From 1db6fc0851fd9beb539607293b836cf48a7df443 Mon Sep 17 00:00:00 2001 From: emmanuelgjr Date: Mon, 14 Sep 2026 15:27:33 -0400 Subject: [PATCH] =?UTF-8?q?Add=20OWASP=20AISVS=201.0=20mapping=20(25=20?= =?UTF-8?q?=E2=86=92=2026=20frameworks)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ports the AISVS 1.0 mapping authored by Otto Sulin (AISVS co-lead) in GenAI-Security-Project/GenAI-Data-Security-Initiative#64 (squash d0c4ff5) into this repo. Only the hand-authored sources were carried over; every generated file was regenerated here. Ported: agentic-top10/Agentic_AISVS.md 83 rows, ASI01–ASI10 dsgai-2026/DSGAI_AISVS.md 141 rows, DSGAI01–DSGAI21 data/frameworks/owasp-aisvs.json 191 requirements Not ported: llm-top10/LLM_AISVS.md (74 rows). It maps the LLM Top 10 2025; this repo targets the 2026 list, where eight entries changed number and LLM08/LLM10 were re-scoped (MIGRATION.md). Re-keying it is an SME call, not a mechanical port, so it is left for follow-up. Adaptations, mapping rows unchanged: - "LLM Top 10:" cross-references in both files renumbered 2025 → 2026 with the MIGRATION.md map (91 ids). generate.js unions these into entries' crossrefs.llm_top10, so leaving them would have attached wrong LLM ids to ASI and DSGAI entries. - Header block, H1, source-list links and footer aligned with sibling files; prose wrapped to 120 columns and blank lines added before lists for markdownlint; changelog row added. - Registry: `kind: control` on all 191 items and an inventory_completeness block (status complete, 191/191), required by framework-schema.json and stats.js. Requirement ids, text and levels re-verified against OWASP/AISVS 1.0/en today: 191/191 identical. Registration, mirroring 2338d1a: FRAMEWORK_FILES in generate.js; framework-sources.json (checked 2026-09-14, current 1.0); AISVS in inventory-completeness COMPLETE_BY_DEFINITION so `npm run inventory` does not downgrade it; REPORT_FRAMEWORKS/FW_META in compliance-report.js; README matrix, file tables and tree; webapp, agentic landing, standards-crosswalk page and llms.txt framework counts; package.json description; FRESHNESS_SLA; CHANGELOG. Regenerated: data/entries (31), backlinks, docs bundles, stats.json and README markers. Counts: 3,497 → 3,721 mappings, 74 → 76 mapping files, 25 → 26 frameworks mapped and registered, 1,372 → 1,563 controls, freshness 2 → 3 current. validate.js: 0 errors, warning set identical to main. Tests 50/50. Co-authored-by: Otto Sulin Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01KJVKF6raJCNKBWjTkDSqR4 --- CHANGELOG.md | 10 + README.md | 41 +- agentic-top10/Agentic_AISVS.md | 657 +++++ data/backlinks.json | 3038 +++++++++++++++++++++++ data/entries/ASI01.json | 88 + data/entries/ASI02.json | 88 + data/entries/ASI03.json | 121 + data/entries/ASI04.json | 91 +- data/entries/ASI05.json | 91 +- data/entries/ASI06.json | 91 +- data/entries/ASI07.json | 88 + data/entries/ASI08.json | 91 +- data/entries/ASI09.json | 77 + data/entries/ASI10.json | 102 +- data/entries/DSGAI01.json | 80 +- data/entries/DSGAI02.json | 80 +- data/entries/DSGAI03.json | 69 +- data/entries/DSGAI04.json | 91 +- data/entries/DSGAI05.json | 99 + data/entries/DSGAI06.json | 77 + data/entries/DSGAI07.json | 80 +- data/entries/DSGAI08.json | 66 + data/entries/DSGAI09.json | 58 +- data/entries/DSGAI10.json | 58 +- data/entries/DSGAI11.json | 69 +- data/entries/DSGAI12.json | 77 + data/entries/DSGAI13.json | 80 +- data/entries/DSGAI14.json | 66 + data/entries/DSGAI15.json | 66 + data/entries/DSGAI16.json | 77 + data/entries/DSGAI17.json | 77 + data/entries/DSGAI18.json | 80 +- data/entries/DSGAI19.json | 58 +- data/entries/DSGAI20.json | 91 +- data/entries/DSGAI21.json | 88 + data/framework-sources.json | 8 + data/frameworks/owasp-aisvs.json | 1752 ++++++++++++++ data/stats.json | 30 +- docs/FRESHNESS_SLA.md | 4 +- docs/agentic-ai-top10/index.html | 10 +- docs/ai-standards-crosswalk/index.html | 17 +- docs/backlinks.js | 3042 +++++++++++++++++++++++- docs/data.js | 2517 +++++++++++++++++++- docs/frameworks-registry.js | 1756 +++++++++++++- docs/incidents.js | 2 +- docs/index.html | 14 +- docs/llms.txt | 8 +- dsgai-2026/DSGAI_AISVS.md | 1160 +++++++++ package.json | 2 +- scripts/compliance-report.js | 7 + scripts/generate.js | 2 + scripts/inventory-completeness.js | 3 + 52 files changed, 16495 insertions(+), 100 deletions(-) create mode 100644 agentic-top10/Agentic_AISVS.md create mode 100644 data/frameworks/owasp-aisvs.json create mode 100644 dsgai-2026/DSGAI_AISVS.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 58e2d5f..4da1896 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,16 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### Added + +- **OWASP AISVS 1.0** mapped to the Agentic Top 10 and DSGAI 2026 — 25 → 26 frameworks. + `agentic-top10/Agentic_AISVS.md` (83 rows, ASI01–ASI10) and `dsgai-2026/DSGAI_AISVS.md` (141 rows, DSGAI01–DSGAI21), + plus `data/frameworks/owasp-aisvs.json` holding all 191 AISVS 1.0 requirements (inventory `complete`, verified + against upstream `1.0/en`). Authored by Otto Sulin (AISVS co-lead) in + GenAI-Security-Project/GenAI-Data-Security-Initiative#64 and ported here. +- LLM Top 10 × AISVS is **not** included: the source mapping targeted the 2025 list. Re-keying it to the 2026 + entries (LLM08 and LLM10 were re-scoped) needs AISVS SME review and is left as follow-up. + Next: npm publish to npmjs.com, custom domain (crosswalk.owasp.org), vendor integration packs, NeMo Guardrails configs. --- diff --git a/README.md b/README.md index ab1de95..62c7819 100644 --- a/README.md +++ b/README.md @@ -5,14 +5,14 @@ [![Version](https://img.shields.io/badge/version-4.0.0-green)](CHANGELOG.md) [![Source Lists](https://img.shields.io/badge/source%20lists-4-blueviolet)](README.md) -[![Mapping Files](https://img.shields.io/badge/mapping%20files-74-brightgreen)](README.md) -[![Frameworks](https://img.shields.io/badge/frameworks-25-orange)](README.md) +[![Mapping Files](https://img.shields.io/badge/mapping%20files-76-brightgreen)](README.md) +[![Frameworks](https://img.shields.io/badge/frameworks-26-orange)](README.md) [![npm](https://img.shields.io/npm/v/genai-security-crosswalk?color=red&label=npm)](https://www.npmjs.com/package/genai-security-crosswalk) > The most comprehensive publicly available mapping of OWASP GenAI security risks to industry frameworks — > covering LLM applications, autonomous agentic AI, and GenAI data security across -> **25 frameworks** and +> **26 frameworks** and > **4 OWASP source lists**. ## [Live Web App](https://genai-security-project.github.io/crosswalk/) | [Score Your Coverage](https://genai-security-project.github.io/crosswalk/#/score) | [Explore Entries](https://genai-security-project.github.io/crosswalk/#/explorer) | [View Incidents](https://genai-security-project.github.io/crosswalk/#/incidents) @@ -30,7 +30,7 @@ AI risks to all of them. **This repo solves that.** Every OWASP GenAI vulnerability (51 total) is mapped to specific controls in -25 industry frameworks. +26 industry frameworks. Pick your risk, find your controls. ### 3 ways to use it (pick one) @@ -74,14 +74,14 @@ Every file answers one question: **which controls from framework X address vulne | | | |---|---| | **4** source lists | LLM Top 10 · Agentic Top 10 · DSGAI 2026 · Agentic Skills Top 10 | -| **25** frameworks | Compliance · Governance · Threat modeling · Testing · OT/ICS · Identity · Secure SDLC · Financial | -| **74** mapping files | Every source list entry × every applicable framework | -| **Mapping review state** | 2 of 25 carry candidate DRAFT rows only — CoSAI · EU AI Act Code of Practice — see [docs/SCHEMA_V2_MIGRATION.md](docs/SCHEMA_V2_MIGRATION.md) | -| **Framework freshness** | 2 current · 1 behind upstream · 22 unchecked — see [docs/FRESHNESS_SLA.md](docs/FRESHNESS_SLA.md) | +| **26** frameworks | Compliance · Governance · Threat modeling · Testing · OT/ICS · Identity · Secure SDLC · Financial | +| **76** mapping files | Every source list entry × every applicable framework | +| **Mapping review state** | 2 of 26 carry candidate DRAFT rows only — CoSAI · EU AI Act Code of Practice — see [docs/SCHEMA_V2_MIGRATION.md](docs/SCHEMA_V2_MIGRATION.md) | +| **Framework freshness** | 3 current · 1 behind upstream · 22 unchecked — see [docs/FRESHNESS_SLA.md](docs/FRESHNESS_SLA.md) | | **21** implementation recipes | Production-ready Python patterns | | **70+** open-source tools | Catalogued and organised by function | | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries | -| **25** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) | +| **26** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) | | **131** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) | | **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk | @@ -114,6 +114,7 @@ All free. All open-source. Built for practitioners. | [ISO/IEC 42001:2023](https://www.iso.org/standard/81230.html) | ✅ | ✅ | ✅ | | [CIS Controls v8.1](https://www.cisecurity.org/controls) | ✅ | ✅ | ✅ | | [OWASP ASVS 4.0.3](https://owasp.org/www-project-application-security-verification-standard/) | ✅ | ✅ | ✅ | +| [OWASP AISVS 1.0](https://github.com/OWASP/AISVS/tree/main/1.0/en) | — | ✅ | ✅ | | [SOC 2 Trust Services Criteria](https://www.aicpa-cima.com/resources/landing/2017-trust-services-criteria) | ✅ | ✅ | ✅ | | [PCI DSS v4.0](https://www.pcisecuritystandards.org/document_library/) | ✅ | ✅ | ✅ | | [ENISA Multilayer Framework](https://www.enisa.europa.eu/publications/multilayer-framework-for-good-cybersecurity-practices-for-ai) | ✅ | ✅ | ✅ | @@ -157,7 +158,7 @@ All free. All open-source. Built for practitioners. | [LLM_FedRAMP.md](llm-top10/LLM_FedRAMP.md) | FedRAMP | SP 800-53 AI overlay — AC/AU/CA/CM/IA/IR/RA/SA/SC/SI/SR control families | | [LLM_DORA.md](llm-top10/LLM_DORA.md) | DORA | EU financial sector resilience — Art. 5–45 per LLM entry | -### Agentic Top 10 2026 — 25 framework mappings +### Agentic Top 10 2026 — 26 framework mappings | File | Framework | Standout content | |---|---|---| @@ -183,11 +184,12 @@ All free. All open-source. Built for practitioners. | [Agentic_SP800218A.md](agentic-top10/Agentic_SP800218A.md) | NIST SP 800-218A | Secure agentic SDLC — tool access, memory integrity, multi-agent pipeline practices | | [Agentic_FedRAMP.md](agentic-top10/Agentic_FedRAMP.md) | FedRAMP | Federal agentic AI authorization — agent identity, tool access, cascade controls | | [Agentic_DORA.md](agentic-top10/Agentic_DORA.md) | DORA | Financial sector agentic resilience — incident reporting, third-party agent risk | +| [Agentic_AISVS.md](agentic-top10/Agentic_AISVS.md) | OWASP AISVS 1.0 | Testable "Verify that" requirements, Levels 1–3, weighted to C9 Orchestration and C10 MCP Security | > **Also in this folder:** [Agentic_CWE_CVE.md](agentic-top10/Agentic_CWE_CVE.md) — CWE root cause taxonomy, > confirmed CVEs, full CWE cross-reference index. -### DSGAI 2026 — 23 framework mappings +### DSGAI 2026 — 24 framework mappings | File | Framework | Standout content | |---|---|---| @@ -212,6 +214,7 @@ All free. All open-source. Built for practitioners. | [DSGAI_SP800218A.md](dsgai-2026/DSGAI_SP800218A.md) | NIST SP 800-218A | Secure GenAI data SDLC — training data protection, data governance, provenance practices | | [DSGAI_FedRAMP.md](dsgai-2026/DSGAI_FedRAMP.md) | FedRAMP | Federal data security controls — SC-28 data at rest, AU-2 logging, SR supply chain | | [DSGAI_DORA.md](dsgai-2026/DSGAI_DORA.md) | DORA | Financial data resilience — Art. 8 asset inventory, Art. 12 backup, Art. 28-44 vendor risk | +| [DSGAI_AISVS.md](dsgai-2026/DSGAI_AISVS.md) | OWASP AISVS 1.0 | Level 1–3 verification requirements for all 21 entries — retrieval-time authorization, embedding sanitization, training-data provenance | ### Shared resources @@ -269,7 +272,7 @@ crosswalk/ │ ├── LLM_FedRAMP.md ← US federal cloud AI (SP 800-53 overlay) │ └── LLM_DORA.md ← EU financial sector resilience │ -├── agentic-top10/ ← ASI01–ASI10 × 25 frameworks +├── agentic-top10/ ← ASI01–ASI10 × 26 frameworks │ ├── Agentic_AIUC1.md │ ├── Agentic_MITREATLAS.md │ ├── Agentic_NISTAIRMF.md @@ -292,9 +295,10 @@ crosswalk/ │ ├── Agentic_NISTSP80082.md ← OT/ICS — U.S. regulatory alignment │ ├── Agentic_SP800218A.md ← Secure agentic SDLC │ ├── Agentic_FedRAMP.md ← Federal agentic AI authorization -│ └── Agentic_DORA.md ← Financial sector agentic resilience +│ ├── Agentic_DORA.md ← Financial sector agentic resilience +│ └── Agentic_AISVS.md ← AI Security Verification Standard — testable requirements │ -├── dsgai-2026/ ← DSGAI01–DSGAI21 × 23 frameworks +├── dsgai-2026/ ← DSGAI01–DSGAI21 × 24 frameworks │ ├── DSGAI_ISO27001.md │ ├── DSGAI_NISTAIRMF.md │ ├── DSGAI_EUAIAct.md @@ -315,7 +319,8 @@ crosswalk/ │ ├── DSGAI_NHI.md ← Non-Human Identity — data pipeline credentials │ ├── DSGAI_SP800218A.md ← Secure GenAI data SDLC │ ├── DSGAI_FedRAMP.md ← Federal data security controls -│ └── DSGAI_DORA.md ← Financial data resilience +│ ├── DSGAI_DORA.md ← Financial data resilience +│ └── DSGAI_AISVS.md ← AI Security Verification Standard — testable requirements │ ├── shared/ │ ├── RECIPES.md ← 21 implementation patterns (Python code) @@ -371,7 +376,7 @@ crosswalk/ Generate framework-specific gap assessments from the data layer in seconds: ```bash -node scripts/compliance-report.js # all 25 frameworks → reports/ +node scripts/compliance-report.js # all 26 frameworks → reports/ node scripts/compliance-report.js --framework "EU AI Act" # one framework node scripts/compliance-report.js --format csv # Excel-compatible node scripts/compliance-report.js --format json # machine-readable @@ -432,8 +437,8 @@ No install required. Works on desktop and mobile. | Page | What it does | |------|-------------| | [**Score**](https://genai-security-project.github.io/crosswalk/#/score) | Select your frameworks, see coverage gaps. Upload Garak/PyRIT/LAAF results to validate. Share your score card on LinkedIn. | -| [**Explorer**](https://genai-security-project.github.io/crosswalk/#/explorer) | Search and filter all 51 entries. Click any entry to see controls across all 25 frameworks. | -| [**Frameworks**](https://genai-security-project.github.io/crosswalk/#/frameworks) | Interactive 51×25 coverage matrix. Click any cell to see the specific controls mapped. | +| [**Explorer**](https://genai-security-project.github.io/crosswalk/#/explorer) | Search and filter all 51 entries. Click any entry to see controls across all 26 frameworks. | +| [**Frameworks**](https://genai-security-project.github.io/crosswalk/#/frameworks) | Interactive 51×26 coverage matrix. Click any cell to see the specific controls mapped. | | [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse 50 AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. | **Evidence-based scoring** — three validation tiers: diff --git a/agentic-top10/Agentic_AISVS.md b/agentic-top10/Agentic_AISVS.md new file mode 100644 index 0000000..1fe7daf --- /dev/null +++ b/agentic-top10/Agentic_AISVS.md @@ -0,0 +1,657 @@ + + +# Agentic Top 10 2026 × OWASP AISVS 1.0 + +Mapping the [OWASP Top 10 for Agentic Applications +2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) to the [OWASP Artificial +Intelligence Security Verification Standard +1.0](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/), a technical +verification standard of 191 testable requirements across 12 chapters, used by engineers and auditors to verify that a +specific AI system implements a control rather than merely documents it. + +--- + +## Why AISVS for this source list + +Most frameworks already in this crosswalk answer the question of what an organisation should govern. AISVS answers a +different question: given a running AI system, what does an assessor check, and what does a pass look like. Every +requirement is written to be independently verifiable and starts with the words Verify that. + +That makes this mapping the bridge between a risk in this source list and a concrete test an engineer can run. Where ISO +42001 or NIST AI RMF establish that a control must exist, AISVS states the condition that demonstrates it does. The two +are complements, not substitutes, and reading them together turns a control objective into an audit step. + +AISVS also assigns each requirement a level from 1 to 3 reflecting implementation difficulty and how situational the +control