Problem Statement
The workflow aims to transform security feature concepts and contextual inputs into rigorous, actionable engineering specifications. It ensures that each feature includes requirements with abuse cases, a threat model with realistic attack vectors, mitigation strategies, a security-focused test plan, and a controlled rollout plan. The goal is to help engineering leaders consistently produce high-quality, compliant, risk-aware security specifications.
Steps
Ingest Feature Context
INGESTCollect inputs including feature idea, system context, threat assumptions, compliance requirements, and user personas. Parse and normalize this information for downstream use.
Generate Security Requirements
EXECUTECreate a PRD-lite outlining functional and non-functional requirements, explicitly including abuse cases and misuse scenarios. Capture compliance-driven constraints such as SOC2 and GDPR obligations.
Model Threats and Mitigations
EXECUTEIdentify realistic attack vectors based on system context, personas, and assumptions. Propose mitigations mapped directly to each threat and verify that controls satisfy relevant compliance requirements.
Draft Security Test Plan
EXECUTEProduce a security-focused test plan covering penetration scenarios, abuse-case validation, and mitigation verification. Include acceptance criteria tied to threat model outcomes.
Propose Staged Rollout Plan
EXECUTECreate a controlled rollout strategy with phased exposure, blast-radius limits, and monitoring checkpoints. Define security events and telemetry required for safe deployment.
Prompt Configurations
Security Specification Generator
You are a senior security product engineer. Using the provided feature idea, system context, threat assumptions, compliance requirements, and user personas, generate: (1) a PRD-lite including explicit requirements and abuse cases, (2) a detailed threat model with realistic attack vectors and aligned mitigations, (3) a security test plan covering penetration scenarios and mitigation validation, and (4) a staged rollout plan with monitoring checkpoints and blast-radius restrictions. Maintain a rigorous, risk-aware tone. Do not invent system facts; only reason from given inputs or widely accepted security principles.
Example Inputs/Outputs
Feature idea: Add MFA enforcement to admin dashboard. System context: Multi-tenant SaaS dashboard with RBAC. Threat assumptions: Attackers may have stolen passwords, may attempt session hijacking. Compliance: SOC2, GDPR. Personas: Admin user, Support engineer.
PRD-lite with requirements such as enforced MFA for all admin logins, session re-auth on privilege escalation, and abuse cases like MFA fatigue attacks. Threat model listing vectors including credential stuffing, phishing bypass attempts, and token replay, each with mitigations such as rate limits, WebAuthn, and token binding. Test plan describing penetration scenarios including simulated credential theft and session fixation attempts. Rollout plan defining a pilot cohort, telemetry on MFA failure rates, and alerting on anomalous login patterns.