality.


threat_family: Connector abuse

affected_asset: External connector

control_principle: Capability-scoped connectors

residual_risk_statement: Trusted connectors may still misbehave beyond visible posture signals.


threat_family: Evidence tampering

affected_asset: Audit evidence

control_principle: Evidence by design

residual_risk_statement: External storage choices determine final tamper resistance.


threat_family: Trust drift

affected_asset: Running capability

control_principle: Continuous verification

residual_risk_statement: Detection quality depends on monitoring signal quality and cadence.