is. That maps cleanly onto the tier model used throughout this crosswalk, so the tier column below carries real +information about sequencing rather than a subjective judgement. + +--- + +## AISVS structure + +| Chapter | Description | Requirements | +|---|---|---| +| [C1 Training Data Integrity & Traceability](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md) | This chapter addresses protecting the integrity and traceability of training data as it is sourced, handled, and maintained. | 13 | +| [C2 Input Validation](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C02-Input-Validation.md) | This chapter addresses validation of all inputs as a first-line defense against prompt injection, one of the most damaging attacks on AI systems. | 12 | +| [C3 Model Lifecycle Management & Change Control](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md) | This chapter addresses control of model changes so that unauthorized or unsafe modifications cannot reach production. | 15 | +| [C4 Infrastructure, Configuration & Deployment Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C04-Infrastructure.md) | This chapter addresses hardening AI-specific infrastructure components against model theft, data leakage, and cross-tenant contamination. | 14 | +| [C5 Access Control & Identity for AI Components & Users](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C05-Access-Control-and-Identity.md) | This chapter addresses access control challenges that AI systems introduce beyond traditional application security. | 11 | +| [C6 Supply Chain Security for Models](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C06-Supply-Chain.md) | This chapter addresses defending against AI supply chain attacks that exploit third-party models, frameworks, or datasets to embed backdoors, bias, or exploitable code. | 7 | +| [C7 Model Behavior, Output Control & Safety Assurance](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C07-Model-Behavior.md) | This chapter addresses constraining, validating, and monitoring model outputs so that unsafe, malformed, or high-risk responses cannot reach users or downstream systems. | 13 | +| [C8 Memory, Embeddings & Vector Database Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md) | This chapter addresses securing the embeddings and vector stores that act as semi-persistent and persistent "memory" for AI systems through Retrieval-Augmented Generation (RAG). | 11 | +| [C9 Orchestration & Agentic Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md) | This chapter addresses ensuring autonomous and multi-agent systems execute only authorized, intended, and bounded actions. | 34 | +| [C10 Model Context Protocol (MCP) Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C10-MCP-Security.md) | This chapter addresses secure discovery, authentication, authorization, transport, and use of MCP-based tool and resource integrations. | 23 | +| [C11 Adversarial Robustness](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C11-Adversarial-Robustness.md) | This chapter addresses keeping AI systems reliable and abuse-resistant when facing evasion, inference, extraction, or poisoning attacks. | 17 | +| [C12 Monitoring, Logging & Anomaly Detection](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C12-Monitoring-and-Logging.md) | This chapter addresses real-time and forensic visibility into what the model and other AI components see, do, and return, so that AI-specific threats can be detected and triaged. | 21 | + +Levels map to crosswalk tiers as Level 1 Foundational, Level 2 Hardening, Level 3 Advanced. Where an entry maps to +requirements at several levels, the tier column below reports the level most of its requirements sit at. + +--- + +## Quick-reference summary + +| ID | Name | Severity | Primary AISVS Controls | Tier | Scope | +|---|---|---|---|---|---| +| ASI01 | Agent Goal Hijack | Critical | C2.1, C10.4, C8.2, C9.3, C9.2, C12.2 | Hardening | Both | +| ASI02 | Tool Misuse and Exploitation | Critical | C9.5, C9.3, C10.2 | Hardening | Both | +| ASI03 | Identity and Privilege Abuse | Critical | C9.4, C9.5, C5.1, C5.2, C10.2 | Advanced | Both | +| ASI04 | Agentic Supply Chain | High | C10.1, C6.1, C6.2, C9.3, C10.4 | Hardening | Both | +| ASI05 | Unexpected Code Execution | Critical | C9.3, C4.1, C7.1, C9.1, C3.4 | Foundational | Both | +| ASI06 | Memory and Context Poisoning | High | C8.2, C8.1, C12.5, C8.3, C9.4 | Hardening | Both | +| ASI07 | Insecure Inter-Agent Communications | High | C10.3, C9.4, C10.4, C9.5 | Hardening | Both | +| ASI08 | Cascading Agent Failures | Critical | C9.1, C9.6, C9.2, C9.3, C12.3 | Advanced | Both | +| ASI09 | Human-Agent Trust Exploitation | High | C9.2, C9.6, C7.4, C7.2, C12.4 | Hardening | Both | +| ASI10 | Rogue Agents | Critical | C12.1, C12.2, C9.4, C9.6, C9.2, C12.4, C12.5 | Hardening | Both | + +--- + +## Target audience + +| Role | Sections to prioritise | +|---|---| +| Security engineer | C2 Input Validation, C9 Orchestration and Agentic Security, C10 MCP Security | +| Developer | C7 Model Behavior and Output Control, C8 Memory and Embeddings, C5 Access Control | +| ML engineer | C1 Training Data, C3 Model Lifecycle, C11 Adversarial Robustness | +| Auditor | The whole standard. Every requirement is written as a verifiable test | +| Compliance and GRC | C1 Training Data, C6 Supply Chain, C12 Monitoring and Logging | +| Red teamer | C2 Input Validation, C11 Adversarial Robustness, C9 Orchestration | + +--- + +## Detailed mappings + +--- + +### ASI01 - Agent Goal Hijack + +AISVS addresses goal hijack at both the injection point and the persistence point. C2.1 screens the steering input, +C10.4.2 screens tool responses, and C8.2.3 stops unvalidated agent and tool output being written into trusted memory +where a hijack would survive the session. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,... | [2.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector | +| Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu... | [2.1.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions | +| Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context. | [10.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path | +| Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation. | [8.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence | +| Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig... | [9.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act | +| Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries. | [9.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries | +| Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de... | [9.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate | +| Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs. | [12.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 2.1.3: Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt + injection detection ruleset or classifier, with flag... +- 10.4.2: Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being + injected into the model context. +- 12.2.1: Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and + adversarial inputs. + +**Tier 2 - Short-term (first 30 days):** + +- 2.1.6: Verify that the system enforces an instruction hierarchy in which system and developer messages override user + instructions and other untrusted inputs, even a... +- 8.2.3: Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without + explicit source validation. +- 9.3.5: Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that + compromised data processing cannot trigger unauth... +- 9.2.5: Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is + restricted by enforceable boundaries. +- 9.2.6: Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that + adds to, and does not replace, the deterministi... + +**Tier 3 - Strategic:** + +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM01, LLM03 +- Agentic: N/A +- DSGAI: DSGAI01, DSGAI15, DSGAI12, DSGAI02 +- See also: the AISVS chapters listed above at + +--- + +### ASI02 - Tool Misuse and Exploitation + +AISVS constrains tools declaratively and enforces the declaration. C9.3 requires tool manifests declaring privileges, +resource limits and output validation, and requires the runtime to enforce them; C9.5.1 adds parameter-value level +authorization so a legitimate tool cannot be called destructively. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w... | [9.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse | +| Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. | [9.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas | +| Verify that tool manifests declare required privileges, resource limits, and output validation requirements. | [9.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Tool manifests declare required privileges, resource limits and output validation requirements | +| Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests. | [9.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests | +| Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t... | [9.3.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation | +| Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool... | [10.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values | +| Verify that policy violations trigger automated tool containment. | [9.3.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 3. Policy violations trigger automated tool containment | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 9.3.1: Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model + operations. +- 9.3.2: Verify that tool outputs are validated against schemas. + +**Tier 2 - Short-term (first 30 days):** + +- 9.5.1: Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict + which tools an agent may invoke, and which param... +- 9.3.3: Verify that tool manifests declare required privileges, resource limits, and output validation requirements. +- 9.3.4: Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared + in tool manifests. +- 9.3.7: Verify that external resources named in model output are verified against an approved allow-list or registry + before the agent installs or invokes them. +- 10.2.5: Verify that MCP servers enforce access control on every tool invocation, validating that the user's access + token authorizes both the requested tool and the s... + +**Tier 3 - Strategic:** + +- 9.3.8: Verify that policy violations trigger automated tool containment. + +#### Cross-references + +- LLM Top 10: LLM10, LLM03, LLM08 +- Agentic: N/A +- DSGAI: DSGAI06, DSGAI12, DSGAI07, DSGAI08 +- See also: the AISVS chapters listed above at + +--- + +### ASI03 - Identity and Privilege Abuse + +AISVS makes the agent a first-class principal rather than a credential holder. C9.4.1 requires a unique cryptographic +identity per agent instance, C9.5.2 requires a scope-limited user context token enforced at every downstream call, and +C10.2 adds OAuth 2.1 token validation on the MCP path. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. | [9.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity | +| Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho... | [9.5.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call | +| Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi... | [9.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Secrets and credentials required at runtime kept out of the model observable context | +| Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens. | [5.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication) | Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens | +| Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe... | [5.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication) | Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change | +| Verify that agent identity credentials rotate on a defined schedule. | [9.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 3. Agent identity credentials rotate on a defined schedule | +| Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum... | [5.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry | +| Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1. | [10.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope | +| Verify that MCP servers validate access tokens for each request and do not rely on transport security alone. | [10.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone | +| Verify that the policy decision point for agent authorization is isolated from the agent's execution environment. | [5.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary | +| Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action. | [9.5.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 10.2.2: Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims + in accordance with OAuth 2.1. +- 10.2.1: Verify that MCP servers validate access tokens for each request and do not rely on transport security alone. + +**Tier 2 - Short-term (first 30 days):** + +- 9.4.1: Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class + principal to downstream systems. +- 9.5.2: Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited + token that carries the user's authorization c... +- 9.5.4: Verify that secrets and credentials required by an agent at runtime are not exposed within the model's + observable context, including the context window, syst... +- 5.2.5: Verify that the policy decision point for agent authorization is isolated from the agent's execution + environment. + +**Tier 3 - Strategic:** + +- 5.1.2: Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, + cryptographically signed tokens. +- 5.1.1: Verify that high-risk AI operations (model deployment, weight export, training data access, production + configuration changes) require step-up authentication. +- 9.4.3: Verify that agent identity credentials rotate on a defined schedule. +- 5.2.6: Verify that privileged access to model weights, training pipelines, and production AI configuration is granted + just in time, with a defined maximum session d... +- 9.5.6: Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged + action. + +#### Cross-references + +- LLM Top 10: LLM03, LLM01 +- Agentic: N/A +- DSGAI: DSGAI02, DSGAI10, DSGAI11, DSGAI06, DSGAI08 +- See also: the AISVS chapters listed above at + +--- + +### ASI04 - Agentic Supply Chain + +AISVS covers the runtime-fetched supply chain that static inventory misses. C10.1 requires trusted sources and +allow-listed MCP servers, C9.3.7 requires allow-list verification of resources named in model output, and C10.4.8 +requires re-approval when a tool definition changes. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that MCP components are obtained only from trusted sources and cryptographically verified. | [10.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 1. MCP components obtained only from trusted sources and cryptographically verified | +| Verify that only allow-listed MCP servers are permitted. | [10.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 2. Only allow-listed MCP servers permitted | +| Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. | [6.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 1. Model weights, datasets and adapters downloaded only from approved sources | +| Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state... | [6.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring) | Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing | +| Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t... | [9.3.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components | +| Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access. | [10.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access | +| Verify that every third-party model artifact can be integrity-verified. | [6.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 2. Every third-party model artifact is integrity-verifiable | +| Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t... | [10.4.