Encrypted agent sessions: what encryption protects and what it does not addresses one concrete problem: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. The guide works from the actual objects — EncryptedSession, Fernet, HKDF, TTL, access control — and aims for a verifiable decision rather than a generic pattern.
The concrete problem: EncryptedSession meets Fernet
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c11 starts at HKDF and treats TTL as an explicit boundary rather than an implicit assumption. The first control requires access control to emit an observable result before EncryptedSession can trigger the intended effect around Fernet. The conclusion stays bounded by access control and Fernet: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c11 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns HKDF into a reviewable decision point with a named input and a retained output. To test TTL, fixture encrypted-agent-sessions-threat-model-c11 contains both an allowed state and a rejected state; rejection must occur before any change attributed to access control.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c12 starts at TTL and treats access control as an explicit boundary rather than an implicit assumption. The first control requires EncryptedSession to emit an observable result before Fernet can trigger the intended effect around HKDF. Operations then observes the transition between EncryptedSession and Fernet, while security checks that HKDF receives neither implicit authority nor unnecessary data. If the Fernet verification fails, rollback restores the configuration around HKDF, replays encrypted-agent-sessions-threat-model-c12, and compares the new state with the control evidence from TTL. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to access control, a concrete condition, and evidence instead of a generic assurance.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c13 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. The conclusion stays bounded by Fernet and TTL: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c13 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns access control into a reviewable decision point with a named input and a retained output. To test EncryptedSession, fixture encrypted-agent-sessions-threat-model-c13 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Fernet.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c14 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. Operations then observes the transition between HKDF and TTL, while security checks that access control receives neither implicit authority nor unnecessary data. If the TTL verification fails, rollback restores the configuration around access control, replays encrypted-agent-sessions-threat-model-c14, and compares the new state with the control evidence from EncryptedSession. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to Fernet, a concrete condition, and evidence instead of a generic assurance.
Failure modes, signals, and diagnosis
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c21 starts at TTL and treats access control as an explicit boundary rather than an implicit assumption. The first control requires EncryptedSession to emit an observable result before Fernet can trigger the intended effect around HKDF. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to access control, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by EncryptedSession and HKDF: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c21 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns TTL into a reviewable decision point with a named input and a retained output.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c22 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. To test EncryptedSession, fixture encrypted-agent-sessions-threat-model-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Fernet. Operations then observes the transition between Fernet and HKDF, while security checks that TTL receives neither implicit authority nor unnecessary data. If the HKDF verification fails, rollback restores the configuration around TTL, replays encrypted-agent-sessions-threat-model-c22, and compares the new state with the control evidence from access control.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c23 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to Fernet, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by HKDF and access control: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c23 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns EncryptedSession into a reviewable decision point with a named input and a retained output.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c24 starts at Fernet and treats HKDF as an explicit boundary rather than an implicit assumption. The first control requires TTL to emit an observable result before access control can trigger the intended effect around EncryptedSession. To test HKDF, fixture encrypted-agent-sessions-threat-model-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to TTL. Operations then observes the transition between TTL and access control, while security checks that EncryptedSession receives neither implicit authority nor unnecessary data. If the access control verification fails, rollback restores the configuration around EncryptedSession, replays encrypted-agent-sessions-threat-model-c24, and compares the new state with the control evidence from Fernet.
Progressive rollout and rollback
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c31 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. If the HKDF verification fails, rollback restores the configuration around TTL, replays encrypted-agent-sessions-threat-model-c31, and compares the new state with the control evidence from access control. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to EncryptedSession, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Fernet and TTL: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c31 is labeled as a limitation or inference, never promoted to fact.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c32 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns EncryptedSession into a reviewable decision point with a named input and a retained output. To test Fernet, fixture encrypted-agent-sessions-threat-model-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to HKDF. Operations then observes the transition between HKDF and TTL, while security checks that access control receives neither implicit authority nor unnecessary data.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c33 starts at Fernet and treats HKDF as an explicit boundary rather than an implicit assumption. The first control requires TTL to emit an observable result before access control can trigger the intended effect around EncryptedSession. If the access control verification fails, rollback restores the configuration around EncryptedSession, replays encrypted-agent-sessions-threat-model-c33, and compares the new state with the control evidence from Fernet. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to HKDF, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by TTL and EncryptedSession: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c33 is labeled as a limitation or inference, never promoted to fact.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c34 starts at HKDF and treats TTL as an explicit boundary rather than an implicit assumption. The first control requires access control to emit an observable result before EncryptedSession can trigger the intended effect around Fernet. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns HKDF into a reviewable decision point with a named input and a retained output. To test TTL, fixture encrypted-agent-sessions-threat-model-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to access control. Operations then observes the transition between access control and EncryptedSession, while security checks that Fernet receives neither implicit authority nor unnecessary data.
