= Trust boundary
A <trust boundary> separates components or actors to which a <threat model> assigns different trust or authority. Data crossing it must be checked under the receiving side's rules. A boundary can exist between a browser and server, between two <operating-system processes>, or inside one application.<Microsoft Threat Modeling Tool threats>[Tampering: crossing a trust boundary; Elevation of privilege: context with greater privilege]{ref}
For example, a browser sends a requested record identifier to a <database>-backed service. The service must check both its format and the requester's <authorization> to access that record. Hiding the identifier in a <GUI widget> does not establish either property: an attacker can send a different request. Identifying the <trust boundary> makes the required checks visible before choosing a security mechanism.
Back to article page