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 10.1.1: Verify that MCP components are obtained only from trusted sources and cryptographically verified. +- 6.1.2: Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. +- 6.2.1: Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, + weights, licenses, and data-origin statements. + +**Tier 2 - Short-term (first 30 days):** + +- 10.1.2: Verify that only allow-listed MCP servers are permitted. +- 9.3.7: Verify that external resources named in model output are verified against an approved allow-list or registry + before the agent installs or invokes them. +- 10.1.3: Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, + network, and system access. +- 6.1.3: Verify that every third-party model artifact can be integrity-verified. + +**Tier 3 - Strategic:** + +- 10.4.8: Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition + triggers re-approval before the modified tool can be... + +#### Cross-references + +- LLM Top 10: LLM04, LLM09, LLM10 +- Agentic: N/A +- DSGAI: DSGAI04, DSGAI06, DSGAI19 +- See also: the AISVS chapters listed above at + +--- + +### ASI05 - Unexpected Code Execution + +AISVS treats generated code as untrusted output requiring a sandbox. C9.3.1 and C4.1.1 require isolated execution, +C4.1.2 blocks code execution during artifact deserialization, and C9.1.1 caps the blast radius of anything that does +execute. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. | [9.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations | +| Verify that AI models execute in isolated sandboxes. | [4.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation) | Level 1. AI models execute in isolated sandboxes | +| Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese... | [4.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation) | Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas before consumption | +| Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. | [7.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement) | Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter | +| Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. | [9.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code | +| Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production). | [3.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices) | Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production | +| Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. | [9.3.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Architectural separation between processing of untrusted tool outputs and agent operations | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 9.3.1: Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model + operations. +- 4.1.1: Verify that AI models execute in isolated sandboxes. +- 4.1.2: Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit + arbitrary code execution during deserialization. +- 9.3.2: Verify that tool outputs are validated against schemas. +- 7.1.1: Verify that the application validates all model outputs against a defined schema and rejects any output that + does not match. +- 9.1.1: Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. +- 3.4.1: Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, + staging, production). + +**Tier 2 - Short-term (first 30 days):** + +- 9.3.6: Verify that there is architectural separation between processing of untrusted tool outputs and agent + operations. + +**Tier 3 - Strategic:** + +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM10, LLM08, LLM04, LLM02, LLM01, LLM03 +- Agentic: N/A +- DSGAI: DSGAI12, DSGAI13, DSGAI06, DSGAI05, DSGAI08 +- See also: the AISVS chapters listed above at + +--- + +### ASI06 - Memory and Context Poisoning + +AISVS addresses memory poisoning as a write-path access control problem. C8.2.3 requires explicit source validation +before agent or tool output enters trusted memory, C12.5.4 tags every ingested document with source and writer identity, +and C8.3 provides quarantine and reset as recovery. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation. | [8.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control | +| Verify that document metadata tags are immutable after the initial write. | [8.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Document metadata tags immutable after initial write | +| Verify that every ingested document is tagged at write time with source, writer identity, and timestamp. | [12.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable | +| Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. | [8.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization | +| Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts. | [8.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting | +| Verify that memory can be reset. | [8.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed | +| Verify that quarantined content is retained but excluded from all retrieval results. | [8.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure | +| Verify that agent state persisted between invocations is integrity-protected. | [9.4.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 3. Agent state persisted between invocations is integrity-protected | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- No AISVS Level 1 requirement maps to this entry + +**Tier 2 - Short-term (first 30 days):** + +- 8.2.3: Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without + explicit source validation. +- 8.1.2: Verify that document metadata tags are immutable after the initial write. +- 12.5.4: Verify that every ingested document is tagged at write time with source, writer identity, and timestamp. +- 8.3.2: Verify that memory can be reset. + +**Tier 3 - Strategic:** + +- 8.2.4: Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before + vectorization. +- 8.2.5: Verify that new content written to memory is checked for contradictions with what is already stored and that + conflicts trigger alerts. +- 8.3.3: Verify that quarantined content is retained but excluded from all retrieval results. +- 9.4.4: Verify that agent state persisted between invocations is integrity-protected. + +#### Cross-references + +- LLM Top 10: LLM05, LLM09, LLM02, LLM04 +- Agentic: N/A +- DSGAI: DSGAI04, DSGAI13, DSGAI06, DSGAI08 +- See also: the AISVS chapters listed above at + +--- + +### ASI07 - Insecure Inter-Agent Communications + +AISVS covers inter-agent communication mainly through the MCP transport chapter. C10.3 requires authenticated encrypted +transport, independent Origin and Host validation, and minimum protocol version enforcement, while C9.4 supplies the +cryptographic agent identity that makes spoofing detectable. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services. | [10.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport | +| Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. | [9.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control | +| Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation. | [9.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation | +| Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att... | [10.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding | +| Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum. | [10.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade | +| Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts. | [10.4.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay | +| Verify that inter-agent task delegation is restricted by an explicit authorization policy. | [9.5.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Inter-agent task delegation restricted by an explicit authorization policy | +| Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP. | [10.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 10.3.1: Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services. + +**Tier 2 - Short-term (first 30 days):** + +- 9.4.1: Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class + principal to downstream systems. +- 9.4.2: Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for + non-repudiation. +- 10.3.3: Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based + transports to prevent DNS rebinding attacks. +- 10.3.4: Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that + propose a version below that minimum. +- 10.4.6: Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay + attempts. +- 9.5.5: Verify that inter-agent task delegation is restricted by an explicit authorization policy. + +**Tier 3 - Strategic:** + +- 10.3.5: Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP. + +#### Cross-references + +- LLM Top 10: LLM04, LLM03, LLM01 +- Agentic: N/A +- DSGAI: DSGAI02, DSGAI16, DSGAI17, DSGAI06 +- See also: the AISVS chapters listed above at + +--- + +### ASI08 - Cascading Agent Failures + +AISVS treats cascade as a containment problem. C9.1.3 requires a swarm-level kill-switch able to halt all active agent +instances, C9.6.3 requires the kill-switch channel to be out-of-band from the agent runtime, and C9.2.10 requires +chain-wide approval gates to take the highest-impact classification present. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that a swarm-level kill-switch exists that can halt all active agent instances. | [9.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure | +| Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. | [9.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-execution budgets including max recursion depth bound runaway amplification | +| Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. | [9.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-tool quotas and timeouts contain a single failing component | +| Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. | [9.6.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 1. Manual kill-switch to immediately halt model inference and outputs | +| Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime. | [9.6.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise | +| Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ... | [9.2.10](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain | +| Verify that policy violations trigger automated tool containment. | [9.3.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 3. Policy violations trigger automated tool containment | +| Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift. | [12.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection) | Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 9.1.2: Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and + enforced by the runtime. +- 9.1.1: Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. +- 9.6.1: Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. + +**Tier 2 - Short-term (first 30 days):** + +- 9.1.3: Verify that a swarm-level kill-switch exists that can halt all active agent instances. + +**Tier 3 - Strategic:** + +- 9.6.3: Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent + runtime. +- 9.2.10: Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact + reversibility classification present anywhere in the chain. +- 9.3.8: Verify that policy violations trigger automated tool containment. +- 12.3.4: Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift. + +#### Cross-references + +- LLM Top 10: LLM06, LLM01, LLM05 +- Agentic: N/A +- DSGAI: DSGAI17, DSGAI05 +- See also: the AISVS chapters listed above at + +--- + +### ASI09 - Human-Agent Trust Exploitation + +AISVS makes the human approval gate resistant to a persuasive agent. C9.2.2 requires canonicalized complete action +parameters shown without truncation, C9.2.8 cryptographically binds the approval to those exact parameters, and C9.6.2 +blocks rather than proceeds when approval times out. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc... | [9.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving | +| Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action. | [9.6.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure | +| Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through... | [9.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection | +| Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. | [7.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source | +| Verify that the system assesses the reliability of generated answers using a confidence estimation method. | [7.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation) | Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency | +| Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes. | [12.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring) | Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes | +| Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce. | [9.2.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 7.4.1: Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source + documents. + +**Tier 2 - Short-term (first 30 days):** + +- 9.2.2: Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, + recipients, amounts, resources, and scopes, with... +- 9.6.2: Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the + pending action. +- 9.2.7: Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and + cannot be overridden or bypassed through prompt in... +- 7.2.1: Verify that the system assesses the reliability of generated answers using a confidence estimation method. +- 12.4.2: Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, + action parameters, and decision outcomes. + +**Tier 3 - Strategic:** + +- 9.2.8: Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, + and a unique single-use nonce. + +#### Cross-references + +- LLM Top 10: LLM07, LLM03 +- Agentic: N/A +- DSGAI: DSGAI21, DSGAI04, DSGAI06, DSGAI18 +- See also: the AISVS chapters listed above at + +--- + +### ASI10 - Rogue Agents + +AISVS detects rogue behaviour through telemetry and immutability. C12.1 and C12.2 require AI-specific logging and +behavioural anomaly detection, C12.5.3 requires immutable model change records, and C9.2.5 stops an agent widening its +own boundary through self-modification. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that AI interactions are logged with session context and AI-specific telemetry. | [12.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging) | Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control | +| Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors. | [12.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors | +| Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation. | [9.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation | +| Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. | [9.6.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 1. Manual kill-switch to immediately halt inference and outputs | +| Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries. | [9.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope | +| Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment. | [12.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring) | Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment | +| Verify that kill-switch activations and override commands are logged. | [12.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring) | Level 2. Kill-switch activations and override commands logged | +| Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2... | [12.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures | +| Verify that all model changes generate immutable audit records. | [12.