Field notes
Threat walkthroughs before the identity provider is wired
— A half-day map of trust boundaries beats weeks of rewriting role checks after go-live.
Architecture threat walkthroughs earn their keep when teams are about to connect a new identity provider, payments rail, or partner data feed. Once tokens and service accounts exist in production shapes, changing trust boundaries becomes expensive.
What we put on the whiteboard
- Actors: end users, support, partners, batch jobs, break-glass admins
- Tokens and secrets: where they live, how they rotate, who can mint them
- Failure modes: provider outage, clock skew, revoked clients still cached
- Data crossing trust boundaries: PII, payment references, internal IDs
Outcome
You leave with annotated boundaries and a short list of controls that must exist in the first release. That list later becomes intake material for a secure code review — reviewers already know where to look.
If your diagrams are messy, bring them anyway. Messy diagrams reveal assumptions faster than polished slides.