From 3d75598cdc115c8bb92ddca30882a1daca2e55fe Mon Sep 17 00:00:00 2001 From: Otto Sulin Date: Fri, 28 Aug 2026 17:41:52 +0300 Subject: [PATCH] Add OWASP AISVS 1.0 mapping across all three source lists --- crosswalk/README.md | 4 +- crosswalk/agentic-top10/Agentic_AISVS.md | 538 +++ crosswalk/data/backlinks.json | 3837 +++++++++++++++++++ crosswalk/data/entries/ASI01.json | 72 + crosswalk/data/entries/ASI02.json | 72 + crosswalk/data/entries/ASI03.json | 99 + crosswalk/data/entries/ASI04.json | 72 + crosswalk/data/entries/ASI05.json | 72 + crosswalk/data/entries/ASI06.json | 72 + crosswalk/data/entries/ASI07.json | 72 + crosswalk/data/entries/ASI08.json | 72 + crosswalk/data/entries/ASI09.json | 63 + crosswalk/data/entries/ASI10.json | 81 + crosswalk/data/entries/DSGAI01.json | 63 + crosswalk/data/entries/DSGAI02.json | 63 + crosswalk/data/entries/DSGAI03.json | 54 + crosswalk/data/entries/DSGAI04.json | 72 + crosswalk/data/entries/DSGAI05.json | 81 + crosswalk/data/entries/DSGAI06.json | 63 + crosswalk/data/entries/DSGAI07.json | 63 + crosswalk/data/entries/DSGAI08.json | 54 + crosswalk/data/entries/DSGAI09.json | 45 + crosswalk/data/entries/DSGAI10.json | 45 + crosswalk/data/entries/DSGAI11.json | 54 + crosswalk/data/entries/DSGAI12.json | 63 + crosswalk/data/entries/DSGAI13.json | 63 + crosswalk/data/entries/DSGAI14.json | 54 + crosswalk/data/entries/DSGAI15.json | 54 + crosswalk/data/entries/DSGAI16.json | 63 + crosswalk/data/entries/DSGAI17.json | 63 + crosswalk/data/entries/DSGAI18.json | 63 + crosswalk/data/entries/DSGAI19.json | 45 + crosswalk/data/entries/DSGAI20.json | 72 + crosswalk/data/entries/DSGAI21.json | 72 + crosswalk/data/entries/LLM01.json | 81 + crosswalk/data/entries/LLM02.json | 72 + crosswalk/data/entries/LLM03.json | 72 + crosswalk/data/entries/LLM04.json | 72 + crosswalk/data/entries/LLM05.json | 54 + crosswalk/data/entries/LLM06.json | 72 + crosswalk/data/entries/LLM07.json | 45 + crosswalk/data/entries/LLM08.json | 63 + crosswalk/data/entries/LLM09.json | 81 + crosswalk/data/entries/LLM10.json | 54 + crosswalk/data/frameworks/owasp-aisvs.json | 1549 ++++++++ crosswalk/docs/backlinks.js | 3841 +++++++++++++++++++- crosswalk/docs/data.js | 2684 +++++++++++++- crosswalk/docs/frameworks-registry.js | 1553 +++++++- crosswalk/docs/incidents.js | 2 +- crosswalk/dsgai-2026/DSGAI_AISVS.md | 955 +++++ crosswalk/llm-top10/LLM_AISVS.md | 521 +++ crosswalk/scripts/generate.js | 3 + 52 files changed, 18161 insertions(+), 8 deletions(-) create mode 100644 crosswalk/agentic-top10/Agentic_AISVS.md create mode 100644 crosswalk/data/frameworks/owasp-aisvs.json create mode 100644 crosswalk/dsgai-2026/DSGAI_AISVS.md create mode 100644 crosswalk/llm-top10/LLM_AISVS.md diff --git a/crosswalk/README.md b/crosswalk/README.md index 843f869..857cd64 100644 --- a/crosswalk/README.md +++ b/crosswalk/README.md @@ -10,7 +10,7 @@ Version Frameworks Controls - Mapping Files + Mapping Files npm

@@ -125,7 +125,7 @@ Every file answers one question: **which controls from framework X address vulne |---|---| | **3** source lists | LLM Top 10 · Agentic Top 10 · DSGAI 2026 | | **25** frameworks | Compliance · Governance · Threat modeling · Testing · OT/ICS · Identity · Secure SDLC · Financial | -| **67** mapping files | Every source list entry × every applicable framework | +| **70** mapping files | Every source list entry × every applicable framework | | **21** implementation recipes | Production-ready Python patterns | | **70+** open-source tools | Catalogued and organised by function | | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries | diff --git a/crosswalk/agentic-top10/Agentic_AISVS.md b/crosswalk/agentic-top10/Agentic_AISVS.md new file mode 100644 index 0000000..0b1b0cc --- /dev/null +++ b/crosswalk/agentic-top10/Agentic_AISVS.md @@ -0,0 +1,538 @@ + + +# OWASP Top 10 for Agentic AI Applications 2026 × OWASP AISVS 1.0 + +Mapping the [OWASP Top 10 for Agentic AI Applications 2026](https://genai.owasp.org/resource/agentic-ai-top-10/) to the [OWASP Artificial Intelligence Security Verification Standard 1.0](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/), a technical verification standard of 191 testable requirements across 12 chapters, used by engineers and auditors to verify that a specific AI system implements a control rather than merely documents it. + +--- + +## Why AISVS for this source list + +Most frameworks already in this crosswalk answer the question of what an organisation should govern. AISVS answers a different question: given a running AI system, what does an assessor check, and what does a pass look like. Every requirement is written to be independently verifiable and starts with the words Verify that. + +That makes this mapping the bridge between a risk in this source list and a concrete test an engineer can run. Where ISO 42001 or NIST AI RMF establish that a control must exist, AISVS states the condition that demonstrates it does. The two are complements, not substitutes, and reading them together turns a control objective into an audit step. + +AISVS also assigns each requirement a level from 1 to 3 reflecting implementation difficulty and how situational the control is. That maps cleanly onto the tier model used throughout this crosswalk, so the tier column below carries real information about sequencing rather than a subjective judgement. + +--- + +## AISVS structure + +| Chapter | Description | Requirements | +|---|---|---| +| [C1 Training Data Integrity & Traceability](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md) | This chapter addresses protecting the integrity and traceability of training data as it is sourced, handled, and maintained. | 13 | +| [C2 Input Validation](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C02-Input-Validation.md) | This chapter addresses validation of all inputs as a first-line defense against prompt injection, one of the most damaging attacks on AI systems. | 12 | +| [C3 Model Lifecycle Management & Change Control](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md) | This chapter addresses control of model changes so that unauthorized or unsafe modifications cannot reach production. | 15 | +| [C4 Infrastructure, Configuration & Deployment Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C04-Infrastructure.md) | This chapter addresses hardening AI-specific infrastructure components against model theft, data leakage, and cross-tenant contamination. | 14 | +| [C5 Access Control & Identity for AI Components & Users](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C05-Access-Control-and-Identity.md) | This chapter addresses access control challenges that AI systems introduce beyond traditional application security. | 11 | +| [C6 Supply Chain Security for Models](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C06-Supply-Chain.md) | This chapter addresses defending against AI supply chain attacks that exploit third-party models, frameworks, or datasets to embed backdoors, bias, or exploitable code. | 7 | +| [C7 Model Behavior, Output Control & Safety Assurance](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C07-Model-Behavior.md) | This chapter addresses constraining, validating, and monitoring model outputs so that unsafe, malformed, or high-risk responses cannot reach users or downstream systems. | 13 | +| [C8 Memory, Embeddings & Vector Database Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md) | This chapter addresses securing the embeddings and vector stores that act as semi-persistent and persistent "memory" for AI systems through Retrieval-Augmented Generation (RAG). | 11 | +| [C9 Orchestration & Agentic Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md) | This chapter addresses ensuring autonomous and multi-agent systems execute only authorized, intended, and bounded actions. | 34 | +| [C10 Model Context Protocol (MCP) Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C10-MCP-Security.md) | This chapter addresses secure discovery, authentication, authorization, transport, and use of MCP-based tool and resource integrations. | 23 | +| [C11 Adversarial Robustness](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C11-Adversarial-Robustness.md) | This chapter addresses keeping AI systems reliable and abuse-resistant when facing evasion, inference, extraction, or poisoning attacks. | 17 | +| [C12 Monitoring, Logging & Anomaly Detection](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C12-Monitoring-and-Logging.md) | This chapter addresses real-time and forensic visibility into what the model and other AI components see, do, and return, so that AI-specific threats can be detected and triaged. | 21 | + +Levels map to crosswalk tiers as Level 1 Foundational, Level 2 Hardening, Level 3 Advanced. Where an entry maps to requirements at several levels, the tier column below reports the level most of its requirements sit at. + +--- + +## Quick-reference summary + +| ID | Name | Severity | Primary AISVS Controls | Tier | Scope | +|---|---|---|---|---|---| +| ASI01 | Agent Goal Hijack | Critical | C2.1, C10.4, C8.2, C9.3, C9.2, C12.2 | Hardening | Both | +| ASI02 | Tool Misuse and Exploitation | Critical | C9.5, C9.3, C10.2 | Hardening | Both | +| ASI03 | Identity and Privilege Abuse | Critical | C9.4, C9.5, C5.1, C5.2, C10.2 | Advanced | Both | +| ASI04 | Agentic Supply Chain | High | C10.1, C6.1, C6.2, C9.3, C10.4 | Hardening | Both | +| ASI05 | Unexpected Code Execution | Critical | C9.3, C4.1, C7.1, C9.1, C3.4 | Foundational | Both | +| ASI06 | Memory and Context Poisoning | High | C8.2, C8.1, C12.5, C8.3, C9.4 | Hardening | Both | +| ASI07 | Insecure Inter-Agent Communications | High | C10.3, C9.4, C10.4, C9.5 | Hardening | Both | +| ASI08 | Cascading Agent Failures | Critical | C9.1, C9.6, C9.2, C9.3, C12.3 | Advanced | Both | +| ASI09 | Human-Agent Trust Exploitation | High | C9.2, C9.6, C7.4, C7.2, C12.4 | Hardening | Both | +| ASI10 | Rogue Agents | Critical | C12.1, C12.2, C9.4, C9.6, C9.2, C12.4, C12.5 | Hardening | Both | + +--- + +## Target audience + +| Role | Sections to prioritise | +|---|---| +| Security engineer | C2 Input Validation, C9 Orchestration and Agentic Security, C10 MCP Security | +| Developer | C7 Model Behavior and Output Control, C8 Memory and Embeddings, C5 Access Control | +| ML engineer | C1 Training Data, C3 Model Lifecycle, C11 Adversarial Robustness | +| Auditor | The whole standard. Every requirement is written as a verifiable test | +| Compliance and GRC | C1 Training Data, C6 Supply Chain, C12 Monitoring and Logging | +| Red teamer | C2 Input Validation, C11 Adversarial Robustness, C9 Orchestration | + +--- + +## Detailed mappings + +--- + +### ASI01 - Agent Goal Hijack + +AISVS addresses goal hijack at both the injection point and the persistence point. C2.1 screens the steering input, C10.4.2 screens tool responses, and C8.2.3 stops unvalidated agent and tool output being written into trusted memory where a hijack would survive the session. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,... | [2.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector | +| Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu... | [2.1.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions | +| Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context. | [10.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path | +| Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation. | [8.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence | +| Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig... | [9.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act | +| Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries. | [9.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries | +| Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de... | [9.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate | +| Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs. | [12.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 2.1.3: Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flag... +- 10.4.2: Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context. +- 12.2.1: Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs. + +**Tier 2 - Short-term (first 30 days):** +- 2.1.6: Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even a... +- 8.2.3: Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation. +- 9.3.5: Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauth... +- 9.2.5: Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries. +- 9.2.6: Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministi... + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM01, LLM06 +- Agentic: N/A +- DSGAI: DSGAI01, DSGAI15, DSGAI12, DSGAI02 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI02 - Tool Misuse and Exploitation + +AISVS constrains tools declaratively and enforces the declaration. C9.3 requires tool manifests declaring privileges, resource limits and output validation, and requires the runtime to enforce them; C9.5.1 adds parameter-value level authorization so a legitimate tool cannot be called destructively. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w... | [9.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse | +| Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. | [9.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas | +| Verify that tool manifests declare required privileges, resource limits, and output validation requirements. | [9.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Tool manifests declare required privileges, resource limits and output validation requirements | +| Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests. | [9.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests | +| Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t... | [9.3.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation | +| Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool... | [10.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values | +| Verify that policy violations trigger automated tool containment. | [9.3.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 3. Policy violations trigger automated tool containment | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.3.1: Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. +- 9.3.2: Verify that tool outputs are validated against schemas. + +**Tier 2 - Short-term (first 30 days):** +- 9.5.1: Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which param... +- 9.3.3: Verify that tool manifests declare required privileges, resource limits, and output validation requirements. +- 9.3.4: Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests. +- 9.3.7: Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them. +- 10.2.5: Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the s... + +**Tier 3 - Strategic:** +- 9.3.8: Verify that policy violations trigger automated tool containment. + +#### Cross-references + +- LLM Top 10: LLM05, LLM06, LLM07 +- Agentic: N/A +- DSGAI: DSGAI06, DSGAI12, DSGAI07, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI03 - Identity and Privilege Abuse + +AISVS makes the agent a first-class principal rather than a credential holder. C9.4.1 requires a unique cryptographic identity per agent instance, C9.5.2 requires a scope-limited user context token enforced at every downstream call, and C10.2 adds OAuth 2.1 token validation on the MCP path. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. | [9.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity | +| Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho... | [9.5.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call | +| Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi... | [9.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Secrets and credentials required at runtime kept out of the model observable context | +| Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens. | [5.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication) | Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens | +| Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe... | [5.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication) | Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change | +| Verify that agent identity credentials rotate on a defined schedule. | [9.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 3. Agent identity credentials rotate on a defined schedule | +| Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum... | [5.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry | +| Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1. | [10.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope | +| Verify that MCP servers validate access tokens for each request and do not rely on transport security alone. | [10.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone | +| Verify that the policy decision point for agent authorization is isolated from the agent's execution environment. | [5.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary | +| Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action. | [9.5.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 10.2.2: Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1. +- 10.2.1: Verify that MCP servers validate access tokens for each request and do not rely on transport security alone. + +**Tier 2 - Short-term (first 30 days):** +- 9.4.1: Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. +- 9.5.2: Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization c... +- 9.5.4: Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, syst... +- 5.2.5: Verify that the policy decision point for agent authorization is isolated from the agent's execution environment. + +**Tier 3 - Strategic:** +- 5.1.2: Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens. +- 5.1.1: Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication. +- 9.4.3: Verify that agent identity credentials rotate on a defined schedule. +- 5.2.6: Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session d... +- 9.5.6: Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action. + +#### Cross-references + +- LLM Top 10: LLM06, LLM01 +- Agentic: N/A +- DSGAI: DSGAI02, DSGAI10, DSGAI11, DSGAI06, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI04 - Agentic Supply Chain + +AISVS covers the runtime-fetched supply chain that static inventory misses. C10.1 requires trusted sources and allow-listed MCP servers, C9.3.7 requires allow-list verification of resources named in model output, and C10.4.8 requires re-approval when a tool definition changes. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that MCP components are obtained only from trusted sources and cryptographically verified. | [10.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 1. MCP components obtained only from trusted sources and cryptographically verified | +| Verify that only allow-listed MCP servers are permitted. | [10.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 2. Only allow-listed MCP servers permitted | +| Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. | [6.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 1. Model weights, datasets and adapters downloaded only from approved sources | +| Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state... | [6.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring) | Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing | +| Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t... | [9.3.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components | +| Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access. | [10.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access | +| Verify that every third-party model artifact can be integrity-verified. | [6.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 2. Every third-party model artifact is integrity-verifiable | +| Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t... | [10.4.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 10.1.1: Verify that MCP components are obtained only from trusted sources and cryptographically verified. +- 6.1.2: Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. +- 6.2.1: Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements. + +**Tier 2 - Short-term (first 30 days):** +- 10.1.2: Verify that only allow-listed MCP servers are permitted. +- 9.3.7: Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them. +- 10.1.3: Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access. +- 6.1.3: Verify that every third-party model artifact can be integrity-verified. + +**Tier 3 - Strategic:** +- 10.4.8: Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be... + +#### Cross-references + +- LLM Top 10: LLM03, LLM08, LLM05 +- Agentic: N/A +- DSGAI: DSGAI04, DSGAI06, DSGAI19 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI05 - Unexpected Code Execution + +AISVS treats generated code as untrusted output requiring a sandbox. C9.3.1 and C4.1.1 require isolated execution, C4.1.2 blocks code execution during artifact deserialization, and C9.1.1 caps the blast radius of anything that does execute. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. | [9.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations | +| Verify that AI models execute in isolated sandboxes. | [4.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation) | Level 1. AI models execute in isolated sandboxes | +| Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese... | [4.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation) | Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas before consumption | +| Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. | [7.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement) | Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter | +| Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. | [9.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code | +| Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production). | [3.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices) | Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production | +| Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. | [9.3.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Architectural separation between processing of untrusted tool outputs and agent operations | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.3.1: Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. +- 4.1.1: Verify that AI models execute in isolated sandboxes. +- 4.1.2: Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization. +- 9.3.2: Verify that tool outputs are validated against schemas. +- 7.1.1: Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. +- 9.1.1: Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. +- 3.4.1: Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production). + +**Tier 2 - Short-term (first 30 days):** +- 9.3.6: Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM05, LLM07, LLM03, LLM02, LLM01, LLM06 +- Agentic: N/A +- DSGAI: DSGAI12, DSGAI13, DSGAI06, DSGAI05, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI06 - Memory and Context Poisoning + +AISVS addresses memory poisoning as a write-path access control problem. C8.2.3 requires explicit source validation before agent or tool output enters trusted memory, C12.5.4 tags every ingested document with source and writer identity, and C8.3 provides quarantine and reset as recovery. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation. | [8.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control | +| Verify that document metadata tags are immutable after the initial write. | [8.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Document metadata tags immutable after initial write | +| Verify that every ingested document is tagged at write time with source, writer identity, and timestamp. | [12.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable | +| Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. | [8.