threat-model clarification