Mark every trust boundary and look hardest where flows cross them

A trust boundary is any place where data or a request moves between parts of the system that trust each other differently. Crossing one is where you must ask: who is really sending this, can it be changed on the way, and is it allowed?

Common boundaries in web and cloud systems:

• the browser or mobile app to your API (everything the client sends is untrusted)
• your API to internal services, if internal services assume every caller is friendly
• your system to third-party APIs and webhooks, in both directions
• one tenant's data to another's in a multi-tenant system
• user privilege to admin privilege, including support and back-office tools
• your code to a cloud provider's managed services, where the OWASP cheat sheet asks you to consider shared responsibility: what the provider secures and what you must

Each data flow that crosses a boundary deserves its own row in the next step. A flow that stays inside one boundary still matters, but crossing points are where authentication, input validation and authorization checks must live.