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization | +| Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts. | [8.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting | +| Verify that memory can be reset. | [8.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed | +| Verify that quarantined content is retained but excluded from all retrieval results. | [8.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure | +| Verify that agent state persisted between invocations is integrity-protected. | [9.4.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 3. Agent state persisted between invocations is integrity-protected | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- No AISVS Level 1 requirement maps to this entry + +**Tier 2 - Short-term (first 30 days):** +- 8.2.3: Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation. +- 8.1.2: Verify that document metadata tags are immutable after the initial write. +- 12.5.4: Verify that every ingested document is tagged at write time with source, writer identity, and timestamp. +- 8.3.2: Verify that memory can be reset. + +**Tier 3 - Strategic:** +- 8.2.4: Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. +- 8.2.5: Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts. +- 8.3.3: Verify that quarantined content is retained but excluded from all retrieval results. +- 9.4.4: Verify that agent state persisted between invocations is integrity-protected. + +#### Cross-references + +- LLM Top 10: LLM04, LLM08, LLM02, LLM03 +- Agentic: N/A +- DSGAI: DSGAI04, DSGAI13, DSGAI06, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI07 - Insecure Inter-Agent Communications + +AISVS covers inter-agent communication mainly through the MCP transport chapter. C10.3 requires authenticated encrypted transport, independent Origin and Host validation, and minimum protocol version enforcement, while C9.4 supplies the cryptographic agent identity that makes spoofing detectable. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services. | [10.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport | +| Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. | [9.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control | +| Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation. | [9.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation | +| Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att... | [10.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding | +| Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum. | [10.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade | +| Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts. | [10.4.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay | +| Verify that inter-agent task delegation is restricted by an explicit authorization policy. | [9.5.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Inter-agent task delegation restricted by an explicit authorization policy | +| Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP. | [10.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport) | Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 10.3.1: Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services. + +**Tier 2 - Short-term (first 30 days):** +- 9.4.1: Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. +- 9.4.2: Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation. +- 10.3.3: Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks. +- 10.3.4: Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum. +- 10.4.6: Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts. +- 9.5.5: Verify that inter-agent task delegation is restricted by an explicit authorization policy. + +**Tier 3 - Strategic:** +- 10.3.5: Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP. + +#### Cross-references + +- LLM Top 10: LLM03, LLM06, LLM01 +- Agentic: N/A +- DSGAI: DSGAI02, DSGAI16, DSGAI17, DSGAI06 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI08 - Cascading Agent Failures + +AISVS treats cascade as a containment problem. C9.1.3 requires a swarm-level kill-switch able to halt all active agent instances, C9.6.3 requires the kill-switch channel to be out-of-band from the agent runtime, and C9.2.10 requires chain-wide approval gates to take the highest-impact classification present. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that a swarm-level kill-switch exists that can halt all active agent instances. | [9.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure | +| Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. | [9.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-execution budgets including max recursion depth bound runaway amplification | +| Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. | [9.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-tool quotas and timeouts contain a single failing component | +| Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. | [9.6.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 1. Manual kill-switch to immediately halt model inference and outputs | +| Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime. | [9.6.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise | +| Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ... | [9.2.10](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain | +| Verify that policy violations trigger automated tool containment. | [9.3.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 3. Policy violations trigger automated tool containment | +| Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift. | [12.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection) | Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.1.2: Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. +- 9.1.1: Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. +- 9.6.1: Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. + +**Tier 2 - Short-term (first 30 days):** +- 9.1.3: Verify that a swarm-level kill-switch exists that can halt all active agent instances. + +**Tier 3 - Strategic:** +- 9.6.3: Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime. +- 9.2.10: Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain. +- 9.3.8: Verify that policy violations trigger automated tool containment. +- 12.3.4: Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift. + +#### Cross-references + +- LLM Top 10: LLM10, LLM01, LLM04 +- Agentic: N/A +- DSGAI: DSGAI17, DSGAI05 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI09 - Human-Agent Trust Exploitation + +AISVS makes the human approval gate resistant to a persuasive agent. C9.2.2 requires canonicalized complete action parameters shown without truncation, C9.2.8 cryptographically binds the approval to those exact parameters, and C9.6.2 blocks rather than proceeds when approval times out. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc... | [9.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving | +| Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action. | [9.6.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure | +| Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through... | [9.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection | +| Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. | [7.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source | +| Verify that the system assesses the reliability of generated answers using a confidence estimation method. | [7.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation) | Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency | +| Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes. | [12.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring) | Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes | +| Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce. | [9.2.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 7.4.1: Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. + +**Tier 2 - Short-term (first 30 days):** +- 9.2.2: Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, with... +- 9.6.2: Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action. +- 9.2.7: Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt in... +- 7.2.1: Verify that the system assesses the reliability of generated answers using a confidence estimation method. +- 12.4.2: Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes. + +**Tier 3 - Strategic:** +- 9.2.8: Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce. + +#### Cross-references + +- LLM Top 10: LLM09, LLM06 +- Agentic: N/A +- DSGAI: DSGAI21, DSGAI04, DSGAI06, DSGAI18 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### ASI10 - Rogue Agents + +AISVS detects rogue behaviour through telemetry and immutability. C12.1 and C12.2 require AI-specific logging and behavioural anomaly detection, C12.5.3 requires immutable model change records, and C9.2.5 stops an agent widening its own boundary through self-modification. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that AI interactions are logged with session context and AI-specific telemetry. | [12.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging) | Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control | +| Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors. | [12.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors | +| Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation. | [9.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation | +| Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. | [9.6.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 1. Manual kill-switch to immediately halt inference and outputs | +| Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries. | [9.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope | +| Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment. | [12.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring) | Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment | +| Verify that kill-switch activations and override commands are logged. | [12.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring) | Level 2. Kill-switch activations and override commands logged | +| Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2... | [12.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures | +| Verify that all model changes generate immutable audit records. | [12.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 12.1.1: Verify that AI interactions are logged with session context and AI-specific telemetry. +- 9.6.1: Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. + +**Tier 2 - Short-term (first 30 days):** +- 12.2.2: Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors. +- 9.4.2: Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation. +- 9.2.5: Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries. +- 12.4.1: Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment. +- 12.4.3: Verify that kill-switch activations and override commands are logged. +- 12.5.3: Verify that all model changes generate immutable audit records. + +**Tier 3 - Strategic:** +- 12.2.6: Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity. + +#### Cross-references + +- LLM Top 10: LLM06, LLM10, LLM05 +- Agentic: ASI01, ASI02, ASI03, ASI05, ASI04, ASI06, ASI07, ASI08, ASI09 +- DSGAI: DSGAI16, DSGAI03, DSGAI19, DSGAI02, DSGAI17, DSGAI06 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +## Implementation priority table + +| Priority | AISVS components | Entries addressed | +|---|---|---| +| P1 - Pre-production gate | All Level 1 requirements | ASI01, ASI02, ASI03, ASI04, ASI05, ASI07, ASI08, ASI09, ASI10 | +| P2 - First 30 days | All Level 2 requirements | ASI01, ASI02, ASI03, ASI04, ASI05, ASI06, ASI07, ASI08, ASI09, ASI10 | +| P3 - Programme maturity | All Level 3 requirements | ASI02, ASI03, ASI04, ASI06, ASI07, ASI08, ASI09, ASI10 | + +--- + +## References + +- [OWASP AISVS project page](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/) +- [OWASP AISVS 1.0 frozen text](https://github.com/OWASP/AISVS/tree/main/1.0/en) +- [OWASP Top 10 for Agentic AI Applications 2026 - OWASP](https://genai.owasp.org/resource/agentic-ai-top-10/) +- [shared/TEMPLATE.md](../shared/TEMPLATE.md) + +--- + +## Changelog + +| Version | Date | Change | +|---|---|---| +| 1.0.0 | 2026-08-28 | Initial release - full mapping of ASI01-ASI10 to OWASP AISVS 1.0 | + +--- + +*Part of the [OWASP GenAI Crosswalk](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative/tree/main/crosswalk) - maintained by the [OWASP GenAI Data Security Initiative](https://genai.owasp.org)* +*License: [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)* diff --git a/crosswalk/data/backlinks.json b/crosswalk/data/backlinks.json index d5dac75..07ce8e4 100644 --- a/crosswalk/data/backlinks.json +++ b/crosswalk/data/backlinks.json @@ -25728,6 +25728,3843 @@ } ] }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data restricted to features required for the stated purpose, reducing what can be disclosed at all" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, use constraints and processing history" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Data integrity provided for training data in storage and in transit" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Data integrity provided when training data is stored and transferred" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.1", + "control_name": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.2", + "control_name": "Verify that cryptographic integrity is applied to labeling artifacts.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Cryptographic integrity applied to labeling artifacts" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection for deliberate poisoning and unintentional corruption" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.2", + "control_name": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Automatically generated labels subject to confidence thresholds and consistency checks" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.3", + "control_name": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Models used in security-relevant decisions evaluated for bias patterns" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses, the attack class that survives label inspection" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.1", + "control_name": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP components obtained only from trusted sources and cryptographically verified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Only allow-listed MCP servers permitted" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.1", + "control_name": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.2", + "control_name": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.3", + "control_name": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.4", + "control_name": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "entries": [ + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.5", + "control_name": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.6", + "control_name": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers ensure all session artifacts are removed when a session terminates" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.7", + "control_name": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.1", + "control_name": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.3", + "control_name": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att...", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.4", + "control_name": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.5", + "control_name": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.1", + "control_name": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "entries": [ + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Indirect injection path: MCP tools/list and tools/call responses screened before entering model context" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.4", + "control_name": "Verify that all MCP servers enforce strict schema validation.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All MCP servers enforce strict schema validation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.6", + "control_name": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.7", + "control_name": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.8", + "control_name": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t...", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.1.2", + "control_name": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Version-controlled alignment test suite run on every model update or release, catching factuality regressions before they ship" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes are not returned directly in outputs" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-principal and global rate limits sized to the threat model rather than as a generic API throttle" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets, limiting memorisation-driven disclosure" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "entries": [ + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector, covering iterative prompt reconstruction" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "entries": [ + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.3", + "control_name": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.4", + "control_name": "Verify that detection of suspected extraction triggers response measures.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Detection of suspected extraction triggers response measures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.4.3", + "control_name": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i...", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.1", + "control_name": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.2", + "control_name": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m...", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.4", + "control_name": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Detection layer: known jailbreak patterns, injection attempts and adversarial inputs alerted on" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.2", + "control_name": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.3", + "control_name": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction atte...", + "entries": [ + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Custom rules detect coordinated jailbreak attempts, injection and system prompt extraction attempts" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.5", + "control_name": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Token usage tracked per user, session, feature endpoint and team so cost abuse is attributable" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.6", + "control_name": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2...", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.1", + "control_name": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match...", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination detection monitors flag factually incorrect, inconsistent or fabricated output" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.3", + "control_name": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination rates tracked as continuous time-series metrics to detect sustained degradation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.4", + "control_name": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.1", + "control_name": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.2", + "control_name": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.3", + "control_name": "Verify that kill-switch activations and override commands are logged.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Kill-switch activations and override commands logged" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling post-hoc poisoning attribution" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.2", + "control_name": "Verify that all labeling activities are recorded in logs.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All labeling activities recorded in logs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.1", + "control_name": "Verify that input normalization is applied before tokenization or embedding.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Input normalization applied before tokenization or embedding, closing the pre-tokenizer bypass class" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.2", + "control_name": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Encoding and representation smuggling defeated by canonicalization, strict schema validation, policy rejection or explicit marking" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Direct control: all inputs able to steer model behavior are treated as untrusted and screened by an injection ruleset or classifier, with flagged inputs blocked" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.5", + "control_name": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only cha...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Character set restricted by allow-list to only explicitly required characters, removing the exotic-codepoint smuggling surface" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy so system and developer messages keep precedence over user and other untrusted input, including after user text is processed" + }, + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy resists the override-then-reveal extraction pattern" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.7", + "control_name": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Reserved special tokens encoded as literals so control tokens cannot be injected into the model context" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.8", + "control_name": "Verify that the system can detect many-shot jailbreaking patterns.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 3. Many-shot jailbreaking pattern detection for long-context in-context-learning attacks" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.3", + "control_name": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.4", + "control_name": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Coordinated attacks spanning multiple input types detected and blocked" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.2", + "control_name": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographi...", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Weights, configurations, tokenizers, base models, fine-tunes, adapters and safety models signed by authorized entities" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.3", + "control_name": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.2.3", + "control_name": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.1", + "control_name": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Production deployments implement rollout mechanisms with automated rollback triggers" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.2", + "control_name": "Verify that rollback capabilities restore the complete model state.