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** + +- 12.1.1: Verify that AI interactions are logged with session context and AI-specific telemetry. +- 9.6.1: Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. + +**Tier 2 - Short-term (first 30 days):** + +- 12.2.2: Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, + or probing behaviors. +- 9.4.2: Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for + non-repudiation. +- 9.2.5: Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is + restricted by enforceable boundaries. +- 12.4.1: Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and + threat-landscape assessment. +- 12.4.3: Verify that kill-switch activations and override commands are logged. +- 12.5.3: Verify that all model changes generate immutable audit records. + +**Tier 3 - Strategic:** + +- 12.2.6: Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to + identify malware and command-and-control (C2) activity. + +#### Cross-references + +- LLM Top 10: LLM03, LLM06, LLM10 +- Agentic: ASI01, ASI02, ASI03, ASI05, ASI04, ASI06, ASI07, ASI08, ASI09 +- DSGAI: DSGAI16, DSGAI03, DSGAI19, DSGAI02, DSGAI17, DSGAI06 +- See also: the AISVS chapters listed above at + +--- + +## Implementation priority table + +| Priority | AISVS components | Entries addressed | +|---|---|---| +| P1 - Pre-production gate | All Level 1 requirements | ASI01, ASI02, ASI03, ASI04, ASI05, ASI07, ASI08, ASI09, ASI10 | +| P2 - First 30 days | All Level 2 requirements | ASI01, ASI02, ASI03, ASI04, ASI05, ASI06, ASI07, ASI08, ASI09, ASI10 | +| P3 - Programme maturity | All Level 3 requirements | ASI02, ASI03, ASI04, ASI06, ASI07, ASI08, ASI09, ASI10 | + +--- + +## References + +- [OWASP AISVS project + page](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/) +- [OWASP AISVS 1.0 frozen text](https://github.com/OWASP/AISVS/tree/main/1.0/en) +- [OWASP Top 10 for Agentic Applications 2026 - + OWASP](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) +- [shared/TEMPLATE.md](../shared/TEMPLATE.md) + +--- + +## Changelog + +| Version | Date | Change | +|---|---|---| +| 1.0.0 | 2026-08-28 | Initial release - full mapping of ASI01-ASI10 to OWASP AISVS 1.0 | +| 1.0.1 | 2026-09-14 | Ported from GenAI-Security-Project/GenAI-Data-Security-Initiative#64 (the monorepo copy of crosswalk/) to this repo. LLM Top 10 cross-references renumbered to the 2026 list per MIGRATION.md; source-list title, links and footer aligned with this repo. Mappings unchanged | + +--- + +*Part of the [OWASP GenAI Crosswalk](https://github.com/GenAI-Security-Project/crosswalk) - maintained by the [OWASP +GenAI Data Security Initiative](https://genai.owasp.org)* +*License: [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)* diff --git a/data/backlinks.json b/data/backlinks.json index f562936..c687221 100644 --- a/data/backlinks.json +++ b/data/backlinks.json @@ -28745,6 +28745,3044 @@ } ] }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Data integrity provided when training data is stored and transferred" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.1", + "control_name": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.2", + "control_name": "Verify that cryptographic integrity is applied to labeling artifacts.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Cryptographic integrity applied to labeling artifacts" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.2", + "control_name": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Automatically generated labels subject to confidence thresholds and consistency checks" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.3", + "control_name": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Models used in security-relevant decisions evaluated for bias patterns" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.1", + "control_name": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP components obtained only from trusted sources and cryptographically verified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Only allow-listed MCP servers permitted" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.1", + "control_name": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.2", + "control_name": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.3", + "control_name": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.4", + "control_name": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "entries": [ + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.5", + "control_name": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.6", + "control_name": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers ensure all session artifacts are removed when a session terminates" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.7", + "control_name": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.1", + "control_name": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.3", + "control_name": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att...", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.4", + "control_name": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.5", + "control_name": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.1", + "control_name": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "entries": [ + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.4", + "control_name": "Verify that all MCP servers enforce strict schema validation.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All MCP servers enforce strict schema validation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.6", + "control_name": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.7", + "control_name": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.8", + "control_name": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t...", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "entries": [ + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "entries": [ + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.3", + "control_name": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.4", + "control_name": "Verify that detection of suspected extraction triggers response measures.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Detection of suspected extraction triggers response measures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.4.3", + "control_name": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i...", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.1", + "control_name": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.2", + "control_name": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m...", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.4", + "control_name": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.2", + "control_name": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.6", + "control_name": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2...", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.1", + "control_name": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match...", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "entries": [ + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.4", + "control_name": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.1", + "control_name": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.2", + "control_name": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.3", + "control_name": "Verify that kill-switch activations and override commands are logged.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Kill-switch activations and override commands logged" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "entries": [ + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.2", + "control_name": "Verify that all labeling activities are recorded in logs.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All labeling activities recorded in logs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "entries": [ + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.3", + "control_name": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.4", + "control_name": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Coordinated attacks spanning multiple input types detected and blocked" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.3", + "control_name": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.2.3", + "control_name": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.1", + "control_name": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Production deployments implement rollout mechanisms with automated rollback triggers" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.2", + "control_name": "Verify that rollback capabilities restore the complete model state.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Rollback capabilities restore the complete model state" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.3", + "control_name": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.4.1", + "control_name": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.2", + "control_name": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.4", + "control_name": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.1", + "control_name": "Verify that AI models execute in isolated sandboxes.", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. AI models execute in isolated sandboxes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.4", + "control_name": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Confidential inference services protect model weights during runtime through isolated execution environments" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.1", + "control_name": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.3", + "control_name": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Inference runtimes enforce process, memory and file access isolation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.4", + "control_name": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.1", + "control_name": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.1", + "control_name": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici...", + "entries": [ + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.5", + "control_name": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Classification labels propagate to prompt caches and model outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.1", + "control_name": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing...", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.2", + "control_name": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica...", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and adapters downloaded only from approved sources" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.3", + "control_name": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All model outputs validated against a defined schema and rejected when they do not match" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.4", + "control_name": "Verify that generated media is watermarked to prove it was AI-generated.", + "entries": [ + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Generated media watermarked to prove it was AI-generated" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "entries": [ + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "entries": [ + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "entries": [ + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.5", + "control_name": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "entries": [ + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, supporting deletion obligations against agent memory" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.3", + "control_name": "Verify that quarantined content is retained but excluded from all retrieval results.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts contain a single failing component" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Per-execution budgets including max recursion depth bound runaway amplification" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.3", + "control_name": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.10", + "control_name": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ...", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.2", + "control_name": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc...", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "entries": [ + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.6", + "control_name": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.7", + "control_name": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through...", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.8", + "control_name": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.9", + "control_name": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Key material or credentials used to issue approvals isolated from the agent runtime" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas before consumption" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.5", + "control_name": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Policy violations trigger automated tool containment" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Policy violations trigger automated tool containment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.4", + "control_name": "Verify that agent state persisted between invocations is integrity-protected.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Agent state persisted between invocations is integrity-protected" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.2", + "control_name": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "entries": [ + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Secrets and credentials required at runtime kept out of the model observable context" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.5", + "control_name": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Inter-agent task delegation restricted by an explicit authorization policy" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.6", + "control_name": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt inference and outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.2", + "control_name": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.3", + "control_name": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise" + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V1 Architecture", diff --git a/data/entries/ASI01.json b/data/entries/ASI01.json index 03816a6..ad443da 100644 --- a/data/entries/ASI01.json +++ b/data/entries/ASI01.json @@ -947,6 +947,94 @@ "notes": "Share agent goal hijacking threat intelligence with sector peers through DORA information sharing arrangements", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.5", + "control_name": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.6", + "control_name": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json index 5653b89..4c3409f 100644 --- a/data/entries/ASI02.json +++ b/data/entries/ASI02.json @@ -927,6 +927,94 @@ "notes": "Include agent access control bypass in resilience testing; verify that agents cannot exceed defined permission boundaries under adversarial conditions", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.5", + "control_name": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 3. Policy violations trigger automated tool containment", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/ASI03.json b/data/entries/ASI03.json index 03bd17f..6bd0ea7 100644 --- a/data/entries/ASI03.json +++ b/data/entries/ASI03.json @@ -997,6 +997,127 @@ "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.2", + "control_name": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials required at runtime kept out of the model observable context", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.1", + "control_name": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.2", + "control_name": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.1", + "control_name": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.5", + "control_name": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.6", + "control_name": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/ASI04.json b/data/entries/ASI04.json index bb56709..178822d 100644 --- a/data/entries/ASI04.json +++ b/data/entries/ASI04.json @@ -928,6 +928,94 @@ "notes": "Include agent supply chain disruption in resilience testing; test fallback procedures for third-party tool and service failures", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.1", + "control_name": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 1. MCP components obtained only from trusted sources and cryptographically verified", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Only allow-listed MCP servers permitted", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and adapters downloaded only from approved sources", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.8", + "control_name": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -1086,7 +1174,8 @@ "crossrefs": { "llm_top10": [ "LLM04", - "LLM09" + "LLM09", + "LLM10" ], "dsgai_2026": [ "DSGAI04", diff --git a/data/entries/ASI05.json b/data/entries/ASI05.json index d333cbe..f3eae8a 100644 --- a/data/entries/ASI05.json +++ b/data/entries/ASI05.json @@ -917,6 +917,94 @@ "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.1", + "control_name": "Verify that AI models execute in isolated sandboxes.