# TEACH Security, Privacy, and Threat Model

**Product ID:** `nurse-educator-instructional-designer-mission-control`  
**Route:** `/nurse-educators-designers/dashboard`  
**Canonical program:** `NAIO-NEID-COMPLETE-TEACH-1.0`  
**Required records:** 216 build controls + 48 cross-cutting scenarios + 169 canonical checks = 433

## Scope and security claim boundary

This document defines security requirements for the downloadable local `TEACH — Nurse Educator & Instructional Designer Mission Control` target. It is a threat model and release checklist, not proof that any control is implemented.

The base target is a loopback-only, single-owner application. It is not a student-record processor, LMS, gradebook, secure assessment platform, clinical system, multi-user institutional service, or external action engine. Direct learner/assessment payloads, PHI, live care, secure item banks, and person-level institutional records are prohibited even if the user calls them redacted or deidentified.

Security readiness requires executed evidence against the final packaged artifact. A framework feature, configuration file, policy statement, development server, or test double does not prove the control.

The exact adapters are **Nurse Educator**, **Instructional Designer**, and **Hybrid or Faculty Developer**. The exact workspaces are **Life, Capacity & Career**; **Teaching, Learning Design & Accessibility**; **Assessment, Feedback & Learner Support**; **Clinical, Skills-Lab & Simulation**; and **Curriculum, Program Evaluation, Scholarship & Faculty Development**.

Every consequential artifact uses: `Exploration → Simulation → Recommendation → Draft Artifact → Approved Plan (human scope review only) → Authorized Execution (external human/official-system only; no app action) → Completed Action (verified external reference only) → Evaluated Outcome`.

## 1. Protected assets

- local owner credential verifier and authenticated session;
- owner-approved Mission Profile fields and provenance, never raw Soul Quiz answers or raw `SOUL.md`;
- private life, capacity, career, and professional-development records;
- non-person teaching/design artifacts and permitted institutional content;
- exact approved aggregate metadata and values under `TEACH-DATA-A`;
- official-system opaque references under `TEACH-DATA-R`;
- sources, rights/licenses, claim mappings, corrections, and expiry;
- missions, artifacts, human reviews, capability evidence, and agent receipts;
- institutional bind, role/hat, policy, authority, retention, and release-owner receipts;
- AI-provider credentials and backend configuration;
- backups, exports, migrations, release manifests, checksums, and update packages; and
- integrity of EDENA, `absolute_stop`, TEACH Gate, permission, lifecycle, Pause/Kill, and audit state.

## 2. Adversaries and failure actors

Consider:

- an unauthenticated local process or browser page reaching the loopback service;
- another local user on a shared device;
- a malicious or compromised dependency, update, archive, file, link, web source, model, provider, plug-in, connector, or tool;
- prompt injection inside course material, policy, source text, simulated learner work, generated output, or imported configuration;
- an authenticated owner making a classification mistake or attempting to bypass a boundary;
- stale, excessive, mistaken, or revoked institutional authority;
- accidental cross-institution, cross-course, cross-workspace, private/institutional, or backup leakage;
- hallucinated sources, rights, approvals, accessibility claims, grades, learner interpretations, or completion state;
- background/abandoned agent work after cancellation or browser closure;
- filesystem corruption, interrupted migration, partial update, restore error, or uninstall orphan; and
- a developer leaving placeholder controls, fake streaming, default credentials, debug endpoints, or test secrets in the release.

## 3. Trust boundaries

```text
untrusted browser / imported content / retrieved content / model output
                              │
                              ▼
authenticated same-origin loopback server
  ├── data admission and schema boundary
  ├── identity/role/hat/workspace/context authorization boundary
  ├── EDENA + absolute_stop + TEACH Gate boundary
  ├── repository boundary
  │    ├── private owner store
  │    └── one isolated store per institutional bind
  ├── AI/agent/tool egress boundary
  └── export/backup/update/recovery boundary
```

The browser, model, tool result, retrieved page, and user-supplied label are never authoritative. Client-side validation improves usability but does not enforce policy. Revalidate on the server at every trust boundary and mutation.

## 4. Closed data-class enforcement

The server must implement the closed classes defined in governance:

- `TEACH-DATA-0` public authoritative nonsensitive;
- `TEACH-DATA-1` synthetic/fictitious;
- `TEACH-DATA-2` owner-authored nonsensitive private;
- `TEACH-DATA-M` minimum institutional routing metadata;
- `TEACH-DATA-C` exact approved non-person course/curriculum content;
- `TEACH-DATA-A` exact approved aggregate created outside TEACH;
- `TEACH-DATA-R` opaque official-system reference only; and
- `TEACH-DATA-X` prohibited/unclassified.