Production decision criteria
The starting point is not a feature; it is an observable decision boundary.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c41 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. Operations then observes the transition between HKDF and TTL, while security checks that access control receives neither implicit authority nor unnecessary data. If the TTL verification fails, rollback restores the configuration around access control, replays encrypted-agent-sessions-threat-model-c41, and compares the new state with the control evidence from EncryptedSession. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to Fernet, a concrete condition, and evidence instead of a generic assurance.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c42 starts at Fernet and treats HKDF as an explicit boundary rather than an implicit assumption. The first control requires TTL to emit an observable result before access control can trigger the intended effect around EncryptedSession. The conclusion stays bounded by TTL and EncryptedSession: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c42 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns Fernet into a reviewable decision point with a named input and a retained output. To test HKDF, fixture encrypted-agent-sessions-threat-model-c42 contains both an allowed state and a rejected state; rejection must occur before any change attributed to TTL.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c43 starts at HKDF and treats TTL as an explicit boundary rather than an implicit assumption. The first control requires access control to emit an observable result before EncryptedSession can trigger the intended effect around Fernet. Operations then observes the transition between access control and EncryptedSession, while security checks that Fernet receives neither implicit authority nor unnecessary data. If the EncryptedSession verification fails, rollback restores the configuration around Fernet, replays encrypted-agent-sessions-threat-model-c43, and compares the new state with the control evidence from HKDF. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to TTL, a concrete condition, and evidence instead of a generic assurance.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c44 starts at TTL and treats access control as an explicit boundary rather than an implicit assumption. The first control requires EncryptedSession to emit an observable result before Fernet can trigger the intended effect around HKDF. The conclusion stays bounded by EncryptedSession and HKDF: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c44 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns TTL into a reviewable decision point with a named input and a retained output. To test access control, fixture encrypted-agent-sessions-threat-model-c44 contains both an allowed state and a rejected state; rejection must occur before any change attributed to EncryptedSession.
Trust boundaries around HKDF
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c51 starts at Fernet and treats HKDF as an explicit boundary rather than an implicit assumption. The first control requires TTL to emit an observable result before access control can trigger the intended effect around EncryptedSession. To test HKDF, fixture encrypted-agent-sessions-threat-model-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to TTL. Operations then observes the transition between TTL and access control, while security checks that EncryptedSession receives neither implicit authority nor unnecessary data. If the access control verification fails, rollback restores the configuration around EncryptedSession, replays encrypted-agent-sessions-threat-model-c51, and compares the new state with the control evidence from Fernet.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c52 starts at HKDF and treats TTL as an explicit boundary rather than an implicit assumption. The first control requires access control to emit an observable result before EncryptedSession can trigger the intended effect around Fernet. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to TTL, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by access control and Fernet: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c52 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns HKDF into a reviewable decision point with a named input and a retained output.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c53 starts at TTL and treats access control as an explicit boundary rather than an implicit assumption. The first control requires EncryptedSession to emit an observable result before Fernet can trigger the intended effect around HKDF. To test access control, fixture encrypted-agent-sessions-threat-model-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to EncryptedSession. Operations then observes the transition between EncryptedSession and Fernet, while security checks that HKDF receives neither implicit authority nor unnecessary data. If the Fernet verification fails, rollback restores the configuration around HKDF, replays encrypted-agent-sessions-threat-model-c53, and compares the new state with the control evidence from TTL.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c54 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to EncryptedSession, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Fernet and TTL: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c54 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns access control into a reviewable decision point with a named input and a retained output.