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. AI models execute in isolated sandboxes", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas before consumption", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.4.1", + "control_name": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices", + "notes": "Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -1078,7 +1166,8 @@ "LLM08", "LLM04", "LLM01", - "LLM03" + "LLM03", + "LLM02" ], "dsgai_2026": [ "DSGAI12", diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json index 16f47cd..98ae736 100644 --- a/data/entries/ASI06.json +++ b/data/entries/ASI06.json @@ -908,6 +908,94 @@ "notes": "Conduct post-incident analysis for memory poisoning events; trace poisoned content to source and assess impact on agent decisions", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.5", + "control_name": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.3", + "control_name": "Verify that quarantined content is retained but excluded from all retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.4", + "control_name": "Verify that agent state persisted between invocations is integrity-protected.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent state persisted between invocations is integrity-protected", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -1058,7 +1146,8 @@ "llm_top10": [ "LLM05", "LLM09", - "LLM02" + "LLM02", + "LLM04" ], "dsgai_2026": [ "DSGAI04", diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json index 8b783ee..2ddf292 100644 --- a/data/entries/ASI07.json +++ b/data/entries/ASI07.json @@ -908,6 +908,94 @@ "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.1", + "control_name": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.3", + "control_name": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.4", + "control_name": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.6", + "control_name": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.5", + "control_name": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Inter-agent task delegation restricted by an explicit authorization policy", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.5", + "control_name": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json index a7fd38c..dd1ba2a 100644 --- a/data/entries/ASI08.json +++ b/data/entries/ASI08.json @@ -908,6 +908,94 @@ "notes": "Include cascading automation risk in ICT risk management; define acceptable multi-agent coupling thresholds and circuit breaker requirements", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.3", + "control_name": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets including max recursion depth bound runaway amplification", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts contain a single failing component", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.3", + "control_name": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.10", + "control_name": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 3. Policy violations trigger automated tool containment", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.4", + "control_name": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -1019,7 +1107,8 @@ "crossrefs": { "llm_top10": [ "LLM06", - "LLM01" + "LLM01", + "LLM05" ], "dsgai_2026": [ "DSGAI17", diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json index 4d8f185..a5d41f7 100644 --- a/data/entries/ASI09.json +++ b/data/entries/ASI09.json @@ -897,6 +897,83 @@ "notes": "Include emerging agentic architecture security in resilience testing; assess novel patterns for resilience implications before production deployment", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.2", + "control_name": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.2", + "control_name": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.7", + "control_name": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.2", + "control_name": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.8", + "control_name": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json index ecda105..f7724f6 100644 --- a/data/entries/ASI10.json +++ b/data/entries/ASI10.json @@ -936,6 +936,105 @@ "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.1", + "control_name": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.2", + "control_name": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt inference and outputs", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.1", + "control_name": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.3", + "control_name": "Verify that kill-switch activations and override commands are logged.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Kill-switch activations and override commands logged", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.6", + "control_name": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -1098,7 +1197,8 @@ "llm_top10": [ "LLM03", "LLM06", - "LLM04" + "LLM04", + "LLM10" ], "agentic_top10": [ "ASI01", diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json index 174aedc..bdeafcf 100644 --- a/data/entries/DSGAI01.json +++ b/data/entries/DSGAI01.json @@ -845,6 +845,83 @@ "notes": "Classify material AI data access violations as ICT-related incidents; report to competent authorities per DORA incident classification and reporting requirements", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -1095,7 +1172,8 @@ "LLM02", "LLM01", "LLM05", - "LLM08" + "LLM08", + "LLM04" ], "agentic_top10": [ "ASI03", diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json index 39d4b3a..b466ccd 100644 --- a/data/entries/DSGAI02.json +++ b/data/entries/DSGAI02.json @@ -836,6 +836,83 @@ "notes": "Monitor AI data flows for undocumented data movement; alert on data transfers outside documented pipelines", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.3", + "control_name": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.7", + "control_name": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.9", + "control_name": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Key material or credentials used to issue approvals isolated from the agent runtime", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -969,7 +1046,8 @@ "LLM03", "LLM05", "LLM04", - "LLM07" + "LLM07", + "LLM10" ] }, "changelog": [ diff --git a/data/entries/DSGAI03.json b/data/entries/DSGAI03.json index 84057cc..64ad0c0 100644 --- a/data/entries/DSGAI03.json +++ b/data/entries/DSGAI03.json @@ -787,6 +787,72 @@ "notes": "Define approved AI tools policy in ICT risk management framework; require vetting and approval before use in financial data processing", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.2.3", + "control_name": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing", + "notes": "Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -886,7 +952,8 @@ "llm_top10": [ "LLM04", "LLM02", - "LLM03" + "LLM03", + "LLM10" ], "agentic_top10": [ "ASI04", diff --git a/data/entries/DSGAI04.json b/data/entries/DSGAI04.json index 9fbc616..a4b70b8 100644 --- a/data/entries/DSGAI04.json +++ b/data/entries/DSGAI04.json @@ -867,6 +867,94 @@ "notes": "Conduct post-incident analysis for data poisoning events; trace poisoned content and update protection controls", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.3", + "control_name": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.2", + "control_name": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.4.3", + "control_name": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection", + "notes": "Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -989,7 +1077,8 @@ "llm_top10": [ "LLM04", "LLM05", - "LLM09" + "LLM09", + "LLM10" ], "agentic_top10": [ "ASI06", diff --git a/data/entries/DSGAI05.json b/data/entries/DSGAI05.json index 6d57eab..a069b09 100644 --- a/data/entries/DSGAI05.json +++ b/data/entries/DSGAI05.json @@ -771,6 +771,105 @@ "notes": "Include external data sources in third-party risk management; assess data quality, provenance practices, and licensing compliance", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Data integrity provided when training data is stored and transferred", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. All model outputs validated against a defined schema and rejected when they do not match", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.4", + "control_name": "Verify that all MCP servers enforce strict schema validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. All MCP servers enforce strict schema validation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.2", + "control_name": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Automatically generated labels subject to confidence thresholds and consistency checks", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.3", + "control_name": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.1", + "control_name": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI06.json b/data/entries/DSGAI06.json index 12856eb..7c8b08a 100644 --- a/data/entries/DSGAI06.json +++ b/data/entries/DSGAI06.json @@ -779,6 +779,83 @@ "notes": "Include data lineage requirements in ICT risk management; define minimum lineage completeness per data sensitivity", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.1", + "control_name": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.4", + "control_name": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI07.json b/data/entries/DSGAI07.json index 01622ca..24aefe5 100644 --- a/data/entries/DSGAI07.json +++ b/data/entries/DSGAI07.json @@ -788,6 +788,83 @@ "notes": "Monitor for excessive data aggregation patterns; alert on dataset combinations exceeding defined sensitivity thresholds", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, supporting deletion obligations against agent memory", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -877,7 +954,8 @@ "LLM02", "LLM03", "LLM05", - "LLM09" + "LLM09", + "LLM04" ], "agentic_top10": [ "ASI03", diff --git a/data/entries/DSGAI08.json b/data/entries/DSGAI08.json index 91ff362..7ea553a 100644 --- a/data/entries/DSGAI08.json +++ b/data/entries/DSGAI08.json @@ -799,6 +799,72 @@ "notes": "Conduct post-incident analysis for data leakage events; identify root cause and update controls", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.3", + "control_name": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Models used in security-relevant decisions evaluated for bias patterns", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI09.json b/data/entries/DSGAI09.json index 728d8c9..fba4240 100644 --- a/data/entries/DSGAI09.json +++ b/data/entries/DSGAI09.json @@ -770,6 +770,61 @@ "notes": "Deploy detection for IP exfiltration attempts; monitor model weight access and download patterns", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.3", + "control_name": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "notes": "Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.4", + "control_name": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "notes": "Level 3. Coordinated attacks spanning multiple input types detected and blocked", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -904,7 +959,8 @@ "LLM02", "LLM05", "LLM09", - "LLM04" + "LLM04", + "LLM10" ], "agentic_top10": [ "ASI03", diff --git a/data/entries/DSGAI10.json b/data/entries/DSGAI10.json index f88fcc7..e1cfe0e 100644 --- a/data/entries/DSGAI10.json +++ b/data/entries/DSGAI10.json @@ -702,6 +702,61 @@ "notes": "Apply lessons learned from synthetic data privacy failures; update generation processes and validation controls", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -818,7 +873,8 @@ "LLM01", "LLM09", "LLM07", - "LLM05" + "LLM05", + "LLM04" ], "agentic_top10": [ "ASI03", diff --git a/data/entries/DSGAI11.json b/data/entries/DSGAI11.json index 2334c4e..664e0f8 100644 --- a/data/entries/DSGAI11.json +++ b/data/entries/DSGAI11.json @@ -758,6 +758,72 @@ "notes": "Enforce retention policies through automated deletion and crypto-shredding; prevent retention beyond defined periods", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.1", + "control_name": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "notes": "Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.3", + "control_name": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.6", + "control_name": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers ensure all session artifacts are removed when a session terminates", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.2", + "control_name": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "notes": "Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -870,7 +936,8 @@ "LLM02", "LLM08", "LLM05", - "LLM09" + "LLM09", + "LLM04" ], "dsgai_2026": [ "DSGAI13" diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json index a7ec25a..75a4bd2 100644 --- a/data/entries/DSGAI12.json +++ b/data/entries/DSGAI12.json @@ -807,6 +807,83 @@ "notes": "Map ownership for all AI data assets; document rights, restrictions, and licensing for training data and outputs", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI13.json b/data/entries/DSGAI13.json index ccc281a..e03c0ba 100644 --- a/data/entries/DSGAI13.json +++ b/data/entries/DSGAI13.json @@ -789,6 +789,83 @@ "notes": "Classify AI data misuse as ICT-related incidents where customer or regulatory impact occurs; report per DORA criteria", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.1", + "control_name": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -908,7 +985,8 @@ "LLM09", "LLM08", "LLM03", - "LLM05" + "LLM05", + "LLM04" ], "agentic_top10": [ "ASI06", diff --git a/data/entries/DSGAI14.json b/data/entries/DSGAI14.json index a5e28d4..00c10e9 100644 --- a/data/entries/DSGAI14.json +++ b/data/entries/DSGAI14.json @@ -777,6 +777,72 @@ "notes": "Monitor for AI processing inconsistent with consent status; alert on violations", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.4", + "control_name": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.2", + "control_name": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI15.json b/data/entries/DSGAI15.json index 69956f7..e4c77c1 100644 --- a/data/entries/DSGAI15.json +++ b/data/entries/DSGAI15.json @@ -759,6 +759,72 @@ "notes": "Document data necessity justification for each AI data asset; map minimum required data per use case", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Classification labels propagate to prompt caches and model outputs", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI16.json b/data/entries/DSGAI16.json index f31601b..6690b3c 100644 --- a/data/entries/DSGAI16.json +++ b/data/entries/DSGAI16.json @@ -789,6 +789,83 @@ "notes": "Monitor for privacy degradation indicators; detect inference attacks, re-identification attempts, and memorisation in model outputs", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.7", + "control_name": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.3", + "control_name": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 3. Inference runtimes enforce process, memory and file access isolation", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.1", + "control_name": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI17.json b/data/entries/DSGAI17.json index 5c4422e..c9b18c3 100644 --- a/data/entries/DSGAI17.json +++ b/data/entries/DSGAI17.json @@ -780,6 +780,83 @@ "notes": "Apply lessons learned from bias incidents; update training data, model parameters, and controls based on fairness assessments", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.1", + "control_name": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Production deployments implement rollout mechanisms with automated rollback triggers", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.2", + "control_name": "Verify that rollback capabilities restore the complete model state.