This register is broader than the threat model. The threat model is a STRIDE inventory of security threats at boundaries. This register captures product, schedule, cost, operational, supply-chain, and security risks together, with state, mitigations, and ownership.
State legend: Watch = monitored, no action required this stage. Triggered = the leading indicator fired; PM must escalate per the SOP Risk Management Process. Mitigated = control is in place; the risk persists but is reduced to an acceptable level. Accepted = explicitly accepted, no further action. Resolved = the underlying condition no longer applies; risk is closed.
| Field | Value |
|---|
| Category | Security / data classification |
| State | Watch |
| Likelihood | Low (operator-controlled) |
| Impact | High (notifiable-breach class if PII corpus is loaded) |
| Trigger | Any change to the corpus identifier in the ingestion loader or pyproject.toml |
| Mitigation today | Corpus pinned in code (RAG003). Data classification doc names one class only |
| Mitigation planned | Feature #66 / #67 add a CI gate that compares the corpus identifier in the loader to the value in data-classification.md |
| Cross-ref | Threat model T3; data-classification.md; #66, #67 |
| Owner | Security Specialist |
| Field | Value |
|---|
| Category | Cost / operational |
| State | Watch — no automated detection; a breach is visible only on deliberate operator review |
| Likelihood | Medium (any test loop, retry storm, or compromised key) |
| Impact | Medium (capped by AWS account but personal-budget-painful) |
| Trigger | Daily Bedrock spend over $5/env. Nothing detects this automatically today |
| Mitigation today | Per-key lifetime request quota (RAG009); Lambda concurrency limit; manual checking. The two hand-created AWS Budgets do not mitigate this: they filter on user:Environment$<env>, and no cost allocation tag is active on the account (aws ce list-cost-allocation-tags --status Active returns empty, verified 2026-08-11), so they match no spend and cannot fire at any threshold. Treat the notification channel as absent, not degraded |
| Mitigation planned | #295 makes the budgets match spend at all: activate the Environment cost allocation tag, then confirm whether on-demand Bedrock usage is attributable per environment (unverified) or whether the filter must move to the service dimension, where Bedrock spend does appear. Story #64 then wires the alarm at $5/env with SNS to operator email — it depends on a budget that can fire |
| Cross-ref | RAG007 (Haiku-class selection reduces unit cost); #64, #295; cost.md |
| Owner | DevOps Lead |
| Field | Value |
|---|
| Category | Security |
| State | Watch |
| Likelihood | Low today (curated public dataset); high if corpus is swapped |
| Impact | Medium (off-policy output attributed to product) |
| Trigger | Output review flags off-template responses; or corpus change |
| Mitigation today | Delimited retrieved content in prompt; explicit “data not instructions” note |
| Mitigation planned | Capability #44 Safety Gate; Bedrock Guardrails approved per Decision #55 (closed), gated on #44 entering Stage 3 |
| Cross-ref | Threat model T1; #44, Decision #55 |
| Owner | Security Specialist |
| Field | Value |
|---|
| Category | Security |
| State | Watch |
| Likelihood | High during the window between authorizer go-live and Story #62 ship |
| Impact | High (bearer tokens in plaintext in CloudWatch) |
| Trigger | RAG009 stories #59-#63 deploy ahead of #62 |
| Mitigation planned | Sequencing: #62 (log scrub) must ship in the same release as #60 (authorizer). PM enforces |
| Cross-ref | Threat model; per-feature requirements; #62 |
| Owner | PM + Security Specialist |
| Field | Value |
|---|
| Category | Security / supply chain |
| State | Watch |
| Likelihood | Low per-dep, accumulating with surface area |
| Impact | High |
