{
  "assets": [
    "DOCUMENT_CONTENT",
    "DOCUMENT_METADATA"
  ],
  "actors": [
    "owner",
    "collaborator",
    "unrelated_authenticated",
    "unauthenticated"
  ],
  "entry_points": [
    "upload_document",
    "get_document",
    "get_metadata"
  ],
  "trust_boundaries": [
    {
      "id": "TB-INTERNET-APP",
      "from": "client",
      "to": "application_service"
    }
  ],
  "components": {
    "application_service": {
      "zone": "APP_CONTROLLED"
    },
    "metadata_store": {
      "zone": "APP_CONTROLLED"
    },
    "storage_adapter": {
      "zone": "APP_CONTROLLED"
    }
  },
  "policy": {
    "document_read_requires_authentication": true,
    "document_read_requires_owner_or_collaborator": true,
    "metadata_requires_authentication": true
  },
  "documents": {
    "doc-1": {
      "owner": "alice",
      "collaborators": [
        "bob"
      ],
      "metadata": {
        "title": "Quarterly Notes"
      },
      "content": "synthetic document body"
    }
  },
  "record_fields": [
    "Asset",
    "Security Objective",
    "Actor",
    "Entry Point",
    "Data Flow",
    "Trust Boundary",
    "Threat Scenario",
    "Control",
    "Evidence Check",
    "Residual Risk",
    "Owner Decision Needed"
  ]
}