The base application has no direct learner-record class. Learner submissions, grades, evaluations, advising/support notes, accommodations, complaints, conduct/integrity records, clinical evaluations, identifiers, messages, secure items/answers, or other learner payloads are `TEACH-DATA-X`.

### Required admission sequence

1. Apply transport and byte-size limits before parsing.
2. Reject malformed content, active content, archive bombs, path traversal, unsafe media, unknown schemas, and unknown fields.
3. Screen for prohibited data before logs, persistence, search, indexing, embeddings, memory, model context, analytics, backup, export, badge, or agent use.
4. Verify—not trust—claims such as public, approved, synthetic, redacted, anonymous, deidentified, aggregate, course material, or authorized.
5. Validate role/hat, workspace, deployment context, institution/course/project, purpose, source/rights, retention, and current authority.
6. Apply EDENA, independent `absolute_stop`, and TEACH Gate.
7. Persist or forward only explicitly permitted fields.
8. Record a minimum content-free decision receipt.

On rejection, do not echo, quote, summarize, transform, retain a reversible hash, or carry the body into a clean sandbox.

## 5. Threats, controls, and release evidence

| Threat | Required control | Required evidence |
|---|---|---|
| Loopback service reachable from other hosts | Bind to `127.0.0.1`/`::1` only; validate Host and Origin; refuse wildcard binding; firewall-independent test | Packaged positive/negative bind tests from local and nonlocal interfaces |
| Default or weak authentication | User-chosen credential, slow salted verifier, no default password, login rate limiting, lockout/backoff without account disclosure | Clean-install auth tests and verifier inspection |
| Session theft/fixation | Opaque server-side session, Secure/HttpOnly/SameSite where applicable, rotation, idle/absolute expiry, revocation current/all | Session lifecycle and stolen/replayed-token tests |
| CSRF/cross-origin mutation | Same-origin API, CSRF token, Origin/Host validation, non-GET mutations, content-type checks | Browser/API negative tests |
| Secret exposure | Provider secrets server-side only; redaction in logs/errors; no browser storage, URL, bundle, export, backup, telemetry, source, or support bundle | Static scans, runtime tests, release archive inspection |
| Data-class bypass | Server admission service on every input/import/retrieval/model/tool/export path; unknown fails closed | Full boundary matrix including aliases and encoded variants |
| Learner-record ingestion | No payload schema/table/route; `TEACH-DATA-R` strict opaque shape; body rejection before persistence/AI | Submission/grade/accommodation/conduct/secure-item fixtures proving zero payload retention |
| PHI/live-care ingestion | Pre-persistence patient/quasi-identifier and live-care guard; no-echo stop and human route | PHI, rare-combination, screenshot/OCR, medication/device/live-care negative tests |
| “Deidentified” reidentification | Exact aggregate-only institutional evidence; denominator/missingness/small-cell/suppression controls; reject rows/narratives | Row/person/small-cell/rare-combination and mislabeled-data tests |
| Cross-context leakage | Separate database per institutional workspace; context nonce; repository handle closure; no cross-store queries/indexes/backups | Cross-owner/institution/course/project/workspace search, API, AI, export, backup tests |
| Private-life institutional leakage | Separate private store; exclusion from institutional views, badges, agent defaults, analytics, and exports | Field-level leakage tests and institutional export inspection |
| Prompt injection | Treat imported/retrieved/source/model/tool content as data; system policy and deterministic routing outside model | Injection fixtures in files, HTML, source text, simulated learner work, tool output |
| Model hallucination/fake evidence | Source allowlist, claim-source mapping, exact retrieval events, conflict/expiry, no source from model memory | Invented/unopened/stale/conflicting citation tests |
| Rights/copyright error | Owner/license/terms/attribution/transformation/expiry fields; no fair-use or legal sufficiency declaration | Restricted/OER/generated-media fixtures and human-review gate |
| Accessibility overclaim | Draft checks plus manual/assistive-technology verification; no compliance/accommodation certification | Keyboard, screen-reader, zoom, contrast, captions, alt, reduced-motion, print/mobile tests |
| Authority inflation | Exact adapter/hat/task/context receipts; least privilege; unknown/expired authority blocks | Adapter and task-hat negative tests; expired/revoked bind tests |
| Autonomous grade or learner decision | No learner payload, no decision route, external-only lifecycle, P4 absent | Attempts to grade, progress, discipline, accommodate, clear, contact, or post all blocked |
| Learner profiling/surveillance | No person analytics; block ranking, risk scores, emotion/sentiment, trait/motivation/honesty/future-success inference | Adversarial prompts and API tests with zero person record creation |
| AI-detection misuse | No learner-specific detector ingestion or result field; never evidence or finding | Detector-score fixtures refused and absent from evidence ledger |
| External/official write | No connector/destination/action implementation; P4 absent; action preview is informational | Route/code/static scans and attempted LMS/email/gradebook/publication writes |
| Agent permission expansion | P0 default; P1/P2 exact expiring charter; deterministic policy; one invocation; no recursion/hidden retry | Transition, expiry, replay, self-activation, delegation, recursion and tool-mismatch tests |
| Abandoned agent work | Server-side cancellation, timeout, Stop/Kill, process reconciliation, temporary-state purge, token revocation | Disconnect/cancel/kill/timeout/orphan tests with truthful receipts |
| Fake streaming or connection | Authenticated backend health/capability checks; genuine incremental events; no canned fallback | Packet/event timing, cancellation, provider-unavailable, and fake-backend tests |
| Log leakage | Structured content-free logs, allowlisted fields, rotation/retention, safe errors and support bundles | Dynamic sensitive-input tests and log/support-bundle scans |
| Malicious import/archive | Safe parser, schema/unknown-field rejection, size/depth/file-count limits, no symlink/path escape/active content | Zip-slip, archive bomb, malformed JSON, polyglot and oversized fixtures |
| Backup/export disclosure | Exact scoped preview, one-store bundle, exclusions, checksums, optional verified encryption, retention warning | Private/institution backup isolation and restore tests |
| Restore revives authority | Restore data separately from current authority, policy, memory, agent, and bind state; revalidate after restore | Expired/revoked authority and agent-token restore tests |
| Dependency/update compromise | Lockfile, SBOM/license record, checksummed release, verified source, copy-on-write build, pre-update backup and migration tests | Reproducible build, tampered package, checksum and rollback tests |
| Partial migration/corruption | Transactional forward migrations, integrity check, backup before migration, fail-safe rollback/recovery | Interrupted migration, disk-full, corrupt DB and version-skew tests |
| Uninstall overclaim | Stop/revoke, exact file/data/provider preview, scoped removal, orphan scan, honest partial/failure state | Clean and dirty uninstall tests |

