Threat model
Map attackers, untrusted inputs, assets, trust boundaries and abuse paths.
MODULE 08 / 10
All modules ↑SECURE · TARGET L4 · 7 days
08
Safe-agent deployment
Red-team a sandboxed agent, contain tool misuse and produce a prioritized remediation plan.
Turn safe-agent principles and OpenClaw findings into a repeatable, evidence-based assessment method.
Prerequisites
- Modules 01 and 05–07
- IAM at L3
- Threat modeling at L2
01 / CONCEPT LESSONS
Build the mental model first.
Prompt injection
Treat retrieved and tool-returned text as untrusted data, not instructions.
Least agency
Limit reachable tools, parameters, resources, duration and side effects.
Guardrails and validation
Defense requires layered input, output, policy and tool validation; no single filter is sufficient.
Detection and response
Record policy decisions and denied attempts, then define containment and credential rotation.
02 / SYSTEM FLOW
Trace the complete path.
Untrusted input→Content classification→Model→Policy engine→Approval→Narrow tool→Audit + response
For every arrow, the engineer must name the data, identity, trust boundary, failure mode and evidence produced.
03 / GUIDED LAB
Build it in bounded steps.
AI and documentation are allowed. The learner owns every generated artifact and must preserve the stated safety boundaries.
- 01Create the sandbox threat model.
- 02Build a prompt-injection test set.
- 03Attempt tool-argument manipulation and data exfiltration.
- 04Apply guardrails plus deterministic policy checks.
- 05Reduce runtime IAM and network egress.
- 06Retest and rank residual risk.
04 / INCIDENT SIMULATION
A retrieved runbook contains instructions that cause the agent to invoke a privileged tool.
Mentor injects
- Retrieved text is concatenated as trusted instruction
- Tool accepts an unrestricted resource identifier
- Audit log captures action but not source context
Required evidence
- Attack path reconstruction
- Containment actions
- Layered remediation and retest results
Investigation loop
Symptom → impact → hypothesis → evidence → test → root cause → containment → correction → verification.
05 / DESIGN CHALLENGE
Start with a blank page.
Create three autonomy tiers—recommend, approve-and-act, bounded automatic action—and define entry criteria for each.
06 / VERIFY & SUBMIT
Verification checklist
Submission package
- Threat model
- Assessment checklist
- Attack test results
- Remediation plan
- Executive summary
Review questions
- Where does untrusted text enter?
- Can a guardrail replace IAM?
- What is the maximum blast radius?
- Which action needs human review?
- How would you rotate after compromise?
07 / MENTOR-ONLY GUIDANCE
Use one novel injection not present in the learner’s test set. Score reasoning and containment, not whether the first defense catches it.
SCORING1 · cannot explain2 · explains with gaps3 · implements and verifies4 · designs and handles trade-offs
Record the achieved L-level only from observed evidence. Course completion and certification do not automatically change the skill matrix.