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Rollback capabilities restore the complete model state", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.4", + "control_name": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json index 3d3394a..ca266be 100644 --- a/data/entries/DSGAI18.json +++ b/data/entries/DSGAI18.json @@ -711,6 +711,83 @@ "notes": "Map all AI systems subject to governance; ensure complete coverage of AI data assets in governance framework", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -785,7 +862,8 @@ "LLM09", "LLM03", "LLM04", - "LLM07" + "LLM07", + "LLM10" ], "dsgai_2026": [ "DSGAI10", diff --git a/data/entries/DSGAI19.json b/data/entries/DSGAI19.json index 4ac6ef2..e794e4f 100644 --- a/data/entries/DSGAI19.json +++ b/data/entries/DSGAI19.json @@ -759,6 +759,61 @@ "notes": "Participate in information sharing arrangements for third-party AI data risks; share threat intelligence on data provider compromises", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.1", + "control_name": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.2", + "control_name": "Verify that cryptographic integrity is applied to labeling artifacts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Cryptographic integrity applied to labeling artifacts", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.2", + "control_name": "Verify that all labeling activities are recorded in logs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. All labeling activities recorded in logs", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -866,7 +921,8 @@ "llm_top10": [ "LLM02", "LLM04", - "LLM05" + "LLM05", + "LLM10" ], "agentic_top10": [ "ASI10", diff --git a/data/entries/DSGAI20.json b/data/entries/DSGAI20.json index ee8335c..d4c9e9e 100644 --- a/data/entries/DSGAI20.json +++ b/data/entries/DSGAI20.json @@ -769,6 +769,94 @@ "notes": "Map physical and logical locations of all AI data; document processing jurisdictions for training, inference, and storage", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.4", + "control_name": "Verify that detection of suspected extraction triggers response measures.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 3. Detection of suspected extraction triggers response measures", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.3", + "control_name": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.4", + "control_name": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 3. Confidential inference services protect model weights during runtime through isolated execution environments", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.4", + "control_name": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ @@ -874,7 +962,8 @@ "LLM02", "LLM05", "LLM08", - "LLM04" + "LLM04", + "LLM10" ], "dsgai_2026": [ "DSGAI18", diff --git a/data/entries/DSGAI21.json b/data/entries/DSGAI21.json index fef0346..8397673 100644 --- a/data/entries/DSGAI21.json +++ b/data/entries/DSGAI21.json @@ -998,6 +998,94 @@ "notes": "Map all AI data subject to regulatory requirements; ensure complete coverage in compliance programme", "confidence": "unreviewed", "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output", + "confidence": "unreviewed", + "reviewed_by": [] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.4", + "control_name": "Verify that generated media is watermarked to prove it was AI-generated.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 3. Generated media watermarked to prove it was AI-generated", + "confidence": "unreviewed", + "reviewed_by": [] } ], "tools": [ diff --git a/data/framework-sources.json b/data/framework-sources.json index 9de0be6..23612b1 100644 --- a/data/framework-sources.json +++ b/data/framework-sources.json @@ -154,6 +154,14 @@ "source_url": "https://owasp.org/www-project-ai-security-and-privacy-guide/", "notes": "" }, + "owasp-aisvs": { + "name": "OWASP AISVS 1.0", + "mapped_version": "1.0", + "current_version": "1.0", + "checked": "2026-09-14", + "source_url": "https://github.com/OWASP/AISVS/tree/main/1.0/en", + "notes": "Verified against the frozen OWASP/AISVS 1.0/en chapter files: 191 requirements, ids, text and levels identical to the registry. No tagged release upstream; 1.01-dev is in development and not yet released." + }, "owasp-asvs": { "name": "OWASP ASVS 4.0.3", "mapped_version": "4.0.3", diff --git a/data/frameworks/owasp-aisvs.json b/data/frameworks/owasp-aisvs.json new file mode 100644 index 0000000..9536e73 --- /dev/null +++ b/data/frameworks/owasp-aisvs.json @@ -0,0 +1,1752 @@ +{ + "id": "owasp-aisvs", + "name": "OWASP AISVS 1.0", + "short_name": "AISVS", + "version": "1.0", + "url": "https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/", + "license": "CC BY-SA 4.0", + "publisher": "OWASP", + "category": "appsec", + "last_synced": "2026-09-14", + "source_sha": null, + "controls": [ + { + "control_id": "1.1.1", + "title": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "description": "AISVS 1.0 Level 1 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "kind": "control" + }, + { + "control_id": "1.1.2", + "title": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use constraints, and processing history.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use constraints, and processing history.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "kind": "control" + }, + { + "control_id": "1.1.3", + "title": "Verify that data integrity is provided when training data is stored and transferred.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that data integrity is provided when training data is stored and transferred.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "kind": "control" + }, + { + "control_id": "1.1.4", + "title": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "kind": "control" + }, + { + "control_id": "1.1.5", + "title": "Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.", + "description": "AISVS 1.0 Level 3 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "kind": "control" + }, + { + "control_id": "1.2.1", + "title": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "description": "AISVS 1.0 Level 1 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "kind": "control" + }, + { + "control_id": "1.2.2", + "title": "Verify that cryptographic integrity is applied to labeling artifacts.", + "description": "AISVS 1.0 Level 2 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that cryptographic integrity is applied to labeling artifacts.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "kind": "control" + }, + { + "control_id": "1.2.3", + "title": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "description": "AISVS 1.0 Level 2 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "kind": "control" + }, + { + "control_id": "1.3.1", + "title": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in training data.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in training data.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "kind": "control" + }, + { + "control_id": "1.3.2", + "title": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "kind": "control" + }, + { + "control_id": "1.3.3", + "title": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "kind": "control" + }, + { + "control_id": "1.3.4", + "title": "Verify that disallowed content is detected and removed before training.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that disallowed content is detected and removed before training.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "kind": "control" + }, + { + "control_id": "1.3.5", + "title": "Verify that defenses against clean-label poisoning attacks are implemented.", + "description": "AISVS 1.0 Level 3 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that defenses against clean-label poisoning attacks are implemented.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "kind": "control" + }, + { + "control_id": "2.1.1", + "title": "Verify that input normalization is applied before tokenization or embedding.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that input normalization is applied before tokenization or embedding.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.2", + "title": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.3", + "title": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.4", + "title": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.5", + "title": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters that are explicitly required.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters that are explicitly required.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.6", + "title": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even after user instructions have been processed.", + "description": "AISVS 1.0 Level 2 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even after user instructions have been processed.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.7", + "title": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "description": "AISVS 1.0 Level 2 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.1.8", + "title": "Verify that the system can detect many-shot jailbreaking patterns.", + "description": "AISVS 1.0 Level 3 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system can detect many-shot jailbreaking patterns.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "kind": "control" + }, + { + "control_id": "2.2.1", + "title": "Verify that every prompt is scored by a content classifier for violence, self-harm, hate, and sexual content against configurable thresholds. Prompts that exceed those thresholds are rejected or sanitized before reaching the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that every prompt is scored by a content classifier for violence, self-harm, hate, and sexual content against configurable thresholds. Prompts that exceed those thresholds are rejected or sanitized before reaching the model context.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "kind": "control" + }, + { + "control_id": "2.2.2", + "title": "Verify that prompt content classification is evaluated for unsupported languages.", + "description": "AISVS 1.0 Level 1 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that prompt content classification is evaluated for unsupported languages.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "kind": "control" + }, + { + "control_id": "2.2.3", + "title": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known attack patterns.", + "description": "AISVS 1.0 Level 2 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known attack patterns.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "kind": "control" + }, + { + "control_id": "2.2.4", + "title": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.", + "description": "AISVS 1.0 Level 3 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "kind": "control" + }, + { + "control_id": "3.1.1", + "title": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "description": "AISVS 1.0 Level 1 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "kind": "control" + }, + { + "control_id": "3.1.2", + "title": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.", + "description": "AISVS 1.0 Level 2 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "kind": "control" + }, + { + "control_id": "3.1.3", + "title": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "description": "AISVS 1.0 Level 2 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that model cryptographic signatures are verified at deployment admission and on load.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "kind": "control" + }, + { + "control_id": "3.2.1", + "title": "Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.", + "description": "AISVS 1.0 Level 1 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing", + "kind": "control" + }, + { + "control_id": "3.2.2", + "title": "Verify that models subjected to post-training quantization are re-evaluated against the same safety and alignment test suite on the compressed artifact before deployment.", + "description": "AISVS 1.0 Level 2 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that models subjected to post-training quantization are re-evaluated against the same safety and alignment test suite on the compressed artifact before deployment.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing", + "kind": "control" + }, + { + "control_id": "3.2.3", + "title": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "description": "AISVS 1.0 Level 3 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing", + "kind": "control" + }, + { + "control_id": "3.3.1", + "title": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "kind": "control" + }, + { + "control_id": "3.3.2", + "title": "Verify that rollback capabilities restore the complete model state.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that rollback capabilities restore the complete model state.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "kind": "control" + }, + { + "control_id": "3.3.3", + "title": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "kind": "control" + }, + { + "control_id": "3.4.1", + "title": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "description": "AISVS 1.0 Level 1 requirement in section C3.4 Secure Development Practices, chapter C3 Model Lifecycle Management & Change Control. Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices", + "kind": "control" + }, + { + "control_id": "3.4.2", + "title": "Verify that model training and fine-tuning environments are isolated from production environments.", + "description": "AISVS 1.0 Level 2 requirement in section C3.4 Secure Development Practices, chapter C3 Model Lifecycle Management & Change Control. Verify that model training and fine-tuning environments are isolated from production environments.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices", + "kind": "control" + }, + { + "control_id": "3.5.1", + "title": "Verify that models used in RLHF fine-tuning are versioned and integrity-verified before use in a training run.", + "description": "AISVS 1.0 Level 2 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that models used in RLHF fine-tuning are versioned and integrity-verified before use in a training run.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "kind": "control" + }, + { + "control_id": "3.5.2", + "title": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "kind": "control" + }, + { + "control_id": "3.5.3", + "title": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "kind": "control" + }, + { + "control_id": "3.5.4", + "title": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "kind": "control" + }, + { + "control_id": "4.1.1", + "title": "Verify that AI models execute in isolated sandboxes.", + "description": "AISVS 1.0 Level 1 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI models execute in isolated sandboxes.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "kind": "control" + }, + { + "control_id": "4.1.2", + "title": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.", + "description": "AISVS 1.0 Level 1 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "kind": "control" + }, + { + "control_id": "4.1.3", + "title": "Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.", + "description": "AISVS 1.0 Level 3 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "kind": "control" + }, + { + "control_id": "4.1.4", + "title": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "description": "AISVS 1.0 Level 3 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "kind": "control" + }, + { + "control_id": "4.2.1", + "title": "Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.", + "description": "AISVS 1.0 Level 2 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security", + "kind": "control" + }, + { + "control_id": "4.2.2", + "title": "Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security", + "kind": "control" + }, + { + "control_id": "4.2.3", + "title": "Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security", + "kind": "control" + }, + { + "control_id": "4.2.4", + "title": "Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security", + "kind": "control" + }, + { + "control_id": "4.2.5", + "title": "Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security", + "kind": "control" + }, + { + "control_id": "4.3.1", + "title": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "description": "AISVS 1.0 Level 1 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "kind": "control" + }, + { + "control_id": "4.3.2", + "title": "Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.", + "description": "AISVS 1.0 Level 2 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "kind": "control" + }, + { + "control_id": "4.3.3", + "title": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that inference runtimes enforce process, memory, and file access isolation.