The TIDIR Assurance Case Map & Architecture Graph

Tier 1: Strategic Architecture · Audience: Security Architects, Regulators, Researchers · Normative Status: Normative Reference
Purpose: Provides full bi-directional traceability from adversarial threats to constitutional invariants, capabilities, and prescribed validation criteria.

Architecture as a Connected Graph

In modern security architecture, declaring principles is insufficient without demonstrating how those principles resist active adversary subversion. The TIDIR Assurance Case establishes an explicit, machine-traceable relationship between identified threats against the defence system itself and the deterministic controls that preserve system integrity:

Adversarial Threat ⟶ Invariant ⟶ Capability ⟶ Architectural Control ⟶ ADR ⟶ Validation Criteria

Bi-Directional Assurance Matrix

The table below maps each adversarial threat to its governing invariant, underpinning capabilities, deterministic control mechanism, and prescribed validation method and acceptance criteria:

Threat ID & Name	Governing Invariant	Underpinning Capabilities	Architectural Control Mechanism	Governing ADR	Primary Scientific Literature	Validation Method & Acceptance Criteria
THR-T1: Sensor Evasion / Log Blinding	INV-01 (Telemetry Preservation) INV-08 (Degraded Defence)	`CAP-DATA-01` `RESIL-01` `RESIL-02`	Local NVMe ring buffering, direct-to-object lakehouse bypass, out-of-band audit beats.	ADR-0021	FND-19: CrowdStrike & Mandiant 2024–2026 Telemetry FND-03: NIST SP 800-207 Zero Trust	Bus partition chaos test: zero dropped records during 24h simulated network isolation.
THR-T2: Schema Poisoning / DoS Inundation	INV-01 (Telemetry Preservation) INV-11 (Operational Portability)	`CAP-DATA-02` `CAP-DATA-03`	Line-rate OCSF compiler validation, structured `unmapped_data` catch-all, isolated DLQ quarantine.	ADR-0002	FND-04: OCSF Specification 2023 FND-16: Apache Iceberg Open Table	Synthetic fuzzing suite: malformed JSON and corrupted payloads diverted to DLQ with zero parser crashes.
THR-T3: Evidence Tampering / Audit Destruction	INV-02 (Evidence Traceability) INV-10 (Reconstructability)	`CAP-INV-04` `RESIL-05`	Immutable WORM object storage, RFC 3161 cryptographic timestamps, append-only Incident Decision DAG.	ADR-0001 ADR-0010	FND-14: Lamport 1978 Distributed Clocks FND-15: RFC 3161 Time-Stamp Protocol	Cryptographic verification audit: cryptographic tamper evidence and Merkle root verification over sealed dossiers.
THR-T4: Indirect Prompt Injection & Instruction Manipulation	INV-04 (Authority Separation) INV-05 (Least Capability)	`CAP-INV-05` `CAP-AIGOV-02` `CAP-AIGOV-06`	Agent Trust Boundary (dual-plane data/control isolator), read-only tools, ephemeral SPIFFE SVIDs ( $\leq 15 m$ , max 15 minutes).	ADR-0004 ADR-0015	FND-10: Greshake et al. 2023 Prompt Injection FND-11: Willison 2023 Dual LLM FND-17: NCSC 2024; Anthropic 2026; UK AISI 2026; Hugging Face 2026	Continuous Evals-as-Code: prompt injection benchmark achieving zero unauthorised tool invocations across test corpus.
THR-T5: Alert Storm Denial of Service / Desensitisation	INV-03 (Evidential Independence) INV-06 (Bounded Autonomy)	`CAP-DET-04` `CAP-DET-05` `CAP-DET-06`	Dependency-aware risk compounding, supernode graph dampening, monthly SRE Alert Noise Error Budgets.	ADR-0003 ADR-0008 ADR-0009	FND-01: Axelsson 2000 Base-Rate Fallacy	Historical lakehouse backtesting: $\geq 75 %$ reduction in alert volume with noise budget false-positive rate $\leq 5 %$ .
THR-T6: Automated Response Sabotage / Outage Trigger	INV-07 (Security-State Monotonicity) INV-09 (Human Recoverability)	`CAP-RESP-01` `CAP-RESP-02` `CAP-RESP-04` `RESIL-05`	Monotonic state machine ( $s_{n + 1} ⪯ s_{n}$ , where post-transition reachability is a subset of pre-transition reachability), pre-execution blast-radius scoring, master cryptographic E-Stop.	ADR-0005	FND-08: Garcia-Molina & Salem 1987 Sagas FND-09: Nygard 2007 Circuit Breakers	Containment failure fault injection: verified forward perimeter escalation with zero security-state rollback.
THR-T7: Machine Token / SVID Hijacking	INV-04 (Authority Separation) INV-05 (Least Capability)	`CAP-AIGOV-06` `CAP-AIGOV-07`	SPIFFE/SPIRE dynamic task-scoped SVIDs ( $\leq 15 m$ ), line-rate NHI behavioral profiling, zero ambient credentials.	ADR-0015 ADR-0018	FND-02: Saltzer & Schroeder 1975 FND-06: CNCF SPIFFE Specification FND-17: Hugging Face 2026 Ambient Credential Incident	Token replay test: simulated out-of-VPC token re-use triggers immediate alert and auto-revocation in $< 5$ seconds.
THR-T8: Model & Knowledge Base Poisoning	INV-02 (Evidence Traceability) INV-10 (Reconstructability)	`CAP-DET-05` `CAP-DET-07` `CAP-AIGOV-01`	WORM-sealed RAG context, parent-hash DAG verification, SLM grounding judges ( $\geq 95 %$ ), ambient canary anchors.	ADR-0010 ADR-0013 ADR-0014	FND-18: Carlini et al. 2023 Data Poisoning FND-17: Fang 2024; Anthropic 2026; Hugging Face 2026	Grounding benchmark: corrupted context injection stripped by AST/DAG kernel; SLM judge maintains $\geq 95 %$ grounding accuracy.
THR-T9: Excessive Agency & Output Leakage	INV-05 (Least Capability) INV-06 (Bounded Autonomy)	`CAP-INV-05` `CAP-AIGOV-02` `CAP-AIGOV-03` `CAP-AIGOV-05`	Deterministic AST query validation, semantic query loop breakers (max 8 hops), strict financial cost ceiling ($2.50).	ADR-0004 ADR-0012 ADR-0017	FND-12: Endsley 1995 Situation Awareness FND-13: Bainbridge 1983 Automation Ironies FND-17: UK AISI 2026 Agent Execution Bounds	Autonomous loop injection test: recursive query oscillation terminates in $\leq 3$ cycles and freezes execution under budget cap.

