The TIDIR Assurance Case Map & Architecture Graph

Tier 1: Strategic Architecture · Audience: Security Architects, Regulators, Researchers · Normative Status: Normative Reference
Purpose: Provides full bi-directional traceability from adversarial threats to constitutional invariants, capabilities, and empirical validation evidence.

---

Architecture as a Connected Graph

In modern security architecture, declaring principles is insufficient without demonstrating how those principles resist active adversary subversion. The TIDIR Assurance Case establishes an explicit, machine-traceable relationship between identified threats against the defence system itself and the deterministic controls that preserve system integrity:

$$\text{Adversarial Threat}⟶\text{Invariant}⟶\text{Capability}⟶\text{Architectural Control}⟶\text{ADR}⟶\text{Validation Evidence}$$

---

Bi-Directional Assurance Matrix

The table below maps each adversarial threat to its governing invariant, underpinning capabilities, deterministic control mechanism, and concrete empirical verification test:

Threat ID & Name	Governing Invariant	Underpinning Capabilities	Architectural Control Mechanism	Governing ADR	Validation Method & Acceptance Criteria
THR-T1: Sensor Evasion / Log Blinding	INV-01 (Telemetry Preservation) INV-08 (Degraded Defence)	DATA-01 RESIL-01 RESIL-02	Local NVMe ring buffering, direct-to-object lakehouse bypass, out-of-band audit beats.	ADR-0021	Bus partition chaos test: zero dropped records during 24h simulated network isolation.
THR-T2: Schema Poisoning / DoS Inundation	INV-01 (Telemetry Preservation) INV-11 (Operational Portability)	DATA-02 DATA-03	Line-rate OCSF compiler validation, structured unmapped_data catch-all, isolated DLQ quarantine.	ADR-0002	Synthetic fuzzing suite: malformed JSON and corrupted payloads diverted to DLQ with zero parser crashes.
THR-T3: Evidence Tampering / Audit Destruction	INV-02 (Evidence Traceability) INV-10 (Reconstructability)	CAP-INV-04 RESIL-05	Immutable WORM object storage, RFC 3161 cryptographic timestamps, append-only Incident Decision DAG.	ADR-0001 ADR-0010	Cryptographic verification audit: mathematical non-repudiation and Merkle root verification over sealed dossiers.
THR-T4: Indirect Prompt Injection / Cognitive Hijack	INV-04 (Authority Separation) INV-05 (Least Capability)	CAP-INV-05 AIGOV-02 AIGOV-06	Agent Trust Boundary (dual-plane data/control isolator), read-only tools, ephemeral SPIFFE SVIDs ( $\le 15\text{m}$ , max 15 minutes).	ADR-0004 ADR-0015	Continuous Evals-as-Code: prompt injection benchmark achieving zero unauthorised tool invocations across test corpus.
THR-T5: Alert Storm Denial of Service / Desensitisation	INV-03 (Evidential Independence) INV-06 (Bounded Autonomy)	DET-04 DET-05 DET-06	Dependency-aware risk compounding, supernode graph dampening, monthly SRE Alert Noise Error Budgets.	ADR-0003 ADR-0008 ADR-0009	Historical lakehouse backtesting: $\ge 75\mathrm{\%}$ reduction in alert volume with noise budget false-positive rate $\le 5\mathrm{\%}$ .
THR-T6: Automated Response Sabotage / Outage Trigger	INV-07 (Security-State Monotonicity) INV-09 (Human Recoverability)	RESP-01 RESP-02 RESP-04 RESIL-05	Monotonic state machine ( $s_{n+1}⪯s_n$ , where post-transition reachability is a subset of pre-transition reachability), pre-execution blast-radius scoring, master cryptographic E-Stop.	ADR-0005	Containment failure fault injection: verified forward perimeter escalation with zero security-state rollback.

---

Machine-Readable Model Access

The complete relationship graph is compiled deterministically during documentation build and exposed as standard JSON for automated agent retrieval and CI conformance testing:

• 📡 Machine-Readable Graph Endpoint: /architecture.json
• 📄 Complete LLM Corpus: /llms-full.txt
• 📋 Curated LLM Summary: /llms.txt