## 6. Local server and browser security requirements

- Bind loopback only and choose collision-safe ports without falling back to external interfaces.
- Require authentication before every application or API surface, including health details, downloads, streams, diagnostics, and static assets that reveal private state.
- Use password hashing appropriate to the supported runtime; never store plaintext or reversible credentials.
- Rotate sessions after login, privilege/context change, restore, credential change, and security event.
- Enforce CSRF, Origin, Host, request size, rate, method, and content-type rules server-side.
- Use a restrictive Content Security Policy, no inline remote code, no third-party trackers, no telemetry by default, and no arbitrary remote resource loading.
- Escape output by context; sanitize permitted rich text; do not render imported HTML or Markdown with active content.
- Prevent clickjacking, MIME sniffing, directory listing, stack-trace leakage, source-map leakage, and debug endpoint exposure in release.
- Use optimistic revisions/idempotency keys for mutations and deny stale writes.
- Do not expose filesystem paths, institution identifiers, model credentials, or sensitive provider errors to the browser.

## 7. Institutional workspace security

An institutional workspace is unavailable until a separate current bind proves platform/vendor/model approval, user/role/hat, institution/program/course/project, purpose, exact data classes/fields/sources, rights, access, authentication, encryption, logging, retention/deletion, incident response, backup/export, official system, human owners, approval, and expiry.

The bind is a reference boundary, not a data transfer. Private records never migrate into it. Institution data never migrates into the private store. Context switch closes the prior store and clears caches/model context.

`TEACH-DATA-C` and `TEACH-DATA-A` are exact object approvals, not blanket categories. A content hash, source/version, purpose, and approval expiry are required. A material change invalidates the receipt.

Even after provisioning, direct learner/person data remains prohibited in the base target. A future learner-record module cannot be introduced by changing a configuration flag; it needs a separate product/security release.

## 8. AI, agent, and tool security

- Discover backend capabilities through authenticated health endpoints; never infer capability from a URL or configuration string.
- Store provider credentials only in the server environment or approved OS secret facility.
- Redact prompts/tool arguments/results from ordinary logs; debugging must be explicit, temporary, local, warned, and still exclude prohibited content.
- Assemble minimum context from one authorized partition; never inject raw Soul content, private-life detail, or unapproved source text.
- Treat model output as untrusted draft. Re-screen before display, persistence, memory, tool use, artifact promotion, export, or citation rendering.
- Tools are exact allowlists with schemas, read-only ceilings, time/size/cost limits, no shell by default, and no external destinations.
- Every P1/P2 run has one invocation, zero hidden retries, expiry, cancellation, timeout, reconciliation, temporary-state purge, and output hash.
- `TEACH-AGT-10` runs on a separate control path and cannot approve or modify the agent under test.
- P3 contains no model or institutional data. P4 is absent.