3. Structured Assurance Cases (GSN: Claim · Argument · Evidence · Assumptions · Defeaters)

Traceability demonstrates design intent; genuine assurance requires structured argument. Following Goal Structuring Notation (GSN) principles, TIDIR articulates its core safety properties across five explicit dimensions:

Case 1: Prompt Injection Immunity from Unauthorized Actuation

Claim: Indirect prompt injection payloads embedded in untrusted telemetry cannot induce unauthorized environmental mutations or policy bypasses.
Argument & Mechanism: Untrusted telemetry is isolated in the Data Plane; AI reasoning models operate strictly in an advisory, read-only capacity with task-scoped ephemeral SVIDs ( $\leq 15 m$ ); proposed mutations must pass across the Agent Trust Boundary to the deterministic policy kernel and blast-radius simulator.
Assurance Evidence: Continuous Evals-as-Code test suites (ADR-0006), automated adversarial prompt fuzzing, and kernel verification proving analytical SVIDs possess zero mutating infrastructure permissions.
Environmental Assumptions: SPIFFE/SPIRE workload attestation authority remains uncompromised; Defence Control Plane network boundary is isolated from direct untrusted ingress; connector proxies enforce cryptographic bearer token scopes.
Defeaters & Falsifiers:
1. Stolen Control-Plane Key: Adversary acquires private signing keys for the declarative policy compiler.
2. Confused-Deputy Connector: Infrastructure connector contains an injection vulnerability in its parameter serialization logic, executing commands outside the validated schema.
3. Supply Chain Subversion: Compromised CI/CD pipeline injects a backdoor into the policy compiler binary.