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Rollback capabilities restore the complete model state" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.3", + "control_name": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.4.1", + "control_name": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.2", + "control_name": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Each stage output integrity-verified before the next stage consumes it in multi-stage fine-tuning" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.4", + "control_name": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.1", + "control_name": "Verify that AI models execute in isolated sandboxes.", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. AI models execute in isolated sandboxes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model artifact loading restricted to an allow-list of serialization formats that cannot execute code on deserialization, the pickle class of supply chain RCE" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.4", + "control_name": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Confidential inference services protect model weights during runtime through isolated execution environments" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.1", + "control_name": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.3", + "control_name": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Inference runtimes enforce process, memory and file access isolation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.4", + "control_name": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.1", + "control_name": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.1", + "control_name": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici...", + "entries": [ + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses containing data the requester is not authorized to receive" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.5", + "control_name": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to embeddings, prompt caches and model outputs so downstream handling matches the source sensitivity" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Classification labels propagate to prompt caches and model outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.1", + "control_name": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing...", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.2", + "control_name": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica...", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.1", + "control_name": "Verify that models are scanned for malicious code before import.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Models scanned for malicious code before import" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and adapters downloaded only from approved sources" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.4", + "control_name": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Behavioral acceptance test suite passed before promotion beyond development, catching backdoors that signature checks cannot" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Version-controlled machine-readable AI BOM listing datasets, weights, licenses and data-origin statements" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.2", + "control_name": "Verify that AI BOMs are cryptographically signed before deployment.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. AI BOMs cryptographically signed before deployment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.3", + "control_name": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. All model outputs validated against a defined schema, non-matching output rejected" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All model outputs validated against a defined schema and rejected when they do not match" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.2", + "control_name": "Verify that model-generated output is bounded by length limits and termination controls.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model-generated output bounded by length limits and termination controls" + }, + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Output bounded by length limits and termination controls, capping runaway generation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Reliability of generated answers assessed using a confidence estimation method" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.2", + "control_name": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Answers blocked or a fallback message returned when the confidence score falls below a defined threshold" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.3", + "control_name": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Additional verification step for responses classified as high-risk by policy" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + }, + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters detect and block responses that disclose system prompt content or backend data" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content via homoglyphs, formatting, metadata or structured fields" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses include attribution to the source documents" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.2", + "control_name": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG attributions derived from retrieval metadata rather than generated by the model, so provenance cannot be fabricated" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.3", + "control_name": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Claims in a RAG response traceable to the retrieved chunk" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.4", + "control_name": "Verify that generated media is watermarked to prove it was AI-generated.", + "entries": [ + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Generated media watermarked to prove it was AI-generated" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write, blocking post-hoc retrieval manipulation" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected and masked, tokenized or dropped before embedding, so disclosure is prevented at the index rather than the response" + }, + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.5", + "control_name": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, supporting deletion obligations against agent memory" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.3", + "control_name": "Verify that quarantined content is retained but excluded from all retrieval results.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts contain a single failing component" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-execution budgets for recursion depth, token use and monetary spend configured and enforced by the runtime" + }, + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-execution budgets for max recursion depth, token use and monetary spend enforced by the runtime" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Per-execution budgets including max recursion depth bound runaway amplification" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.3", + "control_name": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.10", + "control_name": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ...", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.2", + "control_name": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc...", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Each high-impact action carries a trusted reversibility classification" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.4", + "control_name": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact ...", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Runtime enforces reversibility classifications by blocking, requiring approval or restricting the action" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.6", + "control_name": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.7", + "control_name": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through...", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.8", + "control_name": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.9", + "control_name": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Key material or credentials used to issue approvals isolated from the agent runtime" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is otherwise isolated from model operations" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas before the agent consumes them" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas before consumption" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.5", + "control_name": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Policy violations trigger automated tool containment" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Policy violations trigger automated tool containment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.4", + "control_name": "Verify that agent state persisted between invocations is integrity-protected.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Agent state persisted between invocations is integrity-protected" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy restricting which tools an agent may invoke and which parameter values it may supply" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.2", + "control_name": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the model itself" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "entries": [ + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials kept out of the model observable context including context window, system prompts and tool call parameters, so a leaked prompt is not a leaked credential" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Secrets and credentials required at runtime kept out of the model observable context" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.5", + "control_name": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Inter-agent task delegation restricted by an explicit authorization policy" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.6", + "control_name": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt inference and outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.2", + "control_name": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.3", + "control_name": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise" + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V1 Architecture", diff --git a/crosswalk/data/entries/ASI01.json b/crosswalk/data/entries/ASI01.json index a904b30..b6d3392 100644 --- a/crosswalk/data/entries/ASI01.json +++ b/crosswalk/data/entries/ASI01.json @@ -707,6 +707,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Share agent goal hijacking threat intelligence with sector peers through DORA information sharing arrangements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.5", + "control_name": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.6", + "control_name": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI02.json b/crosswalk/data/entries/ASI02.json index 1f8d707..cea5f49 100644 --- a/crosswalk/data/entries/ASI02.json +++ b/crosswalk/data/entries/ASI02.json @@ -691,6 +691,78 @@ "tier": "Foundational", "scope": "Build", "notes": "Include agent access control bypass in resilience testing; verify that agents cannot exceed defined permission boundaries under adversarial conditions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.5", + "control_name": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 3. Policy violations trigger automated tool containment" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI03.json b/crosswalk/data/entries/ASI03.json index 8b5055d..42f1da3 100644 --- a/crosswalk/data/entries/ASI03.json +++ b/crosswalk/data/entries/ASI03.json @@ -747,6 +747,105 @@ "tier": "Foundational", "scope": "Both", "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.2", + "control_name": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials required at runtime kept out of the model observable context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.1", + "control_name": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.2", + "control_name": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.1", + "control_name": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.5", + "control_name": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.6", + "control_name": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI04.json b/crosswalk/data/entries/ASI04.json index 0caa72a..fdaa9bc 100644 --- a/crosswalk/data/entries/ASI04.json +++ b/crosswalk/data/entries/ASI04.json @@ -683,6 +683,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Include agent supply chain disruption in resilience testing; test fallback procedures for third-party tool and service failures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.1", + "control_name": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 1. MCP components obtained only from trusted sources and cryptographically verified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Only allow-listed MCP servers permitted" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and adapters downloaded only from approved sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.8", + "control_name": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI05.json b/crosswalk/data/entries/ASI05.json index 6089c7a..672b392 100644 --- a/crosswalk/data/entries/ASI05.json +++ b/crosswalk/data/entries/ASI05.json @@ -683,6 +683,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.1", + "control_name": "Verify that AI models execute in isolated sandboxes.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. AI models execute in isolated sandboxes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas before consumption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.4.1", + "control_name": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices", + "notes": "Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI06.json b/crosswalk/data/entries/ASI06.json index 16b02d1..c00cebd 100644 --- a/crosswalk/data/entries/ASI06.json +++ b/crosswalk/data/entries/ASI06.json @@ -676,6 +676,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for memory poisoning events; trace poisoned content to source and assess impact on agent decisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.5", + "control_name": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.3", + "control_name": "Verify that quarantined content is retained but excluded from all retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.4", + "control_name": "Verify that agent state persisted between invocations is integrity-protected.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent state persisted between invocations is integrity-protected" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI07.json b/crosswalk/data/entries/ASI07.json index 971340c..d976da3 100644 --- a/crosswalk/data/entries/ASI07.json +++ b/crosswalk/data/entries/ASI07.json @@ -676,6 +676,78 @@ "tier": "Foundational", "scope": "Build", "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.1", + "control_name": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.3", + "control_name": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.4", + "control_name": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.6", + "control_name": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.5", + "control_name": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Inter-agent task delegation restricted by an explicit authorization policy" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.5", + "control_name": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI08.json b/crosswalk/data/entries/ASI08.json index a27c76e..4ed851c 100644 --- a/crosswalk/data/entries/ASI08.json +++ b/crosswalk/data/entries/ASI08.json @@ -676,6 +676,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Include cascading automation risk in ICT risk management; define acceptable multi-agent coupling thresholds and circuit breaker requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.3", + "control_name": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets including max recursion depth bound runaway amplification" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts contain a single failing component" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.3", + "control_name": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.10", + "control_name": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 3. Policy violations trigger automated tool containment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.4", + "control_name": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI09.json b/crosswalk/data/entries/ASI09.json index 178e20f..7ed7c34 100644 --- a/crosswalk/data/entries/ASI09.json +++ b/crosswalk/data/entries/ASI09.json @@ -667,6 +667,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Include emerging agentic architecture security in resilience testing; assess novel patterns for resilience implications before production deployment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.2", + "control_name": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.2", + "control_name": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.7", + "control_name": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.2", + "control_name": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.8", + "control_name": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action" } ], "tools": [ diff --git a/crosswalk/data/entries/ASI10.json b/crosswalk/data/entries/ASI10.json index 79c3df7..96fd5fd 100644 --- a/crosswalk/data/entries/ASI10.json +++ b/crosswalk/data/entries/ASI10.json @@ -698,6 +698,87 @@ "tier": "Foundational", "scope": "Both", "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.1", + "control_name": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.2", + "control_name": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt inference and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.1", + "control_name": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.3", + "control_name": "Verify that kill-switch activations and override commands are logged.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Kill-switch activations and override commands logged" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.6", + "control_name": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI01.json b/crosswalk/data/entries/DSGAI01.json index d3551b7..9c108dc 100644 --- a/crosswalk/data/entries/DSGAI01.json +++ b/crosswalk/data/entries/DSGAI01.json @@ -623,6 +623,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Classify material AI data access violations as ICT-related incidents; report to competent authorities per DORA incident classification and reporting requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI02.json b/crosswalk/data/entries/DSGAI02.json index f8accb8..334b8f4 100644 --- a/crosswalk/data/entries/DSGAI02.json +++ b/crosswalk/data/entries/DSGAI02.json @@ -616,6 +616,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Monitor AI data flows for undocumented data movement; alert on data transfers outside documented pipelines" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.3", + "control_name": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.7", + "control_name": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.9", + "control_name": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Key material or credentials used to issue approvals isolated from the agent runtime" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI03.json b/crosswalk/data/entries/DSGAI03.json index d9d31d6..af13e27 100644 --- a/crosswalk/data/entries/DSGAI03.json +++ b/crosswalk/data/entries/DSGAI03.json @@ -577,6 +577,60 @@ "tier": "Foundational", "scope": "Both", "notes": "Define approved AI tools policy in ICT risk management framework; require vetting and approval before use in financial data processing" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.2.3", + "control_name": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing", + "notes": "Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI04.json b/crosswalk/data/entries/DSGAI04.json index eb1193f..b901000 100644 --- a/crosswalk/data/entries/DSGAI04.json +++ b/crosswalk/data/entries/DSGAI04.json @@ -641,6 +641,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for data poisoning events; trace poisoned content and update protection controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.3", + "control_name": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.2", + "control_name": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.4.3", + "control_name": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection", + "notes": "Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI05.json b/crosswalk/data/entries/DSGAI05.json index 2e168f8..213e0d4 100644 --- a/crosswalk/data/entries/DSGAI05.json +++ b/crosswalk/data/entries/DSGAI05.json @@ -565,6 +565,87 @@ "tier": "Foundational", "scope": "Both", "notes": "Include external data sources in third-party risk management; assess data quality, provenance practices, and licensing compliance" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Data integrity provided when training data is stored and transferred" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. All model outputs validated against a defined schema and rejected when they do not match" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.4", + "control_name": "Verify that all MCP servers enforce strict schema validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. All MCP servers enforce strict schema validation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.2", + "control_name": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Automatically generated labels subject to confidence thresholds and consistency checks" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.3", + "control_name": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.1", + "control_name": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI06.json b/crosswalk/data/entries/DSGAI06.json index 6380974..0d95a56 100644 --- a/crosswalk/data/entries/DSGAI06.json +++ b/crosswalk/data/entries/DSGAI06.json @@ -571,6 +571,69 @@ "tier": "Foundational", "scope": "Build", "notes": "Include data lineage requirements in ICT risk management; define minimum lineage completeness per data sensitivity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.1", + "control_name": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.4", + "control_name": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI07.json b/crosswalk/data/entries/DSGAI07.json index 82d1a6c..b8798c3 100644 --- a/crosswalk/data/entries/DSGAI07.json +++ b/crosswalk/data/entries/DSGAI07.json @@ -578,6 +578,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Monitor for excessive data aggregation patterns; alert on dataset combinations exceeding defined sensitivity thresholds" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, supporting deletion obligations against agent memory" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI08.json b/crosswalk/data/entries/DSGAI08.json index 84e73cb..b9f8493 100644 --- a/crosswalk/data/entries/DSGAI08.json +++ b/crosswalk/data/entries/DSGAI08.json @@ -587,6 +587,60 @@ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for data leakage events; identify root cause and update controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.3", + "control_name": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Models used in security-relevant decisions evaluated for bias patterns" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI09.json b/crosswalk/data/entries/DSGAI09.json index 0db483a..522bd1e 100644 --- a/crosswalk/data/entries/DSGAI09.json +++ b/crosswalk/data/entries/DSGAI09.json @@ -564,6 +564,51 @@ "tier": "Foundational", "scope": "Both", "notes": "Deploy detection for IP exfiltration attempts; monitor model weight access and download patterns" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.3", + "control_name": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "notes": "Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.4", + "control_name": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "notes": "Level 