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "kind": "control" + }, + { + "control_id": "4.3.4", + "title": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "kind": "control" + }, + { + "control_id": "4.3.5", + "title": "Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "kind": "control" + }, + { + "control_id": "5.1.1", + "title": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.", + "description": "AISVS 1.0 Level 3 requirement in section C5.1 Authentication, chapter C5 Access Control & Identity for AI Components & Users. Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "kind": "control" + }, + { + "control_id": "5.1.2", + "title": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "description": "AISVS 1.0 Level 3 requirement in section C5.1 Authentication, chapter C5 Access Control & Identity for AI Components & Users. Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "kind": "control" + }, + { + "control_id": "5.2.1", + "title": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.2.2", + "title": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.2.3", + "title": "Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.2.4", + "title": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.2.5", + "title": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.2.6", + "title": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.", + "description": "AISVS 1.0 Level 3 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.2.7", + "title": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "description": "AISVS 1.0 Level 3 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "kind": "control" + }, + { + "control_id": "5.3.1", + "title": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.", + "description": "AISVS 1.0 Level 2 requirement in section C5.3 Multi-Tenant Isolation, chapter C5 Access Control & Identity for AI Components & Users. Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "kind": "control" + }, + { + "control_id": "5.3.2", + "title": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requires hardware partitioning, confidential computing, or dedicated per-tenant compute allocation.", + "description": "AISVS 1.0 Level 3 requirement in section C5.3 Multi-Tenant Isolation, chapter C5 Access Control & Identity for AI Components & Users. Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requires hardware partitioning, confidential computing, or dedicated per-tenant compute allocation.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "kind": "control" + }, + { + "control_id": "6.1.1", + "title": "Verify that models are scanned for malicious code before import.", + "description": "AISVS 1.0 Level 1 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that models are scanned for malicious code before import.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "kind": "control" + }, + { + "control_id": "6.1.2", + "title": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "description": "AISVS 1.0 Level 1 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "kind": "control" + }, + { + "control_id": "6.1.3", + "title": "Verify that every third-party model artifact can be integrity-verified.", + "description": "AISVS 1.0 Level 2 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that every third-party model artifact can be integrity-verified.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "kind": "control" + }, + { + "control_id": "6.1.4", + "title": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "description": "AISVS 1.0 Level 2 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "kind": "control" + }, + { + "control_id": "6.2.1", + "title": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.", + "description": "AISVS 1.0 Level 1 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "kind": "control" + }, + { + "control_id": "6.2.2", + "title": "Verify that AI BOMs are cryptographically signed before deployment.", + "description": "AISVS 1.0 Level 2 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that AI BOMs are cryptographically signed before deployment.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "kind": "control" + }, + { + "control_id": "6.2.3", + "title": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "description": "AISVS 1.0 Level 2 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "kind": "control" + }, + { + "control_id": "7.1.1", + "title": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "description": "AISVS 1.0 Level 1 requirement in section C7.1 Output Format Enforcement, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "kind": "control" + }, + { + "control_id": "7.1.2", + "title": "Verify that model-generated output is bounded by length limits and termination controls.", + "description": "AISVS 1.0 Level 1 requirement in section C7.1 Output Format Enforcement, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model-generated output is bounded by length limits and termination controls.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "kind": "control" + }, + { + "control_id": "7.2.1", + "title": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "description": "AISVS 1.0 Level 2 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "kind": "control" + }, + { + "control_id": "7.2.2", + "title": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "description": "AISVS 1.0 Level 2 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "kind": "control" + }, + { + "control_id": "7.2.3", + "title": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "description": "AISVS 1.0 Level 3 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "kind": "control" + }, + { + "control_id": "7.3.1", + "title": "Verify that automated classifiers scan every response and block content that matches defined harmful content categories.", + "description": "AISVS 1.0 Level 1 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that automated classifiers scan every response and block content that matches defined harmful content categories.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "kind": "control" + }, + { + "control_id": "7.3.2", + "title": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "description": "AISVS 1.0 Level 2 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "kind": "control" + }, + { + "control_id": "7.3.3", + "title": "Verify that model-generated output is prevented from triggering outbound requests.", + "description": "AISVS 1.0 Level 2 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model-generated output is prevented from triggering outbound requests.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "kind": "control" + }, + { + "control_id": "7.3.4", + "title": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.", + "description": "AISVS 1.0 Level 3 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "kind": "control" + }, + { + "control_id": "7.4.1", + "title": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "description": "AISVS 1.0 Level 1 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "kind": "control" + }, + { + "control_id": "7.4.2", + "title": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "description": "AISVS 1.0 Level 1 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "kind": "control" + }, + { + "control_id": "7.4.3", + "title": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "description": "AISVS 1.0 Level 2 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that claims in a RAG response can be traced to the retrieved chunk.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "kind": "control" + }, + { + "control_id": "7.4.4", + "title": "Verify that generated media is watermarked to prove it was AI-generated.", + "description": "AISVS 1.0 Level 3 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that generated media is watermarked to prove it was AI-generated.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "kind": "control" + }, + { + "control_id": "8.1.1", + "title": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "description": "AISVS 1.0 Level 1 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "kind": "control" + }, + { + "control_id": "8.1.2", + "title": "Verify that document metadata tags are immutable after the initial write.", + "description": "AISVS 1.0 Level 2 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that document metadata tags are immutable after the initial write.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "kind": "control" + }, + { + "control_id": "8.1.3", + "title": "Verify that retrieval operations enforce scope constraints.", + "description": "AISVS 1.0 Level 2 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that retrieval operations enforce scope constraints.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "kind": "control" + }, + { + "control_id": "8.2.1", + "title": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "description": "AISVS 1.0 Level 1 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "kind": "control" + }, + { + "control_id": "8.2.2", + "title": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "description": "AISVS 1.0 Level 2 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "kind": "control" + }, + { + "control_id": "8.2.3", + "title": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "description": "AISVS 1.0 Level 2 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "kind": "control" + }, + { + "control_id": "8.2.4", + "title": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "description": "AISVS 1.0 Level 3 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "kind": "control" + }, + { + "control_id": "8.2.5", + "title": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "description": "AISVS 1.0 Level 3 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "kind": "control" + }, + { + "control_id": "8.3.1", + "title": "Verify that expired vectors are excluded from retrieval results.", + "description": "AISVS 1.0 Level 2 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that expired vectors are excluded from retrieval results.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "kind": "control" + }, + { + "control_id": "8.3.2", + "title": "Verify that memory can be reset.", + "description": "AISVS 1.0 Level 2 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that memory can be reset.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "kind": "control" + }, + { + "control_id": "8.3.3", + "title": "Verify that quarantined content is retained but excluded from all retrieval results.", + "description": "AISVS 1.0 Level 3 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that quarantined content is retained but excluded from all retrieval results.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "kind": "control" + }, + { + "control_id": "9.1.1", + "title": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "description": "AISVS 1.0 Level 1 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "kind": "control" + }, + { + "control_id": "9.1.2", + "title": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "description": "AISVS 1.0 Level 1 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "kind": "control" + }, + { + "control_id": "9.1.3", + "title": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "description": "AISVS 1.0 Level 2 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "kind": "control" + }, + { + "control_id": "9.2.1", + "title": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified.", + "description": "AISVS 1.0 Level 1 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.2", + "title": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.3", + "title": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.4", + "title": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.5", + "title": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.6", + "title": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.7", + "title": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.8", + "title": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.9", + "title": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.2.10", + "title": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "kind": "control" + }, + { + "control_id": "9.3.1", + "title": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "description": "AISVS 1.0 Level 1 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.2", + "title": "Verify that tool outputs are validated against schemas.", + "description": "AISVS 1.0 Level 1 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that tool outputs are validated against schemas.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.3", + "title": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.4", + "title": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.5", + "title": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.6", + "title": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.7", + "title": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.3.8", + "title": "Verify that policy violations trigger automated tool containment.", + "description": "AISVS 1.0 Level 3 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that policy violations trigger automated tool containment.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "kind": "control" + }, + { + "control_id": "9.4.1", + "title": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "description": "AISVS 1.0 Level 2 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "kind": "control" + }, + { + "control_id": "9.4.2", + "title": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "description": "AISVS 1.0 Level 2 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "kind": "control" + }, + { + "control_id": "9.4.3", + "title": "Verify that agent identity credentials rotate on a defined schedule.", + "description": "AISVS 1.0 Level 3 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent identity credentials rotate on a defined schedule.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "kind": "control" + }, + { + "control_id": "9.4.4", + "title": "Verify that agent state persisted between invocations is integrity-protected.", + "description": "AISVS 1.0 Level 3 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent state persisted between invocations is integrity-protected.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "kind": "control" + }, + { + "control_id": "9.5.1", + "title": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "kind": "control" + }, + { + "control_id": "9.5.2", + "title": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization context and is enforced at every downstream call.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization context and is enforced at every downstream call.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "kind": "control" + }, + { + "control_id": "9.5.3", + "title": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "kind": "control" + }, + { + "control_id": "9.5.4", + "title": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "kind": "control" + }, + { + "control_id": "9.5.5", + "title": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "kind": "control" + }, + { + "control_id": "9.5.6", + "title": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "description": "AISVS 1.0 Level 3 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "kind": "control" + }, + { + "control_id": "9.6.1", + "title": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "description": "AISVS 1.0 Level 1 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "kind": "control" + }, + { + "control_id": "9.6.2", + "title": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "description": "AISVS 1.0 Level 2 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "kind": "control" + }, + { + "control_id": "9.6.3", + "title": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "description": "AISVS 1.0 Level 3 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "kind": "control" + }, + { + "control_id": "10.1.1", + "title": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "description": "AISVS 1.0 Level 1 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "kind": "control" + }, + { + "control_id": "10.1.2", + "title": "Verify that only allow-listed MCP servers are permitted.", + "description": "AISVS 1.0 Level 2 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that only allow-listed MCP servers are permitted.