# karanjeet-kumar/cybersecurity-capstone-project architecture

> Architecture diagram of the GitHub repository karanjeet-kumar/cybersecurity-capstone-project, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/karanjeet-kumar/cybersecurity-capstone-project
- Repository: https://github.com/karanjeet-kumar/cybersecurity-capstone-project

## Overview

This repository is a five-part AI identity security capstone: threat modeling, an Auth0-backed web/API application, simulated red-team attacks, blue-team controls and detection, and compliance governance. The primary runtime path is browser login through the web app’s OAuth/PKCE callback and session, then scope-checked chat/admin requests to the protected API. Separate project scripts demonstrate attacks and defenses rather than forming one deployed pipeline. Some capability nodes are based on README requirements and tree paths; their implementation details and connections were not sampled.

Main entry points: [`02-iam-design/app.js`](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/app.js) (Web Portal), [`04-blue-team/guardrails.py`](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/guardrails.py) (Input and Output Guardrails), [`03-red-team/agent.py`](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/agent.py) (Simulated Agent), [`02-iam-design/rotate.js`](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/rotate.js) (M2M Token Test)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_threat["Threat Modeling"]
  node_threat_model["Identity Threat Model<br/>[README.md]"]
  node_attack_trees["Attack Trees"]
  node_atlas_register["ATLAS Risk Register<br/>[risk_register.csv]"]
end

subgraph group_iam["Identity Application"]
  node_web_app["Web Portal<br/>[app.js]"]
  node_auth_middleware["Session and Scope Checks<br/>[auth.js]"]
  node_protected_api["Protected API<br/>[api.js]"]
  node_auth0{{"Auth0"}}
  node_token_rotation["M2M Token Test<br/>[rotate.js]"]
end

subgraph group_red["Red Team"]
  node_red_agent["Simulated Agent<br/>[agent.py]"]
  node_injection_attack["Indirect Injection"]
  node_spoofing_attack["Agent Spoofing"]
  node_extraction_attack["Prompt Extraction"]
  node_rag_attack["RAG and MCP Poisoning"]
end

subgraph group_blue["Blue Team"]
  node_blue_agent["Hardened Agent<br/>[agent.py]"]
  node_regex_guardrails["Input and Output Guardrails<br/>[guardrails.py]"]
  node_nemo_guardrails["NeMo Guardrails<br/>[run_guardrails.py]"]
  node_guardrail_actions["Guardrail Actions<br/>[actions.py]"]
  node_identity_binding["Signed Agent Identity"]
  node_anomaly_detection["Anomaly Detection"]
  node_comparison["Before and After<br/>[before_after.py]"]
end

subgraph group_governance["Governance"]
  node_policy["Identity Security Policy"]
  node_compliance["Compliance Mapping"]
end

node_user(("User"))

node_user -->|"uses"| node_web_app
node_web_app -->|"authenticates with"| node_auth0
node_auth0 -->|"returns tokens"| node_web_app
node_web_app -->|"checks access"| node_auth_middleware
node_web_app -->|"forwards API request"| node_protected_api
node_token_rotation -->|"requests M2M token"| node_auth0
node_token_rotation -->|"replays token"| node_protected_api
node_threat_model -->|"documents threats as"| node_attack_trees
node_attack_trees -->|"maps risks to"| node_atlas_register
node_injection_attack -->|"invokes"| node_red_agent
node_extraction_attack -->|"invokes"| node_red_agent
node_red_agent -->|"agent used by"| node_regex_guardrails
node_regex_guardrails -->|"guards responses from"| node_blue_agent
node_nemo_guardrails -.->|"loads configured rails"| node_guardrail_actions
node_spoofing_attack -->|"mitigated by"| node_identity_binding
node_rag_attack -->|"tested against"| node_regex_guardrails
node_anomaly_detection -.->|"monitors identity events"| node_blue_agent
node_comparison -->|"evaluates controls"| node_regex_guardrails
node_comparison -->|"evaluates controls"| node_identity_binding
node_policy -->|"mapped as evidence"| node_compliance

