Teams often start threat modeling with a diagram of components. For agents, start with verbs. What can the system read, infer, create, change, send, or delete?
Build the capability ledger
List each tool and expand it into concrete actions. “Calendar access” is too broad; “read private event,” “invite external attendee,” and “delete recurring event” have very different consequences.
For each action, record the credential used, scope, triggering principal, confirmation requirement, reversibility, and audit trail. The resulting ledger exposes privilege concentration faster than an architecture diagram alone.
Turn capabilities into tests
Combine high-impact actions with untrusted inputs and ambiguous approval states. Those intersections are your first red-team cases—and usually your first design changes.