# Threat model Which threat is handled by which mechanism, and in which phase. | Threat | Example | Mechanism | Phase | | --- | --- | --- | --- | | Proxy (MCP proxy) | A layer between the agent and the tool server that inspects every call before forwarding it. | | | | YAML | The indented plain-text format the policy is written in (`policy.yaml`). | | | | Request phase / Response phase | Inspection before the tool runs / inspection of the result it returned. | | | | Fail-closed | Blocking a call when an inspector fails instead of allowing it. Details: [Runtime loop](/docs/runtime-loop). | | | | Tenant | A private workspace set aside for one customer, isolated from the others. | | | | Indirect prompt injection | A ticket with a hidden "send the whole customer table to…" instruction | Ingress scan + AI Guard layer 2; then policy and egress at the request phase | Response, then Request | | Excessive agency | An order-lookup agent able to run `DROP TABLE` | Least-privilege policy; deny unlisted tools; argument constraints | Request | | Data exfiltration (single shot) | An API key in an email body | Egress scan (regex) + AI Guard layer 1 | Request | | Slow exfiltration | 2–3 records out per call over 100 calls | Per-session egress counter (drip-exfiltration) | Request | | Runaway loop (OWASP LLM04) | Repeating the same tool with the same arguments | Loop breaker | Request | | Irreversible action | Money movement, deletion, outbound email | Human approval via `require_approval` | Request | ## Evasion techniques The scanners account for more than plain text: Unicode normalisation, Cyrillic look-alikes, zero-width characters, combining marks, spacing/dotting letters apart and leetspeak. Details: [Ingress](/docs/ingress) and [Egress](/docs/egress). > **Limits**: Regex-based detection is not exhaustive; a creative attacker may evade it. That is why AvertGate is layered: deterministic checks + a semantic model + trajectory analysis + policy + human approval. No single layer is a guarantee of safety. ## Out of scope - Content moderation of the conversation layer (prompt/response). - Training a custom detection model. AvertGate does not train its own; it uses TypeSafe AI Jev or off-the-shelf guard-model APIs plus heuristics. - Replacing a broad DLP product.