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "kind": "control" + }, + { + "control_id": "10.1.3", + "title": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "description": "AISVS 1.0 Level 2 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "kind": "control" + }, + { + "control_id": "10.2.1", + "title": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.2.2", + "title": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.2.3", + "title": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.2.4", + "title": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.2.5", + "title": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.2.6", + "title": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.2.7", + "title": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "kind": "control" + }, + { + "control_id": "10.3.1", + "title": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "description": "AISVS 1.0 Level 1 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "kind": "control" + }, + { + "control_id": "10.3.2", + "title": "Verify that stdio transport is permitted only in controlled local environments.", + "description": "AISVS 1.0 Level 1 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that stdio transport is permitted only in controlled local environments.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "kind": "control" + }, + { + "control_id": "10.3.3", + "title": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.", + "description": "AISVS 1.0 Level 2 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "kind": "control" + }, + { + "control_id": "10.3.4", + "title": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "description": "AISVS 1.0 Level 2 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "kind": "control" + }, + { + "control_id": "10.3.5", + "title": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "description": "AISVS 1.0 Level 3 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "kind": "control" + }, + { + "control_id": "10.4.1", + "title": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.2", + "title": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.3", + "title": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.4", + "title": "Verify that all MCP servers enforce strict schema validation.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that all MCP servers enforce strict schema validation.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.5", + "title": "Verify that all MCP transports enforce maximum payload size limits.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that all MCP transports enforce maximum payload size limits.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.6", + "title": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.7", + "title": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "10.4.8", + "title": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.", + "description": "AISVS 1.0 Level 3 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "kind": "control" + }, + { + "control_id": "11.1.1", + "title": "Verify that the model has undergone alignment and safety training or fine-tuning to prevent the model from generating disallowed content categories.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that the model has undergone alignment and safety training or fine-tuning to prevent the model from generating disallowed content categories.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "kind": "control" + }, + { + "control_id": "11.1.2", + "title": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that a version-controlled alignment test suite is run on every model update or release.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "kind": "control" + }, + { + "control_id": "11.1.3", + "title": "Verify that models are evaluated against known adversarial attack techniques relevant to their modality.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that models are evaluated against known adversarial attack techniques relevant to their modality.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "kind": "control" + }, + { + "control_id": "11.1.4", + "title": "Verify that models are hardened against adversarial inputs.", + "description": "AISVS 1.0 Level 2 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that models are hardened against adversarial inputs.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "kind": "control" + }, + { + "control_id": "11.1.5", + "title": "Verify that an automated evaluator measures harmful-content rate and flags regressions beyond a defined threshold.", + "description": "AISVS 1.0 Level 3 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that an automated evaluator measures harmful-content rate and flags regressions beyond a defined threshold.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "kind": "control" + }, + { + "control_id": "11.2.1", + "title": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "description": "AISVS 1.0 Level 1 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "kind": "control" + }, + { + "control_id": "11.2.2", + "title": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.", + "description": "AISVS 1.0 Level 1 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "kind": "control" + }, + { + "control_id": "11.2.3", + "title": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "description": "AISVS 1.0 Level 2 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that model outputs are calibrated to reduce overconfident predictions.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "kind": "control" + }, + { + "control_id": "11.2.4", + "title": "Verify that training on sensitive datasets employs differentially-private optimization.", + "description": "AISVS 1.0 Level 2 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that training on sensitive datasets employs differentially-private optimization.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "kind": "control" + }, + { + "control_id": "11.2.5", + "title": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "description": "AISVS 1.0 Level 3 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "kind": "control" + }, + { + "control_id": "11.3.1", + "title": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "description": "AISVS 1.0 Level 1 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that query-pattern analysis feeds an extraction-attempt detector.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "kind": "control" + }, + { + "control_id": "11.3.2", + "title": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.", + "description": "AISVS 1.0 Level 2 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "kind": "control" + }, + { + "control_id": "11.3.3", + "title": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "description": "AISVS 1.0 Level 3 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "kind": "control" + }, + { + "control_id": "11.3.4", + "title": "Verify that detection of suspected extraction triggers response measures.", + "description": "AISVS 1.0 Level 3 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that detection of suspected extraction triggers response measures.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "kind": "control" + }, + { + "control_id": "11.4.1", + "title": "Verify that inputs from external or untrusted sources pass through anomaly detection before model inference.", + "description": "AISVS 1.0 Level 2 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that inputs from external or untrusted sources pass through anomaly detection before model inference.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection", + "kind": "control" + }, + { + "control_id": "11.4.2", + "title": "Verify that inputs flagged as anomalous trigger gating actions.", + "description": "AISVS 1.0 Level 2 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that inputs flagged as anomalous trigger gating actions.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection", + "kind": "control" + }, + { + "control_id": "11.4.3", + "title": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement mechanism.", + "description": "AISVS 1.0 Level 3 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement mechanism.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection", + "kind": "control" + }, + { + "control_id": "12.1.1", + "title": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "description": "AISVS 1.0 Level 1 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that AI interactions are logged with session context and AI-specific telemetry.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "kind": "control" + }, + { + "control_id": "12.1.2", + "title": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "kind": "control" + }, + { + "control_id": "12.1.3", + "title": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "kind": "control" + }, + { + "control_id": "12.1.4", + "title": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "kind": "control" + }, + { + "control_id": "12.2.1", + "title": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "description": "AISVS 1.0 Level 1 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "kind": "control" + }, + { + "control_id": "12.2.2", + "title": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "kind": "control" + }, + { + "control_id": "12.2.3", + "title": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "kind": "control" + }, + { + "control_id": "12.2.4", + "title": "Verify that extraction-alert events include offending query metadata to support investigation.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that extraction-alert events include offending query metadata to support investigation.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "kind": "control" + }, + { + "control_id": "12.2.5", + "title": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "kind": "control" + }, + { + "control_id": "12.2.6", + "title": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.", + "description": "AISVS 1.0 Level 3 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "kind": "control" + }, + { + "control_id": "12.3.1", + "title": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the input data type (e.g., KS test or PSI for tabular numeric features, embedding-distance metrics for text or image).", + "description": "AISVS 1.0 Level 1 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the input data type (e.g., KS test or PSI for tabular numeric features, embedding-distance metrics for text or image).", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "kind": "control" + }, + { + "control_id": "12.3.2", + "title": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information.", + "description": "AISVS 1.0 Level 2 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "kind": "control" + }, + { + "control_id": "12.3.3", + "title": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "description": "AISVS 1.0 Level 2 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "kind": "control" + }, + { + "control_id": "12.3.4", + "title": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "description": "AISVS 1.0 Level 3 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "kind": "control" + }, + { + "control_id": "12.4.1", + "title": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "kind": "control" + }, + { + "control_id": "12.4.2", + "title": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "kind": "control" + }, + { + "control_id": "12.4.3", + "title": "Verify that kill-switch activations and override commands are logged.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that kill-switch activations and override commands are logged.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "kind": "control" + }, + { + "control_id": "12.5.1", + "title": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "description": "AISVS 1.0 Level 1 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "kind": "control" + }, + { + "control_id": "12.5.2", + "title": "Verify that all labeling activities are recorded in logs.", + "description": "AISVS 1.0 Level 1 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that all labeling activities are recorded in logs.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "kind": "control" + }, + { + "control_id": "12.5.3", + "title": "Verify that all model changes generate immutable audit records.", + "description": "AISVS 1.0 Level 2 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that all model changes generate immutable audit records.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "kind": "control" + }, + { + "control_id": "12.5.4", + "title": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "description": "AISVS 1.0 Level 2 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "kind": "control" + } + ], + "changelog": [ + { + "date": "2026-08-28", + "change": "Initial submission. OWASP AISVS 1.0 (frozen 1.0/en, June 2026): 12 chapters, 44 sections, 191 verification requirements. Levels map to tiers as L1 Foundational, L2 Hardening, L3 Advanced.", + "author": "ottosulin" + }, + { + "date": "2026-09-14", + "change": "Ported to GenAI-Security-Project/crosswalk from GenAI-Data-Security-Initiative#64. Added kind: control to all 191 items and an inventory_completeness block (this repo's registry format). Requirement ids, text and levels re-verified against OWASP/AISVS 1.0/en on 2026-09-14: 191 of 191 identical.", + "author": "OWASP GenAI Data Security Initiative" + } + ], + "inventory_completeness": { + "status": "complete", + "included": 191, + "total": 191, + "note": "AISVS 1.0 is a frozen release (1.0/en) of 191 verification requirements; all 191 are present, verified against the upstream chapter files on 2026-09-14.", + "source": "https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/" + } +} diff --git a/data/stats.json b/data/stats.json index 9f0abb2..b61c71d 100644 --- a/data/stats.json +++ b/data/stats.json @@ -27,17 +27,17 @@ } }, "mappings": { - "total": 3497, + "total": 3721, "by_list": { - "Agentic-Top10-2026": 910, + "Agentic-Top10-2026": 993, "AST-Top10-2026": 36, - "DSGAI-2026": 1647, + "DSGAI-2026": 1788, "LLM-Top10-2026": 904 } }, "frameworks": { - "registries": 25, - "mapped": 25, + "registries": 26, + "mapped": 26, "unmapped_registries": [], "draft_only": [ "CoSAI", @@ -46,17 +46,17 @@ "draft_rows": 286, "by_list": { "LLM-Top10-2026": 25, - "Agentic-Top10-2026": 25, - "DSGAI-2026": 23, + "Agentic-Top10-2026": 26, + "DSGAI-2026": 24, "AST-Top10-2026": 1 } }, "mapping_files": { - "total": 74, + "total": 76, "by_list": { "LLM-Top10-2026": 25, - "Agentic-Top10-2026": 25, - "DSGAI-2026": 23, + "Agentic-Top10-2026": 26, + "DSGAI-2026": 24, "AST-Top10-2026": 1 } }, @@ -64,8 +64,8 @@ "total": 131 }, "freshness": { - "checked": 3, - "current": 2, + "checked": 4, + "current": 3, "diverged": 1, "unchecked": 22, "diverged_frameworks": [ @@ -78,10 +78,10 @@ ] }, "controls": { - "total": 1372, - "registry_items": 1514, + "total": 1563, + "registry_items": 1705, "by_kind": { - "control": 1372, + "control": 1563, "layer": 10, "technique": 50, "threat-category": 6, diff --git a/docs/FRESHNESS_SLA.md b/docs/FRESHNESS_SLA.md index c047030..575e113 100644 --- a/docs/FRESHNESS_SLA.md +++ b/docs/FRESHNESS_SLA.md @@ -66,9 +66,9 @@ point. it through the stats markers. 4. `npm run watch` monitors upstream sources. -The chain only works if `current_version` is populated. **22 of 25 frameworks +The chain only works if `current_version` is populated. **22 of 26 frameworks are unchecked**, so the honest reading today is that freshness is measured for -three frameworks and unknown for the rest. +four frameworks and unknown for the rest. ## Filling in an unchecked framework diff --git a/docs/agentic-ai-top10/index.html b/docs/agentic-ai-top10/index.html index 3bb2125..382ba34 100644 --- a/docs/agentic-ai-top10/index.html +++ b/docs/agentic-ai-top10/index.html @@ -4,18 +4,18 @@ OWASP Top 10 for Agentic AI — Risks & Mitigations | GenAI Crosswalk - + - + - +