## 9. Privacy, memory, logs, and analytics

Session-only memory is default. Persistent memory requires purpose, category, exact fields, access, retention, correction, export, deletion, expiry, and revocation consent. A role, badge, source recommendation, or prior session cannot silently opt in.

Do not persist health narratives, intimate details, employment disputes, or another person's private information. If the owner elects to plan around a constraint, store only a minimal category/time block.

No telemetry or analytics leave the device by default. Local product analytics, if implemented, must be content-free, owner-visible, deletable, and excluded from learner/person/workforce scoring. No streaks, dark patterns, shame, or addictive engagement.

Logs and receipts use an allowlist. Forbidden content includes request/response bodies, learner/person identifiers or payloads, private-life detail, secrets, source content, aggregate values, unsafe prompts, tool payloads, and filesystem-sensitive information.

## 10. Backup, update, rollback, and deletion

- Backup only one store at a time using a transactionally consistent snapshot, manifest, schema/app versions, checksum, creation time, and explicit exclusions.
- If encryption is offered, verify algorithm, key creation/storage/recovery, failure behavior, and restoration; otherwise state plainly that the backup is not application-encrypted.
- Restore into a staging location, validate schema/checksums/data classes, show a diff, and use an atomic swap after approval.
- Never restore active sessions, provider secrets, agent run tokens, P3 schedules, current authority, institutional bind, approval, or external-action completion without fresh validation.
- Update from a verified package only, preserve immutable source, write a pre-migration backup, use forward-only migrations, and retain a tested rollback path.
- Deletion reports what was deleted, retained, failed, or requires manual action. Do not claim secure erasure without filesystem/OS evidence.
- Rollback cannot reverse an external action and cannot revive expired authority or rights.

## 11. Security event response

For suspected sensitive-data entry, cross-context access, secret disclosure, agent escape, prompt-injection control loss, unauthorized network access, corrupted update, or incomplete purge:

1. stop the affected route and invoke Pause All when scope is uncertain;
2. cancel/kill active runs and revoke temporary permissions/sessions as appropriate;
3. do not reproduce the sensitive body;
4. preserve only content-free incident metadata needed for diagnosis;
5. show owner deletion, activity, export, and human incident-route options;
6. identify affected stores, versions, controls, and time window without exposing payload;
7. repair from a verified checkpoint or package;
8. rerun all affected security, isolation, migration, and recovery tests; and
9. report `Partial`, `Failed`, `Blocked`, or `Unsupported` whenever containment, deletion, revocation, or verification is incomplete.

## 12. Release-blocking checklist

Activation is blocked unless evidence proves:

- [ ] loopback-only binding, authentication, session, CSRF, Origin/Host, CSP, rate/size, and secure-header controls;
- [ ] no default credentials, client-side provider secrets, debug route, telemetry, tracker, or remote asset;
- [ ] pre-persistence `TEACH-DATA-X`, learner-record, secure-assessment, PHI/live-care, person, secret, and unclassified rejection;
- [ ] no-echo/no-log/no-index/no-memory/no-export/no-agent handling for stopped content;
- [ ] private/institutional and cross-institution/course/project/workspace isolation;
- [ ] exact `TEACH-DATA-C/A/R` schemas, receipts, expiry, and negative tests;
- [ ] three adapter/task-hat ceilings and five workspace boundaries;
- [ ] EDENA/absolute-stop/TEACH enforcement on every boundary;
- [ ] no ranking, profiling, prediction, surveillance, prohibited inference, or detector-as-proof;
- [ ] no in-app grading, learner contact, LMS/gradebook write, release, pilot, publication, or official action;
- [ ] source, rights, accessibility, disclosure, correction, and expiry controls;
- [ ] all agents P0 by default, P1/P2 one-run, P3 restrictions, P4 absence, Stop/Kill, timeout, purge, and auditor separation;
- [ ] genuine backend state, streaming, cancellation, error handling, and no fake-response fallback;
- [ ] safe import, export, backup, restore, migration, update, rollback, overlay removal, deletion, and uninstall;
- [ ] accessibility tests for every user-facing security/governance control; and
- [ ] final release archive, lockfile, SBOM/license record, manifest, checksums, clean-install test, and truthful readiness statement.

`Attempted`, `Partial`, `Unknown`, `Unavailable`, `Awaiting approval`, `Awaiting human verification`, `Blocked`, and `Not Run` are not `Passed`.