3. Coordinated attacks spanning multiple input types detected and blocked" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI10.json b/crosswalk/data/entries/DSGAI10.json index 62aec58..30fc599 100644 --- a/crosswalk/data/entries/DSGAI10.json +++ b/crosswalk/data/entries/DSGAI10.json @@ -510,6 +510,51 @@ "tier": "Foundational", "scope": "Build", "notes": "Apply lessons learned from synthetic data privacy failures; update generation processes and validation controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI11.json b/crosswalk/data/entries/DSGAI11.json index fc00d1a..2573395 100644 --- a/crosswalk/data/entries/DSGAI11.json +++ b/crosswalk/data/entries/DSGAI11.json @@ -554,6 +554,60 @@ "tier": "Foundational", "scope": "Both", "notes": "Enforce retention policies through automated deletion and crypto-shredding; prevent retention beyond defined periods" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.1", + "control_name": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "notes": "Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.3", + "control_name": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.6", + "control_name": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers ensure all session artifacts are removed when a session terminates" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.2", + "control_name": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "notes": "Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI12.json b/crosswalk/data/entries/DSGAI12.json index 9d9c5b2..bac0722 100644 --- a/crosswalk/data/entries/DSGAI12.json +++ b/crosswalk/data/entries/DSGAI12.json @@ -593,6 +593,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Map ownership for all AI data assets; document rights, restrictions, and licensing for training data and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI13.json b/crosswalk/data/entries/DSGAI13.json index 49f665e..e378312 100644 --- a/crosswalk/data/entries/DSGAI13.json +++ b/crosswalk/data/entries/DSGAI13.json @@ -579,6 +579,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Classify AI data misuse as ICT-related incidents where customer or regulatory impact occurs; report per DORA criteria" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.1", + "control_name": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI14.json b/crosswalk/data/entries/DSGAI14.json index 03a92e4..e5a96a4 100644 --- a/crosswalk/data/entries/DSGAI14.json +++ b/crosswalk/data/entries/DSGAI14.json @@ -569,6 +569,60 @@ "tier": "Foundational", "scope": "Both", "notes": "Monitor for AI processing inconsistent with consent status; alert on violations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.4", + "control_name": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.2", + "control_name": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI15.json b/crosswalk/data/entries/DSGAI15.json index b785695..7662f12 100644 --- a/crosswalk/data/entries/DSGAI15.json +++ b/crosswalk/data/entries/DSGAI15.json @@ -555,6 +555,60 @@ "tier": "Foundational", "scope": "Build", "notes": "Document data necessity justification for each AI data asset; map minimum required data per use case" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Classification labels propagate to prompt caches and model outputs" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI16.json b/crosswalk/data/entries/DSGAI16.json index 3e2faa2..b2dee7d 100644 --- a/crosswalk/data/entries/DSGAI16.json +++ b/crosswalk/data/entries/DSGAI16.json @@ -579,6 +579,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Monitor for privacy degradation indicators; detect inference attacks, re-identification attempts, and memorisation in model outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.7", + "control_name": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.3", + "control_name": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 3. Inference runtimes enforce process, memory and file access isolation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.1", + "control_name": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI17.json b/crosswalk/data/entries/DSGAI17.json index 0424a18..48bd243 100644 --- a/crosswalk/data/entries/DSGAI17.json +++ b/crosswalk/data/entries/DSGAI17.json @@ -572,6 +572,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Apply lessons learned from bias incidents; update training data, model parameters, and controls based on fairness assessments" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.1", + "control_name": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Production deployments implement rollout mechanisms with automated rollback triggers" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.2", + "control_name": "Verify that rollback capabilities restore the complete model state.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Rollback capabilities restore the complete model state" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.4", + "control_name": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI18.json b/crosswalk/data/entries/DSGAI18.json index 8c47341..07b8946 100644 --- a/crosswalk/data/entries/DSGAI18.json +++ b/crosswalk/data/entries/DSGAI18.json @@ -517,6 +517,69 @@ "tier": "Foundational", "scope": "Both", "notes": "Map all AI systems subject to governance; ensure complete coverage of AI data assets in governance framework" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI19.json b/crosswalk/data/entries/DSGAI19.json index 129ca31..0bb0965 100644 --- a/crosswalk/data/entries/DSGAI19.json +++ b/crosswalk/data/entries/DSGAI19.json @@ -555,6 +555,51 @@ "tier": "Foundational", "scope": "Both", "notes": "Participate in information sharing arrangements for third-party AI data risks; share threat intelligence on data provider compromises" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.1", + "control_name": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.2", + "control_name": "Verify that cryptographic integrity is applied to labeling artifacts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Cryptographic integrity applied to labeling artifacts" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.2", + "control_name": "Verify that all labeling activities are recorded in logs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. All labeling activities recorded in logs" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI20.json b/crosswalk/data/entries/DSGAI20.json index 24bec1a..b44d54e 100644 --- a/crosswalk/data/entries/DSGAI20.json +++ b/crosswalk/data/entries/DSGAI20.json @@ -563,6 +563,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Map physical and logical locations of all AI data; document processing jurisdictions for training, inference, and storage" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.4", + "control_name": "Verify that detection of suspected extraction triggers response measures.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 3. Detection of suspected extraction triggers response measures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.3", + "control_name": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.4", + "control_name": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 3. Confidential inference services protect model weights during runtime through isolated execution environments" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.4", + "control_name": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry" } ], "tools": [ diff --git a/crosswalk/data/entries/DSGAI21.json b/crosswalk/data/entries/DSGAI21.json index 28f7a8d..d5006e3 100644 --- a/crosswalk/data/entries/DSGAI21.json +++ b/crosswalk/data/entries/DSGAI21.json @@ -744,6 +744,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Map all AI data subject to regulatory requirements; ensure complete coverage in compliance programme" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.4", + "control_name": "Verify that generated media is watermarked to prove it was AI-generated.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 3. Generated media watermarked to prove it was AI-generated" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM01.json b/crosswalk/data/entries/LLM01.json index 7633525..c4e6c7f 100644 --- a/crosswalk/data/entries/LLM01.json +++ b/crosswalk/data/entries/LLM01.json @@ -728,6 +728,87 @@ "tier": "Foundational", "scope": "Both", "notes": "Share prompt injection threat intelligence with sector peers through DORA information sharing arrangements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Direct control: all inputs able to steer model behavior are treated as untrusted and screened by an injection ruleset or classifier, with flagged inputs blocked" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy so system and developer messages keep precedence over user and other untrusted input, including after user text is processed" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.2", + "control_name": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Encoding and representation smuggling defeated by canonicalization, strict schema validation, policy rejection or explicit marking" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.1", + "control_name": "Verify that input normalization is applied before tokenization or embedding.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input normalization applied before tokenization or embedding, closing the pre-tokenizer bypass class" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.7", + "control_name": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Reserved special tokens encoded as literals so control tokens cannot be injected into the model context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.5", + "control_name": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only cha...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Character set restricted by allow-list to only explicitly required characters, removing the exotic-codepoint smuggling surface" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.8", + "control_name": "Verify that the system can detect many-shot jailbreaking patterns.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 3. Many-shot jailbreaking pattern detection for long-context in-context-learning attacks" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. Indirect injection path: MCP tools/list and tools/call responses screened before entering model context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 1. Detection layer: known jailbreak patterns, injection attempts and adversarial inputs alerted on" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM02.json b/crosswalk/data/entries/LLM02.json index b6275c7..00f066c 100644 --- a/crosswalk/data/entries/LLM02.json +++ b/crosswalk/data/entries/LLM02.json @@ -720,6 +720,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses containing data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes are not returned directly in outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected and masked, tokenized or dropped before embedding, so disclosure is prevented at the index rather than the response" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets, limiting memorisation-driven disclosure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to embeddings, prompt caches and model outputs so downstream handling matches the source sensitivity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data restricted to features required for the stated purpose, reducing what can be disclosed at all" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM03.json b/crosswalk/data/entries/LLM03.json index 98f90fa..fdf7726 100644 --- a/crosswalk/data/entries/LLM03.json +++ b/crosswalk/data/entries/LLM03.json @@ -696,6 +696,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for data poisoning events; identify root cause, trace poisoned records, and update protection controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.1", + "control_name": "Verify that models are scanned for malicious code before import.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Models scanned for malicious code before import" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. Model artifact loading restricted to an allow-list of serialization formats that cannot execute code on deserialization, the pickle class of supply chain RCE" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 1. Version-controlled machine-readable AI BOM listing datasets, weights, licenses and data-origin statements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.2", + "control_name": "Verify that AI BOMs are cryptographically signed before deployment.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 2. AI BOMs cryptographically signed before deployment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.2", + "control_name": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographi...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 2. Weights, configurations, tokenizers, base models, fine-tunes, adapters and safety models signed by authorized entities" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.4", + "control_name": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Behavioral acceptance test suite passed before promotion beyond development, catching backdoors that signature checks cannot" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM04.json b/crosswalk/data/entries/LLM04.json index 99e7bff..36962bc 100644 --- a/crosswalk/data/entries/LLM04.json +++ b/crosswalk/data/entries/LLM04.json @@ -689,6 +689,78 @@ "tier": "Foundational", "scope": "Both", "notes": "Define response and recovery procedures for AI denial of service events; include automated throttling, failover, and service restoration" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection for deliberate poisoning and unintentional corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Data integrity provided for training data in storage and in transit" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, use constraints and processing history" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses, the attack class that survives label inspection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Each stage output integrity-verified before the next stage consumes it in multi-stage fine-tuning" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling post-hoc poisoning attribution" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM05.json b/crosswalk/data/entries/LLM05.json index d4ede07..7438ee1 100644 --- a/crosswalk/data/entries/LLM05.json +++ b/crosswalk/data/entries/LLM05.json @@ -672,6 +672,60 @@ "tier": "Foundational", "scope": "Both", "notes": "Include AI supply chain disruption scenarios in resilience testing; test fallback procedures for third-party AI service failures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. All model outputs validated against a defined schema, non-matching output rejected" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.2", + "control_name": "Verify that model-generated output is bounded by length limits and termination controls.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Model-generated output bounded by length limits and termination controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas before the agent consumes them" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content via homoglyphs, formatting, metadata or structured fields" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM06.json b/crosswalk/data/entries/LLM06.json index 019efe5..7bc3f41 100644 --- a/crosswalk/data/entries/LLM06.json +++ b/crosswalk/data/entries/LLM06.json @@ -695,6 +695,78 @@ "tier": "Foundational", "scope": "Build", "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets for recursion depth, token use and monetary spend configured and enforced by the runtime" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is otherwise isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the model itself" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy restricting which tools an agent may invoke and which parameter values it may supply" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Each high-impact action carries a trusted reversibility classification" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.4", + "control_name": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact ...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Runtime enforces reversibility classifications by blocking, requiring approval or restricting the action" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM07.json b/crosswalk/data/entries/LLM07.json index 9b9f376..f4f99ea 100644 --- a/crosswalk/data/entries/LLM07.json +++ b/crosswalk/data/entries/LLM07.json @@ -641,6 +641,51 @@ "tier": "Foundational", "scope": "Build", "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters detect and block responses that disclose system prompt content or backend data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy resists the override-then-reveal extraction pattern" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials kept out of the model observable context including context window, system prompts and tool call parameters, so a leaked prompt is not a leaked credential" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.3", + "control_name": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction atte...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Custom rules detect coordinated jailbreak attempts, injection and system prompt extraction attempts" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector, covering iterative prompt reconstruction" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM08.json b/crosswalk/data/entries/LLM08.json index 6cbbdcb..be41d88 100644 --- a/crosswalk/data/entries/LLM08.json +++ b/crosswalk/data/entries/LLM08.json @@ -648,6 +648,69 @@ "tier": "Foundational", "scope": "Build", "notes": "Monitor embedding stores for unauthorised modifications, anomalous writes, and bulk access patterns indicative of extraction or poisoning" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write, blocking post-hoc retrieval manipulation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM09.json b/crosswalk/data/entries/LLM09.json index dc1db1d..67d43d7 100644 --- a/crosswalk/data/entries/LLM09.json +++ b/crosswalk/data/entries/LLM09.json @@ -656,6 +656,87 @@ "tier": "Foundational", "scope": "Both", "notes": "Implement factual grounding controls for financial AI outputs — RAG with authoritative sources, confidence scoring, and human review for high-stakes outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses include attribution to the source documents" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.2", + "control_name": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG attributions derived from retrieval metadata rather than generated by the model, so provenance cannot be fabricated" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Reliability of generated answers assessed using a confidence estimation method" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.2", + "control_name": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Answers blocked or a fallback message returned when the confidence score falls below a defined threshold" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.3", + "control_name": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 2. Claims in a RAG response traceable to the retrieved chunk" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination detection monitors flag factually incorrect, inconsistent or fabricated output" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.3", + "control_name": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination rates tracked as continuous time-series metrics to detect sustained degradation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.3", + "control_name": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 3. Additional verification step for responses classified as high-risk by policy" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.1.2", + "control_name": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "notes": "Level 1. Version-controlled alignment test suite run on every model update or release, catching factuality regressions before they ship" } ], "tools": [ diff --git a/crosswalk/data/entries/LLM10.json b/crosswalk/data/entries/LLM10.json index e1f69c3..a3a5af8 100644 --- a/crosswalk/data/entries/LLM10.json +++ b/crosswalk/data/entries/LLM10.json @@ -657,6 +657,60 @@ "tier": "Foundational", "scope": "Both", "notes": "Define response and recovery procedures for AI consumption incidents; include automatic throttling, failover activation, and service restoration" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets for max recursion depth, token use and monetary spend enforced by the runtime" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Per-principal and global rate limits sized to the threat model rather than as a generic API throttle" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.2", + "control_name": "Verify that model-generated output is bounded by length limits and termination controls.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Output bounded by length limits and termination controls, capping runaway generation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.5", + "control_name": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Token usage tracked per user, session, feature endpoint and team so cost abuse is attributable" } ], "tools": [ diff --git a/crosswalk/data/frameworks/owasp-aisvs.json b/crosswalk/data/frameworks/owasp-aisvs.json new file mode 100644 index 0000000..a132bc3 --- /dev/null +++ b/crosswalk/data/frameworks/owasp-aisvs.json @@ -0,0 +1,1549 @@ +{ + "id": "owasp-aisvs", + "name": "OWASP AISVS 1.0", + "short_name": "AISVS", + "version": "1.0", + "url": "https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/", + "license": "CC BY-SA 4.0", + "publisher": "OWASP", + "category": "appsec", + "last_synced": "2026-08-28", + "source_sha": null, + "controls": [ + { + "control_id": "1.1.1", + "title": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "description": "AISVS 1.0 Level 1 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.2", + "title": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use constraints, and processing history.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use constraints, and processing history.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.3", + "title": "Verify that data integrity is provided when training data is stored and transferred.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that data integrity is provided when training data is stored and transferred.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.4", + "title": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.5", + "title": "Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.", + "description": "AISVS 1.0 Level 3 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.2.1", + "title": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "description": "AISVS 1.0 Level 1 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security" + }, + { + "control_id": "1.2.2", + "title": "Verify that cryptographic integrity is applied to labeling artifacts.", + "description": "AISVS 1.0 Level 2 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that cryptographic integrity is applied to labeling artifacts.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security" + }, + { + "control_id": "1.2.3", + "title": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "description": "AISVS 1.0 Level 2 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security" + }, + { + "control_id": "1.3.1", + "title": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in training data.