Security¶

Security posture of AI PDLC harnesses as a class: what the flagship disclosure (Freshworks) reveals about agent governance and access control, plus a threat model valid for any instance of the pattern (Spec Kit chains, Kiro projects, internal Prism-equivalents) — the dimension most writeups illuminate only indirectly.

Analysis Vs. Disclosure

Freshworks' writeup discloses that agents are "governed," never how. Everything in the Governance-As-Disclosed section is sourced [F]; the Threat Model section is our analytical extension for anyone replicating this pattern [A]. Internal controls that would confirm or refute assumptions are marked [TBD].

Identity And Access Flow¶

Identifiable actors and channels, as reconstructed from the disclosure:

flowchart LR
    B["Builder<br/>PM/Designer/Engineer"] -->|"editor account"| CUR["Cursor"]
    CUR -->|"harness runtime,<br/>model API keys [TBD]"| M["Any-model endpoint<br/>(demoed: Grok)"]
    PH["Phase Agents"] -->|"reads"| MONO["Monorepo<br/>(source of truth)"]
    PH -->|"generated SQL"| BEL["Bel<br/>Databricks usage lake<br/>(75k customers' telemetry)"]
    PRISM["Prism hubs"] -->|"context/rules"| PH
    GATE["CPO Check gate<br/>(human)"] -->|"approves"| FIG["Figma Make"]
    FIG -->|"prototype"| EV["Evals"]

    classDef actor fill:#e8f0fe,stroke:#1a73e8,color:#174ea6
    classDef store fill:#fef7e0,stroke:#f9ab00,color:#7c5000
    classDef flow fill:#f3e8fd,stroke:#a142f4,color:#6a1da8
    classDef control fill:#fce8e6,stroke:#d93025,color:#a50e0e
    class B,GATE actor
    class MONO,BEL,PRISM store
    class CUR,M,PH,FIG,EV flow
    class GATE control

Edge	Authentication basis	Disclosed?
Builder → Cursor	Personal/workspace editor account	Implied [F]
Cursor → model APIs	Managed keys; key custody, per-team budgets [TBD]	—
Agents → monorepo	Repo ACLs presumably [TBD]	—
Agents → Bel	Undisclosed service credential; principle-of-least-scope strongly implied by "you can't afford a hallucination" framing	Scope/RBAC detail [TBD]
Human gate → Figma Make	Enterprise SSO typical [TBD]	—

Governance As Disclosed¶

Four concrete control surfaces appear in the narrative, despite light detail:

"Governed AI agent" inside each phase — the writeup's exact term. Mechanism unstated [TBD]; plausible surfaces include the artifact library's rules (explicit written coding standards feeding rule files) and Prism's context hub enforcing phase-appropriate visibility.
Requirements interrogation gate — the agent pauses generation to ask PM-grade questions. Functions as an input-validation control: underspecified requests get bounced back upstream instead of surfacing later as defects.
CPO Check — an executive-review persona encoded as a mandatory pipeline step before prototypes ship. Functionally human-in-the-loop authorization over PRD-level decisions.
Evals phase — terminal automated gate gating the release train itself; the one control that scales without reviewer hours.

Known limits admitted in-source: design-system components were silently skipped by the prototyping step — caught by humans, positioned explicitly as the residual manual layer ("those are the places where humans still have a role").

Access Control Observations¶

Warehouse blast radius is the crown-jewel question. Agent-authored SQL ran against a lake spanning usage telemetry from all 75,000 customers in a demo context. Whether that read path is row-scoped per analyst/business-unit in production is undisclosed [TBD]; the replication playbook recommends role-scoped, read-only grants regardless (see operations step 7).
Single-repo source of truth concentrates write access. Convenient for agents, hazardous without branch protection + signed-commit hygiene [A].
Artifact library is an implicit privilege store. Whoever edits rules/commands shapes agent behavior org-wide; write access there deserves review rigor normally reserved for infrastructure code [A].

Threat Model¶

[A] Analytical model for this harness class, calibrated to the disclosed failures. (Residual risks acknowledged even under best-case versions of the [TBD] items.)

ID	Threat	Vector	Impact	Disclosed Mitigations	Recommended Additions
T1	Prompt injection via ingested data	Malicious/negligent strings inside Bel telemetry (customer-authored tickets!) enter agent context and steer SQL/PRD outputs	Contaminated requirements reasoning; silent policy violation in generated artifacts	Requirements interrogation; evals; human gate (partial, indirect)	Treat warehouse-derived text as untrusted input: scrub/quarantine fields; constrain SQL via allow-listed views; assert-run contracts in eval suites
T2	Over-broad data reachability	Agent-written SQL joins across tenants/product lines by accident	Cross-customer data bleed into an internal document, then into prototypes	None stated	Per-business-unit read roles; column-level masking on identifying fields; query logging with anomaly alerts
T3	Artifact poisoning / rot	Stale or maliciously edited rule/skill files steer every downstream phase simultaneously	Org-wide behavior corruption — a single bad `rules` edit outlives audits of any one generated artifact	Explicit written standards (provenance clarity only)	Versioned artifact library with mandatory reviewed merges; periodic attestation that each active artifact maps to an owner and rationale
T4	Silent generator omission	Design-system components skipped during prototyping	Defective UX reaches evals unchecked if eval coverage mirrors the same blind spot	Humans catch residual errors (stated)	Independent component-parity diff between prototype and token registry; eval assertions enumerated from the design system, not from the prompt
T5	Source-code and strategy egress	Model-agnostic harness ships monorepo context to whichever external model endpoint is fastest	Proprietary roadmap/code transits third-party infrastructure by default	Vendor choice autonomy treated as feature, not control	Provider agreements aligned with enterprise posture; consider Zero Data Retention arrangements for training-side retention; classify which repo subtrees may ever leave the boundary
T6	Gate-keying to individuals	"CPO check" encodes one executive's judgment patterns	Leadership churn weakens authorization without anything formally changing	None stated	Role-owned written gate criteria; quarterly calibration sessions replacing single-reviewer dependence

Encryption And Data Handling¶

Transport encryption rests with vendors (Cursor workspace sync, model endpoints, Figma Make, Databricks) — industry-standard TLS presumed, vendor attestations unexamined here [TBD].
Field-level protection inside Bel for customer-identifying telemetry is undisclosed [TBD]; treat as unverified in any replication plan.
Prompt/context payloads — often overlooked — mirror the sensitivity of whatever they quote: assume prompts replay privileged snippets unless the above controls exist [A].

Residual Risk Statement¶

Even granting every undisclosed control its best plausible form, three residuals follow from disclosed design choices themselves: (1) the deliberate model-vendor agnosticism widens the egress surface permanently (T5); (2) single-pass automated evals cannot certify what their own coverage language doesn't enumerate (T4); (3) human-gate effectiveness is bounded by reviewer attention at 2-week cadence. These accept the efficiency thesis knowingly — the same trade any org adopting this pattern makes.