click node_threat_model "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/01-threat-model/README.md"
click node_attack_trees "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/tree/main/01-threat-model/Draw%20IO"
click node_atlas_register "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/01-threat-model/MITRE%20ATLAS%20Technique/risk_register.csv"
click node_web_app "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/app.js"
click node_auth_middleware "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/middleware/auth.js"
click node_protected_api "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/api.js"
click node_token_rotation "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/rotate.js"
click node_red_agent "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/agent.py"
click node_injection_attack "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack1_indirect_injection.py"
click node_spoofing_attack "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack2_agent_spoofing.py"
click node_extraction_attack "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack3_prompt_extraction.py"
click node_rag_attack "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack4_rag_poisoning.py"
click node_blue_agent "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/agent.py"
click node_regex_guardrails "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/guardrails.py"
click node_nemo_guardrails "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/task1_nemoguardrails/run_guardrails.py"
click node_guardrail_actions "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/task1_nemoguardrails/config/actions.py"
click node_identity_binding "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/identity_binding.py"
click node_anomaly_detection "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/anomaly_detection.py"
click node_comparison "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/before_after.py"
click node_policy "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/tree/main/05-policy"
click node_compliance "https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/05-policy/compliance_mapping.xlsx"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_threat_model,node_attack_trees,node_atlas_register,node_user toneBlue
class node_web_app,node_auth_middleware,node_protected_api,node_auth0,node_token_rotation toneAmber
class node_red_agent,node_injection_attack,node_spoofing_attack,node_extraction_attack,node_rag_attack toneMint
class node_blue_agent,node_regex_guardrails,node_nemo_guardrails,node_guardrail_actions,node_identity_binding,node_anomaly_detection,node_comparison toneRose
class node_policy,node_compliance toneIndigo
```

## Components

### Threat Modeling

- [Identity Threat Model](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/01-threat-model/README.md): `01-threat-model/README.md`
- [Attack Trees](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/tree/main/01-threat-model/Draw%20IO): `01-threat-model/Draw IO`
- [ATLAS Risk Register](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/01-threat-model/MITRE%20ATLAS%20Technique/risk_register.csv): `01-threat-model/MITRE ATLAS Technique/risk_register.csv`

### Identity Application

- [Web Portal](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/app.js): `02-iam-design/app.js`
- [Session and Scope Checks](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/middleware/auth.js): `02-iam-design/middleware/auth.js`
- [Protected API](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/api.js): `02-iam-design/api.js`
- **Auth0**
- [M2M Token Test](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/02-iam-design/rotate.js): `02-iam-design/rotate.js`

### Red Team

- [Simulated Agent](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/agent.py): `03-red-team/agent.py`
- [Indirect Injection](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack1_indirect_injection.py): `03-red-team/attack1_indirect_injection.py`
- [Agent Spoofing](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack2_agent_spoofing.py): `03-red-team/attack2_agent_spoofing.py`
- [Prompt Extraction](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack3_prompt_extraction.py): `03-red-team/attack3_prompt_extraction.py`
- [RAG and MCP Poisoning](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/03-red-team/attack4_rag_poisoning.py): `03-red-team/attack4_rag_poisoning.py`

### Blue Team

- [Hardened Agent](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/agent.py): `04-blue-team/agent.py`
- [Input and Output Guardrails](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/guardrails.py): `04-blue-team/guardrails.py`
- [NeMo Guardrails](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/task1_nemoguardrails/run_guardrails.py): `04-blue-team/task1_nemoguardrails/run_guardrails.py`
- [Guardrail Actions](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/task1_nemoguardrails/config/actions.py): `04-blue-team/task1_nemoguardrails/config/actions.py`
- [Signed Agent Identity](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/identity_binding.py): `04-blue-team/identity_binding.py`
- [Anomaly Detection](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/anomaly_detection.py): `04-blue-team/anomaly_detection.py`
- [Before and After](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/04-blue-team/before_after.py): `04-blue-team/before_after.py`

### Governance

- [Identity Security Policy](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/tree/main/05-policy): `05-policy`
- [Compliance Mapping](https://github.com/karanjeet-kumar/cybersecurity-capstone-project/blob/main/05-policy/compliance_mapping.xlsx): `05-policy/compliance_mapping.xlsx`

### Other components

- **User**

## Connections

- User → Web Portal: uses (evidence: `README.md`)
- Web Portal → Auth0: authenticates with (evidence: `02-iam-design/app.js`)
- Auth0 → Web Portal: returns tokens (evidence: `02-iam-design/app.js`)
- Web Portal → Session and Scope Checks: checks access (evidence: `02-iam-design/app.js`)
- Web Portal → Protected API: forwards API request (evidence: `02-iam-design/app.js`)
- M2M Token Test → Auth0: requests M2M token (evidence: `02-iam-design/rotate.js`)
- M2M Token Test → Protected API: replays token (evidence: `02-iam-design/rotate.js`)
- Identity Threat Model → Attack Trees: documents threats as (evidence: `README.md`)
- Attack Trees → ATLAS Risk Register: maps risks to (evidence: `README.md`)
- Indirect Injection → Simulated Agent: invokes (evidence: `03-red-team/attack1_indirect_injection.py`)
- Prompt Extraction → Simulated Agent: invokes (evidence: `03-red-team/attack3_prompt_extraction.py`)
- Simulated Agent → Input and Output Guardrails: agent used by (evidence: `04-blue-team/guardrails.py`)
- Input and Output Guardrails → Hardened Agent: guards responses from (evidence: `04-blue-team/guardrails.py`)
- NeMo Guardrails → Guardrail Actions: loads configured rails
- Agent Spoofing → Signed Agent Identity: mitigated by (evidence: `README.md`)
- RAG and MCP Poisoning → Input and Output Guardrails: tested against
- Anomaly Detection → Hardened Agent: monitors identity events
- Before and After → Input and Output Guardrails: evaluates controls (evidence: `04-blue-team/before_after.py`)
- Before and After → Signed Agent Identity: evaluates controls (evidence: `04-blue-team/before_after.py`)
- Identity Security Policy → Compliance Mapping: mapped as evidence (evidence: `README.md`)