diff --git a/terminology/USER_MODEL.md b/terminology/USER_MODEL.md
new file mode 100644
index 0000000..b96e139
--- /dev/null
+++ b/terminology/USER_MODEL.md
@@ -0,0 +1,12 @@
+Primary user: Cyber analyst
+
+Assumptions:
+- Technically competent
+- Time-constrained
+- Prefers density over whitespace
+- Values consistency over novelty
+
+Mental model:
+- Scan → filter → prioritize → act
+- Severity drives attention
+- Confidence drives trust