1. Describe the system
Provide architecture, trust boundaries, data types, users, and important business constraints.
2. Review suggested threats
BlackShield organizes likely spoofing, tampering, disclosure, denial-of-service, and privilege risks for human review.
3. Assign mitigations
Record owners and practical controls. Require approval before sensitive AI-assisted actions are used.
4. Retain the evidence
Export the approved report to the Security Review so the decision and its context remain tenant-scoped.
Before you start
Remove secrets from prompts, confirm the AI Gateway policy for your workspace, and name the person who will approve the final model.