A successful happy-path demonstration says little about who can trigger an action or where sensitive data may travel. In a proposed Thora Vietnam automation, AI can help organize a threat review, but the review must stay grounded in the actual design. The output should be a set of concrete questions, decisions and checks that a person can verify.
Draw the data and access boundaries
Describe where input comes from, where it is stored, which external providers receive it and who can read the output. Include background jobs and logs. Mark the point where an untrusted request enters a trusted part of the system.
Use redacted or synthetic examples while discussing the design with an assistant. A diagram should not require sharing production credentials or customer records.
Ask about misuse of the actual workflow
For a request-and-approval tool, ask what happens if someone changes a request identifier, repeats an approved action or supplies instructions inside uploaded content. The assistant should tie each concern to a component and a data flow. Treat its list as review input rather than a complete security assessment.
Do not assume that a hidden button, an obscure URL or a model instruction enforces authorization.
Turn a concern into a testable requirement
Write a specific response for each important concern. An authorization requirement might say that the server checks the signed-in user’s access to the requested record on every read and write. A delivery requirement might prevent a repeated request from sending the same message twice.
Attach a check that would expose failure. Testing a rejected cross-user request is more useful than a checklist item that merely says access control exists.
Review again when the boundary changes
Adding a provider, enabling autonomous delivery or exposing an internal tool publicly changes the threat picture. Keep the model with the architecture and revisit it when those changes happen. For a first pilot, record the risks that remain open and keep the relevant action supervised until there is a reviewed response.
Further reading
Background for the method; the Thora Vietnam workflow above is a proposed application.
OWASP — Threat Modeling Cheat Sheet
