@ryanc isn't that basically how we do threat modeling? Except we use third person, it's weird otherwise