Prerequisites
Give the reader the minimum software-system vocabulary needed to trace an agent. Do not reteach large language models.
Follow the chapters in order. Each one combines a clear explanation, local illustrations, traceable sources, and runnable examples where code helps.
Module Overview & Outcomes
Section titled “Module Overview & Outcomes”Working familiarity with large language models and prompts. No programming or API experience is required.
The reader can read a component diagram, distinguish data from instructions, follow an HTTP and JSON exchange, identify a process and trust boundary, and interpret identity, permission, event, state, and side effect.
Required Concepts & Scope
Section titled “Required Concepts & Scope”Start with the project system map. Then teach data flow versus control flow, processes and network calls, structured messages, state transitions, identities, permissions, and trust boundaries. End with the notation reused in later diagrams.
Published chapters in this section
Section titled “Published chapters in this section”Reader contract and system map
Establishes the system vocabulary and diagram notation used to trace an agent safely.
- Trace a request through a process, a store, and an external service.
- Distinguish data flow, control flow, state, events, identity, authority, and side effects.
- Read the system-context and state-transition notation reused in later chapters.
Data, control, and trust boundaries
Separates information from instructions and shows where a system must reconsider its assumptions.
- Distinguish data from control in one structured message.
- Trace data flow and control flow through a simple application.
- Mark a trust boundary and name the assumption that changes there.
Requests, events, state, and side effects
Explains how a requested action, remembered state, event record, and outside-world result describe different parts of one workflow.
- Distinguish a request from an event in a simple workflow.
- Trace a state transition from its old state to its next state.
- Identify a side effect without mistaking it for proof of completion.
Identity, authority, and least privilege primer
Explains identity, delegation, authority, and least privilege in multi-actor software workflows.
- Distinguish an actor's identity from the authority granted to perform an action.
- Explain delegation when an agent acts on behalf of a user while maintaining distinct identities.
- Apply the principle of least privilege to limit what an agent or tool can access.
Security & Threat Model Connections (Pass 2 Preview)
Section titled “Security & Threat Model Connections (Pass 2 Preview)”Provide vocabulary used by the threat model, especially assets, actors, authority, boundaries, and side effects.