{ "schema": "aiblocks-page/1", "id": "agency-security-architect", "type": "agent", "name": "Security architect agent", "summary": "Describe your system. Get trust boundaries, a ranked STRIDE threat table and the security controls to fix first, before you write a line of code.", "headline": "Security architect agent", "subhead": "Describe your system's architecture, data and every way in. It maps where trust changes hands, finds how each crossing could be attacked, and hands back a ranked list of fixes with its assumptions marked.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "source_text", "required": false, "label": "Source text", "what": "a long source in full: an article, a video or talk transcript, or notes from a book, with its title, author and link" } ], "outputs": [ { "type": "audit_report", "required": true, "label": "Audit report", "what": "findings with evidence, severity, missing inputs and next actions" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "Your system's architecture (monolith, microservices or serverless), and its languages, frameworks, databases and cloud provider.", "What data it handles and how sensitive it is, such as passwords, payment details or health records.", "Every way in: public APIs, admin panels, mobile apps, third-party integrations, internal service calls.", "Any controls you already have, such as login checks, encryption or a firewall (optional).", "An architecture diagram or design doc (optional)." ], "you_get": [ "A trust boundary table: where control passes between a user, a service or a third party, and what protects that crossing today.", "A ranked STRIDE threat table: each risk that applies, the component it hits, an attack scenario, and the proposed fix.", "An attack surface list, split into external, internal, data and infrastructure entry points.", "A control list in priority order, each sized small, medium or large.", "The assumptions it made and what you should confirm before you trust the result." ], "use_when": [ "You're designing a new service, API or feature and want the security gaps found before you build.", "You inherited a system with no written threat model and need one for a review or a customer's security questionnaire.", "You added an integration, such as a payment processor or a login provider, and want to know what trust boundary it creates.", "A customer or investor asks how your system defends itself and you have nothing written down." ], "skip_when": [ "You have an active breach or suspicious activity right now. Use the Security incident responder and call your security lead first.", "You want your code scanned for bugs like SQL injection or broken access control. Use the Application security reviewer.", "You need a SOC 2, ISO 27001, HIPAA or PCI-DSS gap check. Use the Compliance Auditor agent." ], "output_sample": { "input": [ "Your system's architecture, tech stack and data types", "Every way in, including internal and third-party ones", "Controls you already have (optional)", "An architecture diagram (optional)" ], "prerequisites": [ "An AI that can read files, if you attach a diagram" ], "output": [ { "name": "Trust boundaries", "contains": "Every place control passes between a user, a service or a third party, and what protects it today." }, { "name": "STRIDE threats", "contains": "Each risk that applies, the component it hits, an attack scenario and the proposed fix, ranked by severity." }, { "name": "Attack surface", "contains": "Every external, internal, data and infrastructure entry point found." }, { "name": "Control proposals", "contains": "A priority-ordered fix list, each sized small, medium or large." }, { "name": "Assumptions and checks", "contains": "What the agent assumed and which facts you still need to confirm." } ] }, "output_shape": "TRUST BOUNDARIES\n | | | \n\nSTRIDE THREATS (ranked)\n | | | | \n\nATTACK SURFACE\n External: \n Internal: \n Data: \n Infrastructure: \n\nCONTROL PROPOSALS (in order)\n | | \n\nASSUMPTIONS AND CHECKS STILL NEEDED\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.", "Describe your system: architecture, tech stack, data types, and every way in, including internal and third-party ones.", "List any controls you already have, and attach a diagram if you have one.", "Say \"Build the threat model. Score each threat and tell me what you assumed.\"", "Read the trust boundary table first. If a boundary is wrong, fix that before trusting the risks listed under it.", "Hand the ranked control list to whoever owns each fix, most urgent first." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Security audit evidence reviewer", "url": "https://useaiblocks.com/skills/copilot-audit-integrity", "why": "Security audit evidence reviewer" }, { "name": "ISO 27001 audit planner", "url": "https://useaiblocks.com/skills/iso-27001-audit-planner", "why": "ISO 27001 audit planner" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-architect.md", "licence": "MIT", "original_name": "Security Architect", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Security Architect", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-architect.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-architect", "markdown": "https://useaiblocks.com/agents/agency-security-architect.md", "json": "https://useaiblocks.com/agents/agency-security-architect.json", "instructions": "https://useaiblocks.com/skills/agency-security-architect/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-architect.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-architect", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-architect", "mcp": "https://useaiblocks.com/mcp" } }