Capstone: threat-model an AI application

Every defence in this pillar was built one rung at a time — quarantine, redaction, permission gates, sandboxes — but real systems are attacked as a whole, so this capstone asks you to defend one as a whole: a realistic multi-tenant customer-support agent that retrieves from a shared knowledge base and the user's own tickets, and can call tools including send_email and issue_refund. Your deliverable is its threat model: you map assets and trust boundaries, enumerate abuse cases with STRIDE — a checklist of six threat categories, from spoofing to elevation of privilege, adapted here to LLM/agent systems — and attach to each threat a mitigation you built in P59. You end by stating the residual risk honestly, because no injection defence is complete — which is exactly why the irreversible actions sit behind a human. No code runs and nothing asks you to attack a system: this is a design exercise, and the deliverable is the defence plan.