# Data-flow diagram (DFD) — sensor / broker / telemetry

**Status:** mapping aid / not a certification artifact  
**Non-claim:** this DFD does not assert SOC 2, ISO 27001, HIPAA, or similar certification.

## Trust zones (summary)

```text
[Attacker network] --TCP/UDP--> [Sensor process]
                                      |
                                      | UDS only (optional)
                                      v
                               [AI broker]
                                      |
                                      x  (no attacker listener; no public bind)

[Sensor] --one-way--> [Telemetry / evidence sinks]
              (no reverse control path into policy)

[Sensor] --x--> Internet providers / CTI / cloud APIs
         (zero-egress default; Live gated NAT is opt-in research)
```

## Flows

| # | From | To | Data | Notes |
|---|------|-----|------|-------|
| F1 | Attacker | Sensor | Protocol bytes | Synthetic persona responses only |
| F2 | Sensor | AI broker | Typed slot-fill requests | UDS (or mTLS lab); SEC-003 |
| F3 | AI broker | Sensor | Validated slot-fill candidates | Fail-closed to static on error |
| F4 | Sensor | Telemetry sinks | Metadata / evidence refs | One-way observation (SEC-004) |
| F5 | Ops (optional) | Sensor | Desired-state / config | Out-of-band; never required to bind ports |

## Boundaries

- **Broker:** no attacker-facing listener; policy is sole client.
- **Telemetry:** sinks cannot call policy APIs.
- **Sensor default:** no provider, CTI, cloud, or Ops credentials on the wire plane.
- **Egress:** default deny; Live NAT is a separate research opt-in with kill-switch.

Pointers: [threat-model.md](../../security/threat-model.md),
[ADR 0008](../../adr/0008-safe-agentic-roles.md).