How should threat modeling be designed for production?

For production, diagram data flows and trust boundaries, identify assets and attackers, enumerate threats, prioritize by impact and likelihood, assign mitigations, and revisit the model when architecture or exposure changes. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.