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in training data.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.2", + "title": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.3", + "title": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.4", + "title": "Verify that disallowed content is detected and removed before training.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that disallowed content is detected and removed before training.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.5", + "title": "Verify that defenses against clean-label poisoning attacks are implemented.", + "description": "AISVS 1.0 Level 3 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that defenses against clean-label poisoning attacks are implemented.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "2.1.1", + "title": "Verify that input normalization is applied before tokenization or embedding.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that input normalization is applied before tokenization or embedding.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.2", + "title": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.3", + "title": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.4", + "title": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.5", + "title": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters that are explicitly required.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters that are explicitly required.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.6", + "title": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even after user instructions have been processed.", + "description": "AISVS 1.0 Level 2 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even after user instructions have been processed.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.7", + "title": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "description": "AISVS 1.0 Level 2 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.8", + "title": "Verify that the system can detect many-shot jailbreaking patterns.", + "description": "AISVS 1.0 Level 3 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system can detect many-shot jailbreaking patterns.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.2.1", + "title": "Verify that every prompt is scored by a content classifier for violence, self-harm, hate, and sexual content against configurable thresholds. Prompts that exceed those thresholds are rejected or sanitized before reaching the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that every prompt is scored by a content classifier for violence, self-harm, hate, and sexual content against configurable thresholds. Prompts that exceed those thresholds are rejected or sanitized before reaching the model context.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "2.2.2", + "title": "Verify that prompt content classification is evaluated for unsupported languages.", + "description": "AISVS 1.0 Level 1 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that prompt content classification is evaluated for unsupported languages.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "2.2.3", + "title": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known attack patterns.", + "description": "AISVS 1.0 Level 2 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known attack patterns.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "2.2.4", + "title": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.", + "description": "AISVS 1.0 Level 3 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "3.1.1", + "title": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "description": "AISVS 1.0 Level 1 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity" + }, + { + "control_id": "3.1.2", + "title": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.", + "description": "AISVS 1.0 Level 2 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity" + }, + { + "control_id": "3.1.3", + "title": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "description": "AISVS 1.0 Level 2 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that model cryptographic signatures are verified at deployment admission and on load.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity" + }, + { + "control_id": "3.2.1", + "title": "Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.", + "description": "AISVS 1.0 Level 1 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing" + }, + { + "control_id": "3.2.2", + "title": "Verify that models subjected to post-training quantization are re-evaluated against the same safety and alignment test suite on the compressed artifact before deployment.", + "description": "AISVS 1.0 Level 2 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that models subjected to post-training quantization are re-evaluated against the same safety and alignment test suite on the compressed artifact before deployment.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing" + }, + { + "control_id": "3.2.3", + "title": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "description": "AISVS 1.0 Level 3 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing" + }, + { + "control_id": "3.3.1", + "title": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback" + }, + { + "control_id": "3.3.2", + "title": "Verify that rollback capabilities restore the complete model state.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that rollback capabilities restore the complete model state.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback" + }, + { + "control_id": "3.3.3", + "title": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback" + }, + { + "control_id": "3.4.1", + "title": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "description": "AISVS 1.0 Level 1 requirement in section C3.4 Secure Development Practices, chapter C3 Model Lifecycle Management & Change Control. Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices" + }, + { + "control_id": "3.4.2", + "title": "Verify that model training and fine-tuning environments are isolated from production environments.", + "description": "AISVS 1.0 Level 2 requirement in section C3.4 Secure Development Practices, chapter C3 Model Lifecycle Management & Change Control. Verify that model training and fine-tuning environments are isolated from production environments.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices" + }, + { + "control_id": "3.5.1", + "title": "Verify that models used in RLHF fine-tuning are versioned and integrity-verified before use in a training run.", + "description": "AISVS 1.0 Level 2 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that models used in RLHF fine-tuning are versioned and integrity-verified before use in a training run.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "3.5.2", + "title": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "3.5.3", + "title": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "3.5.4", + "title": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "4.1.1", + "title": "Verify that AI models execute in isolated sandboxes.", + "description": "AISVS 1.0 Level 1 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI models execute in isolated sandboxes.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.1.2", + "title": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.", + "description": "AISVS 1.0 Level 1 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.1.3", + "title": "Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.", + "description": "AISVS 1.0 Level 3 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.1.4", + "title": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "description": "AISVS 1.0 Level 3 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.2.1", + "title": "Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.", + "description": "AISVS 1.0 Level 2 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.2", + "title": "Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.3", + "title": "Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.4", + "title": "Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.5", + "title": "Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.3.1", + "title": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "description": "AISVS 1.0 Level 1 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.2", + "title": "Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.", + "description": "AISVS 1.0 Level 2 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.3", + "title": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that inference runtimes enforce process, memory, and file access isolation.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.4", + "title": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.5", + "title": "Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "5.1.1", + "title": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.", + "description": "AISVS 1.0 Level 3 requirement in section C5.1 Authentication, chapter C5 Access Control & Identity for AI Components & Users. Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication" + }, + { + "control_id": "5.1.2", + "title": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "description": "AISVS 1.0 Level 3 requirement in section C5.1 Authentication, chapter C5 Access Control & Identity for AI Components & Users. Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication" + }, + { + "control_id": "5.2.1", + "title": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.2", + "title": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.3", + "title": "Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.4", + "title": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.5", + "title": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.6", + "title": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.", + "description": "AISVS 1.0 Level 3 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.7", + "title": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "description": "AISVS 1.0 Level 3 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.3.1", + "title": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.", + "description": "AISVS 1.0 Level 2 requirement in section C5.3 Multi-Tenant Isolation, chapter C5 Access Control & Identity for AI Components & Users. Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation" + }, + { + "control_id": "5.3.2", + "title": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requires hardware partitioning, confidential computing, or dedicated per-tenant compute allocation.", + "description": "AISVS 1.0 Level 3 requirement in section C5.3 Multi-Tenant Isolation, chapter C5 Access Control & Identity for AI Components & Users. Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requires hardware partitioning, confidential computing, or dedicated per-tenant compute allocation.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation" + }, + { + "control_id": "6.1.1", + "title": "Verify that models are scanned for malicious code before import.", + "description": "AISVS 1.0 Level 1 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that models are scanned for malicious code before import.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.1.2", + "title": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "description": "AISVS 1.0 Level 1 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.1.3", + "title": "Verify that every third-party model artifact can be integrity-verified.", + "description": "AISVS 1.0 Level 2 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that every third-party model artifact can be integrity-verified.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.1.4", + "title": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "description": "AISVS 1.0 Level 2 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.2.1", + "title": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.", + "description": "AISVS 1.0 Level 1 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring" + }, + { + "control_id": "6.2.2", + "title": "Verify that AI BOMs are cryptographically signed before deployment.", + "description": "AISVS 1.0 Level 2 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that AI BOMs are cryptographically signed before deployment.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring" + }, + { + "control_id": "6.2.3", + "title": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "description": "AISVS 1.0 Level 2 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring" + }, + { + "control_id": "7.1.1", + "title": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "description": "AISVS 1.0 Level 1 requirement in section C7.1 Output Format Enforcement, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement" + }, + { + "control_id": "7.1.2", + "title": "Verify that model-generated output is bounded by length limits and termination controls.", + "description": "AISVS 1.0 Level 1 requirement in section C7.1 Output Format Enforcement, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model-generated output is bounded by length limits and termination controls.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement" + }, + { + "control_id": "7.2.1", + "title": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "description": "AISVS 1.0 Level 2 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation" + }, + { + "control_id": "7.2.2", + "title": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "description": "AISVS 1.0 Level 2 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation" + }, + { + "control_id": "7.2.3", + "title": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "description": "AISVS 1.0 Level 3 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation" + }, + { + "control_id": "7.3.1", + "title": "Verify that automated classifiers scan every response and block content that matches defined harmful content categories.", + "description": "AISVS 1.0 Level 1 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that automated classifiers scan every response and block content that matches defined harmful content categories.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.3.2", + "title": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "description": "AISVS 1.0 Level 2 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.3.3", + "title": "Verify that model-generated output is prevented from triggering outbound requests.", + "description": "AISVS 1.0 Level 2 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model-generated output is prevented from triggering outbound requests.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.3.4", + "title": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.", + "description": "AISVS 1.0 Level 3 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.4.1", + "title": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "description": "AISVS 1.0 Level 1 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "7.4.2", + "title": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "description": "AISVS 1.0 Level 1 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "7.4.3", + "title": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "description": "AISVS 1.0 Level 2 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that claims in a RAG response can be traced to the retrieved chunk.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "7.4.4", + "title": "Verify that generated media is watermarked to prove it was AI-generated.", + "description": "AISVS 1.0 Level 3 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that generated media is watermarked to prove it was AI-generated.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "8.1.1", + "title": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "description": "AISVS 1.0 Level 1 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices" + }, + { + "control_id": "8.1.2", + "title": "Verify that document metadata tags are immutable after the initial write.", + "description": "AISVS 1.0 Level 2 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that document metadata tags are immutable after the initial write.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices" + }, + { + "control_id": "8.1.3", + "title": "Verify that retrieval operations enforce scope constraints.", + "description": "AISVS 1.0 Level 2 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that retrieval operations enforce scope constraints.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices" + }, + { + "control_id": "8.2.1", + "title": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "description": "AISVS 1.0 Level 1 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.2", + "title": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "description": "AISVS 1.0 Level 2 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.3", + "title": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "description": "AISVS 1.0 Level 2 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.4", + "title": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "description": "AISVS 1.0 Level 3 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.5", + "title": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "description": "AISVS 1.0 Level 3 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.3.1", + "title": "Verify that expired vectors are excluded from retrieval results.", + "description": "AISVS 1.0 Level 2 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that expired vectors are excluded from retrieval results.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation" + }, + { + "control_id": "8.3.2", + "title": "Verify that memory can be reset.", + "description": "AISVS 1.0 Level 2 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that memory can be reset.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation" + }, + { + "control_id": "8.3.3", + "title": "Verify that quarantined content is retained but excluded from all retrieval results.", + "description": "AISVS 1.0 Level 3 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that quarantined content is retained but excluded from all retrieval results.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation" + }, + { + "control_id": "9.1.1", + "title": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "description": "AISVS 1.0 Level 1 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers" + }, + { + "control_id": "9.1.2", + "title": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "description": "AISVS 1.0 Level 1 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers" + }, + { + "control_id": "9.1.3", + "title": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "description": "AISVS 1.0 Level 2 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers" + }, + { + "control_id": "9.2.1", + "title": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified.", + "description": "AISVS 1.0 Level 1 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.2", + "title": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.3", + "title": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.4", + "title": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.5", + "title": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.6", + "title": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.7", + "title": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.8", + "title": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.9", + "title": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.10", + "title": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.3.1", + "title": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "description": "AISVS 1.0 Level 1 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.2", + "title": "Verify that tool outputs are validated against schemas.", + "description": "AISVS 1.0 Level 1 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that tool outputs are validated against schemas.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.3", + "title": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.4", + "title": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.5", + "title": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.6", + "title": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.7", + "title": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.8", + "title": "Verify that policy violations trigger automated tool containment.", + "description": "AISVS 1.0 Level 3 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that policy violations trigger automated tool containment.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.4.1", + "title": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "description": "AISVS 1.0 Level 2 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.4.2", + "title": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "description": "AISVS 1.0 Level 2 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.4.3", + "title": "Verify that agent identity credentials rotate on a defined schedule.", + "description": "AISVS 1.0 Level 3 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent identity credentials rotate on a defined schedule.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.4.4", + "title": "Verify that agent state persisted between invocations is integrity-protected.", + "description": "AISVS 1.0 Level 3 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent state persisted between invocations is integrity-protected.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.5.1", + "title": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.2", + "title": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization context and is enforced at every downstream call.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization context and is enforced at every downstream call.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.3", + "title": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.4", + "title": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.5", + "title": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.6", + "title": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "description": "AISVS 1.0 Level 3 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.6.1", + "title": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "description": "AISVS 1.0 Level 1 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation" + }, + { + "control_id": "9.6.2", + "title": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "description": "AISVS 1.0 Level 2 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation" + }, + { + "control_id": "9.6.3", + "title": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "description": "AISVS 1.0 Level 3 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation" + }, + { + "control_id": "10.1.1", + "title": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "description": "AISVS 1.0 Level 1 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity" + }, + { + "control_id": "10.1.2", + "title": "Verify that only allow-listed MCP servers are permitted.", + "description": "AISVS 1.0 Level 2 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that only allow-listed MCP servers are permitted.