Case 2: Model-Bounded Containment Monotonicity ( ${\hat{R}}_{A} (s^{'}, M_{t}) \subseteq {\hat{R}}_{A} (s, M_{t})$ )

Claim: Downstream API timeouts or connector failures during automated containment cannot restore adversary reachability relative to the validated environmental model $M_{t}$ .
Argument & Mechanism: Containment state machines execute asymmetric forward Sagas; reverse compensation on established perimeters is strictly forbidden; partial failures freeze existing barriers and escalate forward to outer network perimeters.
Assurance Evidence: Chaos engineering fault injection (ADR-0008), simulated API partition tests, and programmatic model-checking of state transition tables.
Environmental Assumptions: The environmental topology and identity model $M_{t}$ accurately captures current network routes, trust domains, and fallback authentication pathways; target infrastructure APIs support idempotent retry.
Defeaters & Falsifiers:
1. Unmodelled Fallback Pathways: Isolating an IdP session causes an application to fall back to unmanaged local credentials unknown to model $M_{t}$ .
2. Asymmetric Network Routing: Host isolation severs defensive telemetry streams before confirming network-layer egress shutdown, blinding the control plane to lateral movement.
3. Isolation Lease Deadlock: An unratified isolation lease expires during a prolonged operator outage without successfully triggering forward boundary escalation.

Case 3: Evidential Independence & Non-Inflated Risk Compounding

Claim: Co-derived detection alerts sharing common raw observation lineage cannot masquerade as independent corroborating evidence or artificially trigger automated containment.
Argument & Mechanism: The canonical finding contract mandates explicit citation of source_observation_ids and derivation_chain; the Risk Lens applies ancestral discounting, penalizing co-derived signals to their residual information gain.
Assurance Evidence: Historical lakehouse backtesting demonstrating $\geq 75 %$ reduction in alert noise; unit test fixtures verifying that duplicate detections from a single parent event yield a single evidence increment.
Environmental Assumptions: Upstream sensors and parsers faithfully generate and preserve unique, immutable observation identifiers; the in-memory graph correlation window is sufficiently sized to link causally related events.
Defeaters & Falsifiers:
1. Identifier Collision or Stripping: A buggy collector generates duplicate or random observation IDs, masking shared ancestry from the graph correlator.
2. Uncalibrated Overlap Heuristic: The overlap discounting parameter $Overlap (e_{1}, e_{2})$ underestimates cross-domain correlation, allowing closely coupled sensors (e.g. host network connections vs firewall flows) to inflate posterior risk.

Case 4: Deterministic Reconstructability of Defensive Lineage

Claim: Any consequential defensive finding, analytical hypothesis, policy evaluation, or response mutation can be deterministically reconstructed after the fact from immutable records.
Argument & Mechanism: Every event, proposal, and authorization decision is committed as a cryptographically linked node in the Incident Decision DAG, sealed with RFC 3161 timestamps and persisted to WORM object storage.
Assurance Evidence: Cryptographic Merkle tree verification audits over archived dossiers, tamper-detection canary assertions, and full post-incident deterministic replay simulations.
Environmental Assumptions: RFC 3161 Time-Stamp Authorities (TSAs) remain cryptographically trustworthy; object storage WORM retention policies cannot be administratively shortened.
Defeaters & Falsifiers:
1. Pre-Ingestion Log Modification: An attacker with root kernel access tampers with memory before raw events are committed to the local NVMe spool.
2. Time-Stamp Authority Compromise: Rogue or compromised TSA certificate authorities issuing backdated or forged timestamp tokens.

Machine-Readable Model Access

The complete relationship graph is compiled deterministically during documentation build and exposed as standard JSON for automated agent retrieval and CI conformance testing:

📡 Machine-Readable Graph Endpoint: /architecture.json
📄 Complete LLM Corpus: /llms-full.txt
📋 Curated LLM Summary: /llms.txt

The TIDIR Assurance Case Map & Architecture Graph ​

Architecture as a Connected Graph ​

Bi-Directional Assurance Matrix ​

3. Structured Assurance Cases (GSN: Claim · Argument · Evidence · Assumptions · Defeaters) ​

Case 1: Prompt Injection Immunity from Unauthorized Actuation ​

Case 3: Evidential Independence & Non-Inflated Risk Compounding ​

Case 4: Deterministic Reconstructability of Defensive Lineage ​

Machine-Readable Model Access ​