How should STRIDE be designed for production?

For production, apply the categories to real trust boundaries and data flows, record concrete threats rather than generic labels, connect each threat to mitigations, and prioritize based on system context. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.