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity" + }, + { + "control_id": "10.1.3", + "title": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "description": "AISVS 1.0 Level 2 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity" + }, + { + "control_id": "10.2.1", + "title": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.2", + "title": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.3", + "title": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.4", + "title": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.5", + "title": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.6", + "title": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.7", + "title": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.3.1", + "title": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "description": "AISVS 1.0 Level 1 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.2", + "title": "Verify that stdio transport is permitted only in controlled local environments.", + "description": "AISVS 1.0 Level 1 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that stdio transport is permitted only in controlled local environments.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.3", + "title": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.", + "description": "AISVS 1.0 Level 2 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.4", + "title": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "description": "AISVS 1.0 Level 2 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.5", + "title": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "description": "AISVS 1.0 Level 3 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.4.1", + "title": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.2", + "title": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.3", + "title": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.4", + "title": "Verify that all MCP servers enforce strict schema validation.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that all MCP servers enforce strict schema validation.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.5", + "title": "Verify that all MCP transports enforce maximum payload size limits.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that all MCP transports enforce maximum payload size limits.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.6", + "title": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.7", + "title": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.8", + "title": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.", + "description": "AISVS 1.0 Level 3 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "11.1.1", + "title": "Verify that the model has undergone alignment and safety training or fine-tuning to prevent the model from generating disallowed content categories.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that the model has undergone alignment and safety training or fine-tuning to prevent the model from generating disallowed content categories.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.2", + "title": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that a version-controlled alignment test suite is run on every model update or release.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.3", + "title": "Verify that models are evaluated against known adversarial attack techniques relevant to their modality.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that models are evaluated against known adversarial attack techniques relevant to their modality.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.4", + "title": "Verify that models are hardened against adversarial inputs.", + "description": "AISVS 1.0 Level 2 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that models are hardened against adversarial inputs.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.5", + "title": "Verify that an automated evaluator measures harmful-content rate and flags regressions beyond a defined threshold.", + "description": "AISVS 1.0 Level 3 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that an automated evaluator measures harmful-content rate and flags regressions beyond a defined threshold.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.2.1", + "title": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "description": "AISVS 1.0 Level 1 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.2", + "title": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.", + "description": "AISVS 1.0 Level 1 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.3", + "title": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "description": "AISVS 1.0 Level 2 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that model outputs are calibrated to reduce overconfident predictions.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.4", + "title": "Verify that training on sensitive datasets employs differentially-private optimization.", + "description": "AISVS 1.0 Level 2 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that training on sensitive datasets employs differentially-private optimization.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.5", + "title": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "description": "AISVS 1.0 Level 3 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.3.1", + "title": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "description": "AISVS 1.0 Level 1 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that query-pattern analysis feeds an extraction-attempt detector.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.3.2", + "title": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.", + "description": "AISVS 1.0 Level 2 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.3.3", + "title": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "description": "AISVS 1.0 Level 3 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.3.4", + "title": "Verify that detection of suspected extraction triggers response measures.", + "description": "AISVS 1.0 Level 3 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that detection of suspected extraction triggers response measures.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.4.1", + "title": "Verify that inputs from external or untrusted sources pass through anomaly detection before model inference.", + "description": "AISVS 1.0 Level 2 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that inputs from external or untrusted sources pass through anomaly detection before model inference.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection" + }, + { + "control_id": "11.4.2", + "title": "Verify that inputs flagged as anomalous trigger gating actions.", + "description": "AISVS 1.0 Level 2 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that inputs flagged as anomalous trigger gating actions.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection" + }, + { + "control_id": "11.4.3", + "title": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement mechanism.", + "description": "AISVS 1.0 Level 3 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement mechanism.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection" + }, + { + "control_id": "12.1.1", + "title": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "description": "AISVS 1.0 Level 1 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that AI interactions are logged with session context and AI-specific telemetry.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.1.2", + "title": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.1.3", + "title": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.1.4", + "title": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.2.1", + "title": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "description": "AISVS 1.0 Level 1 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.2", + "title": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.3", + "title": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.4", + "title": "Verify that extraction-alert events include offending query metadata to support investigation.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that extraction-alert events include offending query metadata to support investigation.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.5", + "title": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.6", + "title": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.", + "description": "AISVS 1.0 Level 3 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.3.1", + "title": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the input data type (e.g., KS test or PSI for tabular numeric features, embedding-distance metrics for text or image).", + "description": "AISVS 1.0 Level 1 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the input data type (e.g., KS test or PSI for tabular numeric features, embedding-distance metrics for text or image).", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.3.2", + "title": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information.", + "description": "AISVS 1.0 Level 2 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.3.3", + "title": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "description": "AISVS 1.0 Level 2 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.3.4", + "title": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "description": "AISVS 1.0 Level 3 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.4.1", + "title": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring" + }, + { + "control_id": "12.4.2", + "title": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring" + }, + { + "control_id": "12.4.3", + "title": "Verify that kill-switch activations and override commands are logged.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that kill-switch activations and override commands are logged.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring" + }, + { + "control_id": "12.5.1", + "title": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "description": "AISVS 1.0 Level 1 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + }, + { + "control_id": "12.5.2", + "title": "Verify that all labeling activities are recorded in logs.", + "description": "AISVS 1.0 Level 1 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that all labeling activities are recorded in logs.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + }, + { + "control_id": "12.5.3", + "title": "Verify that all model changes generate immutable audit records.", + "description": "AISVS 1.0 Level 2 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that all model changes generate immutable audit records.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + }, + { + "control_id": "12.5.4", + "title": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "description": "AISVS 1.0 Level 2 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + } + ], + "changelog": [ + { + "date": "2026-08-28", + "change": "Initial submission. OWASP AISVS 1.0 (frozen 1.0/en, June 2026): 12 chapters, 44 sections, 191 verification requirements. Levels map to tiers as L1 Foundational, L2 Hardening, L3 Advanced.", + "author": "ottosulin" + } + ] +} \ No newline at end of file diff --git a/crosswalk/docs/backlinks.js b/crosswalk/docs/backlinks.js index 0445346..0b8fc9f 100644 --- a/crosswalk/docs/backlinks.js +++ b/crosswalk/docs/backlinks.js @@ -1,6 +1,6 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Generated: 2026-05-04 -// Backlinks: 1097 +// Generated: 2026-08-28 +// Backlinks: 1262 window.CROSSWALK_BACKLINKS = [ { "framework": "AIUC-1", @@ -25731,6 +25731,3843 @@ window.CROSSWALK_BACKLINKS = [ } ] }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data restricted to features required for the stated purpose, reducing what can be disclosed at all" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, use constraints and processing history" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Data integrity provided for training data in storage and in transit" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Data integrity provided when training data is stored and transferred" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.1", + "control_name": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.2", + "control_name": "Verify that cryptographic integrity is applied to labeling artifacts.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Cryptographic integrity applied to labeling artifacts" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection for deliberate poisoning and unintentional corruption" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.2", + "control_name": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Automatically generated labels subject to confidence thresholds and consistency checks" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.3", + "control_name": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "entries": [ + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Models used in security-relevant decisions evaluated for bias patterns" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training" + }, + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Disallowed content detected and removed before training" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses, the attack class that survives label inspection" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.1", + "control_name": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP components obtained only from trusted sources and cryptographically verified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Only allow-listed MCP servers permitted" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.1", + "control_name": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.2", + "control_name": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.3", + "control_name": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.4", + "control_name": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "entries": [ + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.5", + "control_name": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.6", + "control_name": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers ensure all session artifacts are removed when a session terminates" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.7", + "control_name": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.1", + "control_name": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.3", + "control_name": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att...", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.4", + "control_name": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.5", + "control_name": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.1", + "control_name": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "entries": [ + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Indirect injection path: MCP tools/list and tools/call responses screened before entering model context" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.4", + "control_name": "Verify that all MCP servers enforce strict schema validation.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All MCP servers enforce strict schema validation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.6", + "control_name": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.7", + "control_name": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.8", + "control_name": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t...", + "entries": [ + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.1.2", + "control_name": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Version-controlled alignment test suite run on every model update or release, catching factuality regressions before they ship" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes are not returned directly in outputs" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-principal and global rate limits sized to the threat model rather than as a generic API throttle" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets, limiting memorisation-driven disclosure" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "entries": [ + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test" + }, + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "entries": [ + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector, covering iterative prompt reconstruction" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "entries": [ + { + "id": "DSGAI18", + "name": "Inference and Data Reconstruction", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.3", + "control_name": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.4", + "control_name": "Verify that detection of suspected extraction triggers response measures.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Detection of suspected extraction triggers response measures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.4.3", + "control_name": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i...", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.1", + "control_name": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.2", + "control_name": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m...", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.4", + "control_name": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "entries": [ + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Detection layer: known jailbreak patterns, injection attempts and adversarial inputs alerted on" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.2", + "control_name": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.3", + "control_name": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction atte...", + "entries": [ + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Custom rules detect coordinated jailbreak attempts, injection and system prompt extraction attempts" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.5", + "control_name": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Token usage tracked per user, session, feature endpoint and team so cost abuse is attributable" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.6", + "control_name": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2...", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.1", + "control_name": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match...", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination detection monitors flag factually incorrect, inconsistent or fabricated output" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.3", + "control_name": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Hallucination rates tracked as continuous time-series metrics to detect sustained degradation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.4", + "control_name": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.1", + "control_name": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.2", + "control_name": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.3", + "control_name": "Verify that kill-switch activations and override commands are logged.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Kill-switch activations and override commands logged" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling post-hoc poisoning attribution" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges" + }, + { + "id": "DSGAI08", + "name": "Non-Compliance and Regulatory Violations", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.2", + "control_name": "Verify that all labeling activities are recorded in logs.", + "entries": [ + { + "id": "DSGAI19", + "name": "Human-in-Loop and Labeler Overexposure", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All labeling activities recorded in logs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "entries": [ + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.1", + "control_name": "Verify that input normalization is applied before tokenization or embedding.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Input normalization applied before tokenization or embedding, closing the pre-tokenizer bypass class" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.2", + "control_name": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Encoding and representation smuggling defeated by canonicalization, strict schema validation, policy rejection or explicit marking" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Direct control: all inputs able to steer model behavior are treated as untrusted and screened by an injection ruleset or classifier, with flagged inputs blocked" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.5", + "control_name": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only cha...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Character set restricted by allow-list to only explicitly required characters, removing the exotic-codepoint smuggling surface" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy so system and developer messages keep precedence over user and other untrusted input, including after user text is processed" + }, + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy resists the override-then-reveal extraction pattern" + }, + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.7", + "control_name": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Reserved special tokens encoded as literals so control tokens cannot be injected into the model context" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.8", + "control_name": "Verify that the system can detect many-shot jailbreaking patterns.", + "entries": [ + { + "id": "LLM01", + "name": "Prompt Injection", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 3. Many-shot jailbreaking pattern detection for long-context in-context-learning attacks" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.3", + "control_name": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.4", + "control_name": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ...", + "entries": [ + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Coordinated attacks spanning multiple input types detected and blocked" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.2", + "control_name": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographi...", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Weights, configurations, tokenizers, base models, fine-tunes, adapters and safety models signed by authorized entities" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.3", + "control_name": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.2.3", + "control_name": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "entries": [ + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.1", + "control_name": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Production deployments implement rollout mechanisms with automated rollback triggers" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.2", + "control_name": "Verify that rollback capabilities restore the complete model state.