Build the decision path with TTL
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c61 starts at HKDF and treats TTL as an explicit boundary rather than an implicit assumption. The first control requires access control to emit an observable result before EncryptedSession can trigger the intended effect around Fernet. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns HKDF into a reviewable decision point with a named input and a retained output. To test TTL, fixture encrypted-agent-sessions-threat-model-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to access control. Operations then observes the transition between access control and EncryptedSession, while security checks that Fernet receives neither implicit authority nor unnecessary data.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c62 starts at TTL and treats access control as an explicit boundary rather than an implicit assumption. The first control requires EncryptedSession to emit an observable result before Fernet can trigger the intended effect around HKDF. If the Fernet verification fails, rollback restores the configuration around HKDF, replays encrypted-agent-sessions-threat-model-c62, and compares the new state with the control evidence from TTL. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to access control, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by EncryptedSession and HKDF: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c62 is labeled as a limitation or inference, never promoted to fact.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c63 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns access control into a reviewable decision point with a named input and a retained output. To test EncryptedSession, fixture encrypted-agent-sessions-threat-model-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to Fernet. Operations then observes the transition between Fernet and HKDF, while security checks that TTL receives neither implicit authority nor unnecessary data.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c64 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. If the TTL verification fails, rollback restores the configuration around access control, replays encrypted-agent-sessions-threat-model-c64, and compares the new state with the control evidence from EncryptedSession. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to Fernet, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by HKDF and access control: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c64 is labeled as a limitation or inference, never promoted to fact.
Verify access control with observable evidence
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c71 starts at TTL and treats access control as an explicit boundary rather than an implicit assumption. The first control requires EncryptedSession to emit an observable result before Fernet can trigger the intended effect around HKDF. The conclusion stays bounded by EncryptedSession and HKDF: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c71 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns TTL into a reviewable decision point with a named input and a retained output. To test access control, fixture encrypted-agent-sessions-threat-model-c71 contains both an allowed state and a rejected state; rejection must occur before any change attributed to EncryptedSession.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c72 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. Operations then observes the transition between Fernet and HKDF, while security checks that TTL receives neither implicit authority nor unnecessary data. If the HKDF verification fails, rollback restores the configuration around TTL, replays encrypted-agent-sessions-threat-model-c72, and compares the new state with the control evidence from access control. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to EncryptedSession, a concrete condition, and evidence instead of a generic assurance.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c73 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. The conclusion stays bounded by HKDF and access control: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c73 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns EncryptedSession into a reviewable decision point with a named input and a retained output. To test Fernet, fixture encrypted-agent-sessions-threat-model-c73 contains both an allowed state and a rejected state; rejection must occur before any change attributed to HKDF.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c74 starts at Fernet and treats HKDF as an explicit boundary rather than an implicit assumption. The first control requires TTL to emit an observable result before access control can trigger the intended effect around EncryptedSession. Operations then observes the transition between TTL and access control, while security checks that EncryptedSession receives neither implicit authority nor unnecessary data. If the access control verification fails, rollback restores the configuration around EncryptedSession, replays encrypted-agent-sessions-threat-model-c74, and compares the new state with the control evidence from Fernet. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to HKDF, a concrete condition, and evidence instead of a generic assurance.
