Threat Model for Agents With Write Access

The land-records cell wanted the agent to 'help the patwari'. Help, in the integration diagram, was an API that could insert a remark. The remark field was not a comment. In that district it was how a mutation moved. Nobody had written a threat model for a next-token predictor that could move a mutation. They had written a chatbot policy.

Write access is the line. Retrieval can embarrass you. Write can transfer a right, a rupee, or a record that a court will later treat as the department's act. If you cannot draw the blast radius of one successful tool call, you do not have an agent programme. You have a hope.

This is a field guide for CIOs and CISOs dated 17 August 2026. It is not a CERT-In circular and not legal advice. CERT-In's 28 April 2022 directions already expect specified incidents to be reported within six hours and specified logs to be kept 180 days in India. They do not give you an 'AI write-access' template. You still have to think.

Prcept AI will run agents on your rack. We still refuse payment and register writes unless a competent human is on the tool. That is a product choice. Your file needs the same sentence even if you never speak to us.

Name the machine, not the demo

An agent with tools is four things: a model that proposes, a planner that chooses a tool, a connector that holds a credential, and a system of record that believes the connector. Threat-model all four. A pretty chat window is furniture.

Write the identity the connector uses. If it is a shared service account with the same rights as a deputy director, the agent is a deputy director who never sleeps and cannot be prosecuted. That sentence belongs in the file.

Write the data classes the tool can read and write. Personal data under DPDP, payment data, land, examination marks, medical. The class changes the blast radius and the incident story you will later tell.

The four questions that are the model

Who is it? Human users, service identity, vendor engineers, and any other agent that can invoke it.

What can it touch? List tools as verbs: read circular, draft noting, update remark, create ticket, send SMS, call payment. Verbs, not product names.

What happens when it is wrong or owned? One injected prompt, one stolen token, one insider. Name the worst record that can change.

Who can revoke it at 2 a.m.? If the answer is 'raise a ticket with the SI', you have already lost the night.

Minimum rows for a write-capable agent. If a cell is theatre, the tool stays off.

Row	Good answer	Fail
Identity	Named service account, no interactive login, scoped to one register	Borrowed officer SSO
Verb	insert_draft only; publish requires human OTP	update_* on the production schema
Approval	DFPR-competent click in the system of record	Thumbs-up in the chat
Blast radius	One application ID per call, rate 10/hour	Bulk endpoint, no cap
Revocation	CISO break-glass disables the client_id in five minutes	Vendor change window Tuesday
Evidence	Tool, actor, record id, before/after hash, in SDC logs	Chat transcript only

STRIDE without the cosplay

You do not need a new religion. Spoofing is a stolen connector token. Tampering is a poisoned RAG chunk that says 'always approve'. Repudiation is a missing before/after hash. Information disclosure is a tool that returns another citizen's file because the filter was in the prompt, not in the query. Denial of service is a loop that writes until the register locks. Elevation is the agent calling a second tool it was shown in a help string.

Prompt injection is how several of those arrive. It is not a separate universe. Treat the retrieved document and the citizen's paste as hostile. The companion teardown on citizen-facing injection is the tactic; this page is the write-surface consequence.

OWASP's LLM work and NIST's adversarial-ML language are useful vocabularies. They are not Indian law. Do not paste them into a standing order as if they were a Gazette. Use them to make sure you did not forget a verb.

Default deny writes

The only safe default is that the agent cannot write. Every write verb is an exception with an owner, a rate, a blast radius, and a revocation test. If a vendor's reference architecture lights up six verbs on day one, it is a sales architecture.

Prefer draft objects the officer publishes. Prefer tickets the officer assigns. Prefer SMS the officer sends. If you must let the machine write, write to a quarantine table, not to the register the court will read.

Air-gap does not change this. An air-gapped agent with a fat service account is an insider amplifier. The air-gap article in this cluster exists because people keep using the gap as a sedative.

• No write tool in a pilot that has not passed a tabletop.
• No bulk endpoint on an agent identity.
• No payment, mutation, mark-change or speaking-order verb without a competent human in the system of record.
• No second hop. The agent does not get a tool that gets a tool.

When it becomes an incident

If a write tool is abused, you may have a cyber incident in the sense of CERT-In's existing Annexure I categories — unauthorised access, data leak, targeted attack on an application — depending on facts. Map the facts to the live annexure. Do not invent an 'AI incident type' code that CERT-In has not published.

The six-hour clock runs from noticing or being brought to notice, for incidents that are in scope. Your runbook should say who decides that a rogue tool call is in scope. Waiting for a perfect classification is how you miss the clock.

Keep the tool logs. 180 days in India is the floor for specified ICT logs, not the whole administrative file. Before/after hashes belong in the departmental record schedule as well.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Without write tools the agent is just search.

Yes. Search is often the product you should have bought. Write is a separate programme with a separate model.

The vendor sandboxes the tool.

Sandbox is a word. Ask to call the tool from a hostile prompt on staging and show the deny. If they will not, the sandbox is a slide.

We will threat-model after the pilot.

Then the pilot has no write tools. A pilot with production verbs is production.

STRIDE is too heavy for a chatbot.

Then you do not have a chatbot. You have a writer. Four questions and the table are enough. The acronym is optional. The verbs are not.

A twelve-day write-access threat model

Do this before the connector is issued a secret. Secrets are how diagrams become incidents.

1. Day 1–2: inventory verbs. Strike any verb that is not needed for the unit of work.
2. Day 3–4: name identities. Kill shared officer credentials for tools.
3. Day 5–6: draw blast radius per verb. If you cannot, the verb is off.
4. Day 7–8: write the four questions on one page. CISO signs or vetoes.
5. Day 9–10: tabletop one injection and one insider. Time the revoke.
6. Day 11: map a successful abuse to CERT-In Annexure I language without inventing codes. Name the six-hour owner.
7. Day 12: only then issue the scoped secret. Store it in the secrets system, not in the prompt.

How this shows up in the file

Subject: Threat model — agent [name] — write verbs.

This agent is permitted the following verbs: [list]. Identity: [service account]. Blast radius: [one record / rate]. Approval: [human in system of record / none because draft-only]. Revocation owner: [post], tested on [date], [n] minutes. Evidence: tool, actor, record, before/after, retained in [store] for 180 days plus the record schedule. CERT-In mapping will use existing Annexure I categories; no invented AI incident code will be filed. This note is not legal advice.

Any new verb is a change request, not a prompt edit.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Threat Model for Agents With Write Access” is a path problem. A P1 CIO/CTO should be able to name the tool, the identity, the secret and the egress that would make “AI agent threat model” real. If the only control is a network diagram from last year, you have a story, not a threat model.

A read-only retrieval box and an agent that can update a register are different machines. Write down who it is, what it can touch, what happens when it is wrong, and who can revoke it. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Threat Model for Agents With Write Access” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI agent threat model” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.