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Rollback capabilities restore the complete model state" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.3", + "control_name": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.4.1", + "control_name": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.2", + "control_name": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "entries": [ + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "entries": [ + { + "id": "LLM04", + "name": "Data and Model Poisoning", + "source_list": "LLM-Top10-2025", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Each stage output integrity-verified before the next stage consumes it in multi-stage fine-tuning" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.4", + "control_name": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "entries": [ + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.1", + "control_name": "Verify that AI models execute in isolated sandboxes.", + "entries": [ + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. AI models execute in isolated sandboxes" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model artifact loading restricted to an allow-list of serialization formats that cannot execute code on deserialization, the pickle class of supply chain RCE" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.4", + "control_name": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Confidential inference services protect model weights during runtime through isolated execution environments" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.1", + "control_name": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.3", + "control_name": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "entries": [ + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Inference runtimes enforce process, memory and file access isolation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.4", + "control_name": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "entries": [ + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.1", + "control_name": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.1", + "control_name": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici...", + "entries": [ + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses containing data the requester is not authorized to receive" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.5", + "control_name": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry" + }, + { + "id": "DSGAI20", + "name": "Model Exfiltration and IP Replication", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to embeddings, prompt caches and model outputs so downstream handling matches the source sensitivity" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Classification labels propagate to prompt caches and model outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.1", + "control_name": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing...", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.2", + "control_name": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica...", + "entries": [ + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.1", + "control_name": "Verify that models are scanned for malicious code before import.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Models scanned for malicious code before import" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and adapters downloaded only from approved sources" + }, + { + "id": "DSGAI03", + "name": "Shadow AI and Unsanctioned Data Flows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.4", + "control_name": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Behavioral acceptance test suite passed before promotion beyond development, catching backdoors that signature checks cannot" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Version-controlled machine-readable AI BOM listing datasets, weights, licenses and data-origin statements" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.2", + "control_name": "Verify that AI BOMs are cryptographically signed before deployment.", + "entries": [ + { + "id": "LLM03", + "name": "Supply Chain Vulnerabilities", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. AI BOMs cryptographically signed before deployment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.3", + "control_name": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "entries": [ + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. All model outputs validated against a defined schema, non-matching output rejected" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. All model outputs validated against a defined schema and rejected when they do not match" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.2", + "control_name": "Verify that model-generated output is bounded by length limits and termination controls.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Model-generated output bounded by length limits and termination controls" + }, + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Output bounded by length limits and termination controls, capping runaway generation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Reliability of generated answers assessed using a confidence estimation method" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.2", + "control_name": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Answers blocked or a fallback message returned when the confidence score falls below a defined threshold" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.3", + "control_name": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Additional verification step for responses classified as high-risk by policy" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + }, + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters detect and block responses that disclose system prompt content or backend data" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content via homoglyphs, formatting, metadata or structured fields" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses include attribution to the source documents" + }, + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.2", + "control_name": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. RAG attributions derived from retrieval metadata rather than generated by the model, so provenance cannot be fabricated" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.3", + "control_name": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "entries": [ + { + "id": "LLM09", + "name": "Misinformation", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Claims in a RAG response traceable to the retrieved chunk" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.4", + "control_name": "Verify that generated media is watermarked to prove it was AI-generated.", + "entries": [ + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Generated media watermarked to prove it was AI-generated" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write, blocking post-hoc retrieval manipulation" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Document metadata tags immutable after initial write" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "id": "DSGAI15", + "name": "Over-Broad Context Windows", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Retrieval operations enforce scope constraints" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "entries": [ + { + "id": "LLM02", + "name": "Sensitive Information Disclosure", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected and masked, tokenized or dropped before embedding, so disclosure is prevented at the index rather than the response" + }, + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI01", + "name": "Sensitive Data Leakage", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI09", + "name": "Multimodal Cross-Channel Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content" + }, + { + "id": "DSGAI10", + "name": "Synthetic Data and Anonymization Pitfalls", + "source_list": "DSGAI-2026", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "id": "DSGAI04", + "name": "Data Model and Artifact Poisoning", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning" + }, + { + "id": "DSGAI21", + "name": "Disinformation via Data Poisoning", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.5", + "control_name": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "entries": [ + { + "id": "LLM08", + "name": "Vector and Embedding Weaknesses", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer" + }, + { + "id": "DSGAI13", + "name": "Vector Store Platform Security", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Expired vectors excluded from retrieval results" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed" + }, + { + "id": "DSGAI07", + "name": "Data Governance and Lifecycle", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, supporting deletion obligations against agent memory" + }, + { + "id": "DSGAI11", + "name": "Cross-Context Conversation Bleed", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next" + }, + { + "id": "DSGAI17", + "name": "Data Availability and Resilience Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.3", + "control_name": "Verify that quarantined content is retained but excluded from all retrieval results.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "entries": [ + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Per-tool quotas and timeouts contain a single failing component" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-execution budgets for recursion depth, token use and monetary spend configured and enforced by the runtime" + }, + { + "id": "LLM10", + "name": "Unbounded Consumption", + "source_list": "LLM-Top10-2025", + "severity": "Medium", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Per-execution budgets for max recursion depth, token use and monetary spend enforced by the runtime" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Per-execution budgets including max recursion depth bound runaway amplification" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.3", + "control_name": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.10", + "control_name": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ...", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.2", + "control_name": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc...", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Each high-impact action carries a trusted reversibility classification" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.4", + "control_name": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact ...", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Runtime enforces reversibility classifications by blocking, requiring approval or restricting the action" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.6", + "control_name": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.7", + "control_name": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through...", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.8", + "control_name": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.9", + "control_name": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "entries": [ + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Key material or credentials used to issue approvals isolated from the agent runtime" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is otherwise isolated from model operations" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "id": "DSGAI16", + "name": "Endpoint and Browser Overreach", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas before the agent consumes them" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas before consumption" + }, + { + "id": "DSGAI05", + "name": "Data Integrity and Validation Failures", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Tool outputs validated against schemas" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.5", + "control_name": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig...", + "entries": [ + { + "id": "ASI01", + "name": "Agent Goal Hijack", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "entries": [ + { + "id": "LLM05", + "name": "Insecure Output Handling", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "id": "ASI05", + "name": "Unexpected Code Execution", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "id": "DSGAI06", + "name": "Tool Plugin and Agent Data Exchange", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation" + }, + { + "id": "ASI04", + "name": "Agentic Supply Chain", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "entries": [ + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Policy violations trigger automated tool containment" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Policy violations trigger automated tool containment" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity" + }, + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.4", + "control_name": "Verify that agent state persisted between invocations is integrity-protected.", + "entries": [ + { + "id": "ASI06", + "name": "Memory and Context Poisoning", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 3. Agent state persisted between invocations is integrity-protected" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy restricting which tools an agent may invoke and which parameter values it may supply" + }, + { + "id": "ASI02", + "name": "Tool Misuse and Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.2", + "control_name": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho...", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the model itself" + }, + { + "id": "DSGAI12", + "name": "Unsafe Natural Language Data Gateways", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "entries": [ + { + "id": "LLM07", + "name": "System Prompt Leakage", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials kept out of the model observable context including context window, system prompts and tool call parameters, so a leaked prompt is not a leaked credential" + }, + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 2. Secrets and credentials required at runtime kept out of the model observable context" + }, + { + "id": "DSGAI02", + "name": "Agent Identity and Credential Exposure", + "source_list": "DSGAI-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control" + }, + { + "id": "DSGAI14", + "name": "Excessive Telemetry and Monitoring Leakage", + "source_list": "DSGAI-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.5", + "control_name": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "entries": [ + { + "id": "ASI07", + "name": "Insecure Inter-Agent Communications", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Inter-agent task delegation restricted by an explicit authorization policy" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.6", + "control_name": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "entries": [ + { + "id": "ASI03", + "name": "Identity and Privilege Abuse", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "entries": [ + { + "id": "LLM06", + "name": "Excessive Agency", + "source_list": "LLM-Top10-2025", + "severity": "High", + "tier": "Foundational", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "id": "ASI10", + "name": "Rogue Agents", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 1. Manual kill-switch to immediately halt inference and outputs" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.2", + "control_name": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "entries": [ + { + "id": "ASI09", + "name": "Human-Agent Trust Exploitation", + "source_list": "Agentic-Top10-2026", + "severity": "High", + "tier": "Hardening", + "scope": "Both", + "notes": "Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure" + } + ] + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.3", + "control_name": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "entries": [ + { + "id": "ASI08", + "name": "Cascading Agent Failures", + "source_list": "Agentic-Top10-2026", + "severity": "Critical", + "tier": "Advanced", + "scope": "Both", + "notes": "Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise" + } + ] + }, { "framework": "OWASP ASVS 4.0.3", "control_id": "V1 Architecture", diff --git a/crosswalk/docs/data.js b/crosswalk/docs/data.js index ec826b4..3bb63aa 100644 --- a/crosswalk/docs/data.js +++ b/crosswalk/docs/data.js @@ -1,6 +1,6 @@ // Auto-generated by scripts/generate.js — do not edit manually // Source: OWASP GenAI Crosswalk v1.5.2 -// Generated: 2026-05-04 +// Generated: 2026-08-28 // Entries: 41 window.CROSSWALK_DATA = [ { @@ -733,6 +733,87 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Share prompt injection threat intelligence with sector peers through DORA information sharing arrangements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Direct control: all inputs able to steer model behavior are treated as untrusted and screened by an injection ruleset or classifier, with flagged inputs blocked" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy so system and developer messages keep precedence over user and other untrusted input, including after user text is processed" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.2", + "control_name": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Encoding and representation smuggling defeated by canonicalization, strict schema validation, policy rejection or explicit marking" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.1", + "control_name": "Verify that input normalization is applied before tokenization or embedding.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input normalization applied before tokenization or embedding, closing the pre-tokenizer bypass class" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.7", + "control_name": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Reserved special tokens encoded as literals so control tokens cannot be injected into the model context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.5", + "control_name": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only cha...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Character set restricted by allow-list to only explicitly required characters, removing the exotic-codepoint smuggling surface" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.8", + "control_name": "Verify that the system can detect many-shot jailbreaking patterns.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 3. Many-shot jailbreaking pattern detection for long-context in-context-learning attacks" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. Indirect injection path: MCP tools/list and tools/call responses screened before entering model context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 1. Detection layer: known jailbreak patterns, injection attempts and adversarial inputs alerted on" } ], "tools": [ @@ -1790,6 +1871,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Deploy detection mechanisms for sensitive data in model outputs; monitor for PII, financial data, and credential patterns in inference responses" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses containing data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes are not returned directly in outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected and masked, tokenized or dropped before embedding, so disclosure is prevented at the index rather than the response" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets, limiting memorisation-driven disclosure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to embeddings, prompt caches and model outputs so downstream handling matches the source sensitivity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data restricted to features required for the stated purpose, reducing what can be disclosed at all" } ], "tools": [ @@ -2640,6 +2793,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for data poisoning events; identify root cause, trace poisoned records, and update protection controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.1", + "control_name": "Verify that models are scanned for malicious code before import.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Models scanned for malicious code before import" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. Model artifact loading restricted to an allow-list of serialization formats that cannot execute code on deserialization, the pickle class of supply chain RCE" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 1. Version-controlled machine-readable AI BOM listing datasets, weights, licenses and data-origin statements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.2", + "control_name": "Verify that AI BOMs are cryptographically signed before deployment.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 2. AI BOMs cryptographically signed before deployment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.2", + "control_name": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographi...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 2. Weights, configurations, tokenizers, base models, fine-tunes, adapters and safety models signed by authorized entities" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.4", + "control_name": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Behavioral acceptance test suite passed before promotion beyond development, catching backdoors that signature checks cannot" } ], "tools": [ @@ -3462,6 +3687,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Define response and recovery procedures for AI denial of service events; include automated throttling, failover, and service restoration" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection for deliberate poisoning and unintentional corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Data integrity provided for training data in storage and in transit" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, use constraints and processing history" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses, the attack class that survives label inspection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Each stage output integrity-verified before the next stage consumes it in multi-stage fine-tuning" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling post-hoc poisoning attribution" } ], "tools": [ @@ -4278,6 +4575,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Include AI supply chain disruption scenarios in resilience testing; test fallback procedures for third-party AI service failures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. All model outputs validated against a defined schema, non-matching output rejected" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.2", + "control_name": "Verify that model-generated output is bounded by length limits and termination controls.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Model-generated output bounded by length limits and termination controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas before the agent consumes them" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content via homoglyphs, formatting, metadata or structured fields" } ], "tools": [ @@ -5074,6 +5425,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets for recursion depth, token use and monetary spend configured and enforced by the runtime" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is otherwise isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the model itself" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy restricting which tools an agent may invoke and which parameter values it may supply" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Each high-impact action carries a trusted reversibility classification" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.4", + "control_name": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact ...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Runtime enforces reversibility classifications by blocking, requiring approval or restricting the action" } ], "tools": [ @@ -5922,6 +6345,51 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Deploy detection mechanisms for system prompt extraction attempts; monitor inference requests for extraction technique patterns" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters detect and block responses that disclose system prompt content or backend data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy resists the override-then-reveal extraction pattern" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials kept out of the model observable context including context window, system prompts and tool call parameters, so a leaked prompt is not a leaked credential" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.3", + "control_name": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction atte...