Evidence point: Mozilla documents that require-trusted-types-for can make DOM XSS sinks reject raw strings and accept trusted typed values instead. This source anchors verify access control with observable evidence but does not replace local verification. [S7]Controls that remain after launch
The starting point is not a feature; it is an observable decision boundary.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c81 starts at access control and treats EncryptedSession as an explicit boundary rather than an implicit assumption. The first control requires Fernet to emit an observable result before HKDF can trigger the intended effect around TTL. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to EncryptedSession, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by Fernet and TTL: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c81 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns access control into a reviewable decision point with a named input and a retained output.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c82 starts at EncryptedSession and treats Fernet as an explicit boundary rather than an implicit assumption. The first control requires HKDF to emit an observable result before TTL can trigger the intended effect around access control. To test Fernet, fixture encrypted-agent-sessions-threat-model-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to HKDF. Operations then observes the transition between HKDF and TTL, while security checks that access control receives neither implicit authority nor unnecessary data. If the TTL verification fails, rollback restores the configuration around access control, replays encrypted-agent-sessions-threat-model-c82, and compares the new state with the control evidence from EncryptedSession.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c83 starts at Fernet and treats HKDF as an explicit boundary rather than an implicit assumption. The first control requires TTL to emit an observable result before access control can trigger the intended effect around EncryptedSession. This detail makes “Encrypted agent sessions: what encryption protects and what it does not” reviewable because each operational statement points to HKDF, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by TTL and EncryptedSession: anything not demonstrated by scenario encrypted-agent-sessions-threat-model-c83 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Threat-model a session store so encryption at rest is not mistaken for authorization, deletion, or prompt-level privacy. It turns Fernet into a reviewable decision point with a named input and a retained output.
In “Encrypted agent sessions: what encryption protects and what it does not”, scenario encrypted-agent-sessions-threat-model-c84 starts at HKDF and treats TTL as an explicit boundary rather than an implicit assumption. The first control requires access control to emit an observable result before EncryptedSession can trigger the intended effect around Fernet. To test TTL, fixture encrypted-agent-sessions-threat-model-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to access control. Operations then observes the transition between access control and EncryptedSession, while security checks that Fernet receives neither implicit authority nor unnecessary data. If the EncryptedSession verification fails, rollback restores the configuration around Fernet, replays encrypted-agent-sessions-threat-model-c84, and compares the new state with the control evidence from HKDF.
Evidence point: IETF / RFC Editor documents that rFC 9700 updates OAuth 2.0 security practice, including exact redirect URI matching and avoiding open redirectors and insecure legacy patterns. This source anchors controls that remain after launch but does not replace local verification. [S8]Operational checklist
- The control around EncryptedSession has an input, a rule, a rejection behavior, and evidence.
- The control around Fernet has an input, a rule, a rejection behavior, and evidence.
- The control around HKDF has an input, a rule, a rejection behavior, and evidence.
- The control around TTL has an input, a rule, a rejection behavior, and evidence.
- The control around access control has an input, a rule, a rejection behavior, and evidence.
Sources and control points
- [S1] Encrypted session - OpenAI Agents SDK — EncryptedSession can wrap a session store with Fernet encryption, per-session HKDF-derived keys and TTL-based expiration. source
- [S2] OpenAI Agents SDK — The Agents SDK is a higher-level runtime around model calls that manages tools, guardrails, handoffs, sessions and tracing. source
- [S3] Authorization - Model Context Protocol — For HTTP authorization, MCP requires resource-bound tokens, server-side audience validation and PKCE, and forbids insecure token passthrough patterns. source
- [S4] Authentication Cheat Sheet — OWASP authentication guidance separates identity proofing, authentication and session management and recommends strong controls for sensitive operations. source
- [S5] Tracing - OpenAI Agents SDK — Tracing records model generations, tool calls, handoffs, guardrails and custom events, and sensitive payload capture can be disabled. source
- [S6] REST Security Cheat Sheet — OWASP REST guidance emphasizes HTTPS, explicit access control and careful handling of tokens, methods, inputs and security headers. source
- [S7] Content-Security-Policy: require-trusted-types-for directive — require-trusted-types-for can make DOM XSS sinks reject raw strings and accept trusted typed values instead. source
- [S8] RFC 9700: Best Current Practice for OAuth 2.0 Security — RFC 9700 updates OAuth 2.0 security practice, including exact redirect URI matching and avoiding open redirectors and insecure legacy patterns. source
- [S9] Web Authentication Level 3 — WebAuthn Level 3 defines strong public-key credentials scoped to relying parties and reached Candidate Recommendation Snapshot status in May 2026. source
- [S10] SLSA specification v1.2 — SLSA 1.2 organizes supply-chain assurances into tracks and levels with recommended attestation formats. source
Comments
No published comment yet.
Sign in to comment