Mapping Trust Boundaries
Map the actors and systems that exchange data before selecting controls. A boundary may exist between a browser and an API, between two services, or between an application and its data store.
Questions to ask
- Who controls the data before it reaches this component?
- What identity information is available at the boundary?
- Which authorization decision protects the next operation?