| Trigger | pip-audit or npm audit reports new High/Critical CVE on direct or transitive dep |
| Mitigation planned | pip-audit and npm audit jobs in CI (non-blocking initially, blocking once baseline is clean). SBOM process per sbom.md |
| Cross-ref | sbom.md; #29 |
| Owner | DevOps Lead + Security Specialist |
| Field | Value |
|---|
| Category | Operational / developer experience |
| State | Watch |
| Likelihood | Certain (already observed) |
| Impact | Low (productivity drag, no shipping risk) |
| Trigger | Already triggered for npm install, pip install, dev servers |
| Mitigation today | Vite cache redirected to ext4 (astro.config.mjs) |
| Mitigation planned | Issue #41 relocates Python .venv to ext4 |
| Cross-ref | #41; planning repo CLAUDE.md “Architecture notes” |
| Owner | Operator |
| Field | Value |
|---|
| Category | Schedule / delivery |
| State | Watch |
| Likelihood | High (the gate is a hard-fail) |
| Impact | Low (intended behavior; surfaces gaps early) |
| Trigger | PR fails pytest --cov-fail-under=90 |
| Mitigation today | Coverage exclusion policy at coverage-exclusions.md |
| Mitigation planned | QA plans (qa/plan-*.md) call out per-Feature coverage approach; DoD template requires the check pass |
| Cross-ref | RAG006; qa/summary.md; dod-template.md |
| Owner | QA Lead |
| Field | Value |
|---|
| Category | Deployment / security |
| State | Watch |
| Likelihood | Certain (no issue exists) |
| Impact | Medium (Stage 4 deploys can’t run without it) |
| Trigger | First Terraform apply story enters Stage 4 |
| Mitigation today | OIDC trust policy design documented in deployment-plan.md |
| Mitigation planned | PM opens a tracking issue under Capability #26; DevOps Lead provisions the role in Stage 4 |
| Cross-ref | deployment-plan.md; #25, #29 |
| Owner | PM (to open issue), DevOps Lead (to design) |
Risks move here when the underlying condition no longer applies or a control is in place with explicit operator acceptance.
| Field | Value |
|---|
| Category | Security |
| Initial state | Watch |
| Current state | Mitigated |
| Likelihood | Medium (any public endpoint receives adversarial inputs) |
| Impact | Low (same audience as requester for single-tenant demo) |
| Trigger | 422 oversized-question rate elevated; output review |
| Mitigation | RAG013 prompt-attack filter via ApplyGuardrail before the pipeline runs; question length cap (retrieval spec); RAG009 bearer auth limits caller pool |
| Cross-ref | Threat model T2; RAG013 |
| Owner | Security Specialist |
| Field | Value |
|---|
| Category | Architecture / governance |
| Initial state | Triggered |
| Current state | Resolved |
| Trigger | Architect-reviewer Stage 3 review §2 flagged it |
| Resolution | RAG011 written, documenting the public-path access contract and rationale for no Lambda VPC attachment |
| Cross-ref | RAG001; RAG011 |
| Owner | Solution Architect (Operator) |
| Field | Value |
|---|
| Category | Architecture / governance |
| Initial state | Triggered |
| Current state | Resolved |
| Trigger | Architect-reviewer Stage 3 review §2 |
| Resolution | RAG012 written, covering Vite + React, S3 + CloudFront target, no SSR, and the rationale against Next.js |
| Cross-ref | RAG012; #17, #18 |
| Owner | Solution Architect (Operator) |
| Field | Value |
|---|
| Category | Schedule / scope |
| Initial state | Triggered |
| Current state | Resolved |
| Trigger | Architect-reviewer §3 flagged as top gold-plating candidate |
| Resolution | Scope decision made: harness retained under Capability #44 Safety / Quality, scoped to BERTScore + SentenceTransformers with no threshold enforcement. RAG014 records the decision and rejected alternatives |
| Cross-ref | RAG014; architect-reviewer §3, §4 item 7; #14, #44 |
| Owner | Operator |
This register is updated at every PM Notification trigger and at every stage gate. The Risk Management Process loads at every stage start; Triggered risks escalate immediately to the operator.