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Custom rules detect coordinated jailbreak attempts, injection and system prompt extraction attempts" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector, covering iterative prompt reconstruction" } ], "tools": [ @@ -6690,6 +7158,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Monitor embedding stores for unauthorised modifications, anomalous writes, and bulk access patterns indicative of extraction or poisoning" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write, blocking post-hoc retrieval manipulation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" } ], "tools": [ @@ -7460,6 +7991,87 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Implement factual grounding controls for financial AI outputs — RAG with authoritative sources, confidence scoring, and human review for high-stakes outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses include attribution to the source documents" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.2", + "control_name": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG attributions derived from retrieval metadata rather than generated by the model, so provenance cannot be fabricated" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Reliability of generated answers assessed using a confidence estimation method" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.2", + "control_name": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Answers blocked or a fallback message returned when the confidence score falls below a defined threshold" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.3", + "control_name": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 2. Claims in a RAG response traceable to the retrieved chunk" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination detection monitors flag factually incorrect, inconsistent or fabricated output" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.3", + "control_name": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination rates tracked as continuous time-series metrics to detect sustained degradation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.3", + "control_name": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 3. Additional verification step for responses classified as high-risk by policy" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.1.2", + "control_name": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training", + "notes": "Level 1. Version-controlled alignment test suite run on every model update or release, catching factuality regressions before they ship" } ], "tools": [ @@ -8305,6 +8917,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Define response and recovery procedures for AI consumption incidents; include automatic throttling, failover activation, and service restoration" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets for max recursion depth, token use and monetary spend enforced by the runtime" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Per-principal and global rate limits sized to the threat model rather than as a generic API throttle" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.2", + "control_name": "Verify that model-generated output is bounded by length limits and termination controls.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Output bounded by length limits and termination controls, capping runaway generation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.5", + "control_name": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Token usage tracked per user, session, feature endpoint and team so cost abuse is attributable" } ], "tools": [ @@ -9118,6 +9784,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Share agent goal hijacking threat intelligence with sector peers through DORA information sharing arrangements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. All inputs able to steer model behavior treated as untrusted and screened by an injection classifier, the primary hijack vector" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy keeps the operator goal authoritative over injected instructions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.2", + "control_name": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP tool responses screened for indirect injection before entering model context, the tool-output hijack path" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Agent and tool outputs not written to trusted agent memory without explicit source validation, blocking hijack persistence" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.5", + "control_name": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trig...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Components processing untrusted data isolated from tool-calling capability so a hijacked reasoning step cannot act" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Self-modification capability such as prompt rewriting, tool-list changes and parameter updates restricted by enforceable boundaries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.6", + "control_name": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the de...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. AI-augmented review of planned high-risk actions, added to and not replacing the deterministic policy gate" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.1", + "control_name": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 1. Detection and alerting on jailbreak patterns, injection attempts and adversarial inputs" } ], "tools": [ @@ -10121,6 +10859,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Include agent access control bypass in resilience testing; verify that agents cannot exceed defined permission boundaries under adversarial conditions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy over which tools may be invoked and which parameter values may be supplied, the direct control for destructive-parameter misuse" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in tool manifests" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before install or invocation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.5", + "control_name": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers enforce access control on every tool invocation, validating both the tool and the specific argument values" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 3. Policy violations trigger automated tool containment" } ], "tools": [ @@ -11123,6 +11933,105 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems, removing inherited-credential ambiguity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.2", + "control_name": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's autho...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Integrity-protected scope-limited token carries the user authorization context and is enforced at every downstream call" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials required at runtime kept out of the model observable context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Agents in federated or multi-system deployments authenticate with short-lived, minimal-scoped, cryptographically signed tokens" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.1", + "control_name": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authe...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Step-up authentication for high-risk AI operations including model deployment, weight export, training data access and production configuration change" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Just-in-time privileged access to weights, training pipelines and production AI configuration with maximum session duration and automatic expiry" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.2", + "control_name": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers validate the presented token issuer, audience, expiration and scope claims per OAuth 2.1, the check that stops a valid credential being replayed beyond its intended scope" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.1", + "control_name": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers validate access tokens on each request rather than relying on transport security alone" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.5", + "control_name": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Policy decision point for agent authorization isolated from the agent execution environment, so a compromised agent cannot rewrite its own privilege boundary" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.6", + "control_name": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 3. Long-running agent sessions re-evaluate current backend authorization policy on every privileged action, closing the stale-grant window" } ], "tools": [ @@ -12015,6 +12924,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Include agent supply chain disruption in resilience testing; test fallback procedures for third-party tool and service failures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.1", + "control_name": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 1. MCP components obtained only from trusted sources and cryptographically verified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Only allow-listed MCP servers permitted" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and adapters downloaded only from approved sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.1", + "control_name": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 1. Version-controlled machine-readable AI BOM per model artifact, giving the static inventory this risk says is usually missing" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.7", + "control_name": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. External resources named in model output verified against an approved allow-list or registry before the agent installs or invokes them, covering runtime-fetched components" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.8", + "control_name": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified t...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 3. Tool definition snapshot maintained and any change triggers re-approval before the modified tool can be invoked, the rug-pull control" } ], "tools": [ @@ -12876,6 +13857,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Monitor agent code execution for anomalous patterns — unexpected system calls, network access, filesystem operations; alert on detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.1", + "control_name": "Verify that AI models execute in isolated sandboxes.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. AI models execute in isolated sandboxes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.2", + "control_name": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese...", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 1. Model artifact loading restricted to serialization formats that cannot execute code during deserialization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas before consumption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. Model output validated against a defined schema and rejected when it does not match, applied to generated code before it reaches an interpreter" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time bound the blast radius of executed code" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.4.1", + "control_name": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices", + "notes": "Level 1. AI-specific runtime components not shared across development, staging and production boundaries, so code executed in a lower environment cannot reach production" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Foundational", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" } ], "tools": [ @@ -13735,6 +14788,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for memory poisoning events; trace poisoned content to source and assess impact on agent decisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.3", + "control_name": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Agent and tool outputs not automatically written to trusted agent memory without explicit source validation, the direct control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp, making poisoned entries attributable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.5", + "control_name": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. New content written to memory checked for contradictions with what is already stored, with conflicts alerting" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, giving a recovery path once poisoning is confirmed" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.3", + "control_name": "Verify that quarantined content is retained but excluded from all retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 3. Quarantined content retained but excluded from all retrieval results, preserving evidence without re-exposure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.4", + "control_name": "Verify that agent state persisted between invocations is integrity-protected.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent state persisted between invocations is integrity-protected" } ], "tools": [ @@ -14582,6 +15707,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.1", + "control_name": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 1. Authenticated, encrypted streamable HTTP required for remote MCP transport" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, the anti-spoofing base control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.3", + "control_name": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding att...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 2. Origin and Host headers validated independently on all HTTP-based transports to prevent DNS rebinding" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.4", + "control_name": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 2. Clients enforce a minimum acceptable protocol version and reject initialize responses below it, blocking downgrade" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.6", + "control_name": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. Tool responses signed with a unique nonce and timestamp so clients can detect replay" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.5", + "control_name": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Inter-agent task delegation restricted by an explicit authorization policy" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.3.5", + "control_name": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport", + "notes": "Level 3. Access tokens between client and server sender-constrained using mTLS or DPoP, defeating agent-in-the-middle token replay" } ], "tools": [ @@ -15389,6 +16586,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Include cascading automation risk in ICT risk management; define acceptable multi-agent coupling thresholds and circuit breaker requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.3", + "control_name": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 2. Swarm-level kill-switch able to halt all active agent instances, the direct containment control for a propagating failure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.2", + "control_name": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-execution budgets including max recursion depth bound runaway amplification" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.1.1", + "control_name": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers", + "notes": "Level 1. Per-tool quotas and timeouts contain a single failing component" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt model inference and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.3", + "control_name": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 3. Kill-switch commands implemented through an out-of-band channel isolated from the agent runtime, so containment survives runtime compromise" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.10", + "control_name": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Approval gates for multi-step or multi-agent chains enforce the highest-impact reversibility classification present anywhere in the chain" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.8", + "control_name": "Verify that policy violations trigger automated tool containment.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 3. Policy violations trigger automated tool containment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.4", + "control_name": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 3. Unexplained behavioral shifts distinguished from gradual expected operational drift, detecting cascade onset" } ], "tools": [ @@ -16186,6 +17455,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Include emerging agentic architecture security in resilience testing; assess novel patterns for resilience implications before production deployment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.2", + "control_name": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and sc...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Approval requests display canonicalized and complete action parameters including diffs, commands, recipients, amounts, resources and scopes, without truncation or unsafe transformation, so the approver sees what they are actually approving" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.2", + "control_name": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 2. Pending action blocked when a human-approval gate is not satisfied within the defined approval time, removing approval-fatigue pressure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.7", + "control_name": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. AI-augmented review mechanism protected against adversarial manipulation and cannot be overridden through prompt injection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses carry source attribution so a persuasive answer can be checked against its source" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.2.1", + "control_name": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation", + "notes": "Level 2. Reliability of generated answers assessed with a confidence estimation method, surfacing uncertainty against fluency" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.2", + "control_name": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Audit logs capture approver identity, timestamp, action parameters and decision outcomes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.8", + "control_name": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Approvals cryptographically bound to action parameters, requester identity, execution context and a single-use nonce, so a displayed approval cannot be swapped for a different action" } ], "tools": [ @@ -17055,6 +18387,87 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Monitor agent dependency health in real time — API availability, response latency, error rates; alert on degradation and trigger fallback procedures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.1", + "control_name": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 1. AI interactions logged with session context and AI-specific telemetry, the foundational visibility control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.2", + "control_name": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 2. Behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts and probing behaviors" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.2", + "control_name": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Agent-initiated actions cryptographically bound to each step of the execution chain for non-repudiation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.6.1", + "control_name": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation", + "notes": "Level 1. Manual kill-switch to immediately halt inference and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.5", + "control_name": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. Self-modification capability restricted by enforceable boundaries, blocking a compromised agent from widening its own scope" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.1", + "control_name": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Autonomous action triggers include proactive behavior-pattern analysis, security evaluation and threat-landscape assessment" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.4.3", + "control_name": "Verify that kill-switch activations and override commands are logged.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring", + "notes": "Level 2. Kill-switch activations and override commands logged" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.2.6", + "control_name": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting", + "notes": "Level 3. LLM API traffic monitored for covert-channel indicators and C2 communication signatures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. All model changes generate immutable audit records, so a silent substitution behind a compliant-looking agent is detectable" } ], "tools": [ @@ -17873,6 +19286,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Classify material AI data access violations as ICT-related incidents; report to competent authorities per DORA incident classification and reporting requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.2", + "control_name": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Output filters block responses disclosing system prompt content or backend data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names" } ], "tools": [ @@ -18759,6 +20235,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Monitor AI data flows for undocumented data movement; alert on data transfers outside documented pipelines" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.3", + "control_name": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.1", + "control_name": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.7", + "control_name": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.1.2", + "control_name": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication", + "notes": "Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.4.3", + "control_name": "Verify that agent identity credentials rotate on a defined schedule.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity", + "notes": "Level 3. Agent identity credentials rotate on a defined schedule" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.9", + "control_name": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 3. Key material or credentials used to issue approvals isolated from the agent runtime" } ], "tools": [ @@ -19484,6 +21023,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Define approved AI tools policy in ICT risk management framework; require vetting and approval before use in financial data processing" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.2", + "control_name": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.2", + "control_name": "Verify that only allow-listed MCP servers are permitted.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.2.3", + "control_name": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing", + "notes": "Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use" } ], "tools": [ @@ -20243,6 +21836,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for data poisoning events; trace poisoned content and update protection controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.3", + "control_name": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.1.3", + "control_name": "Verify that every third-party model artifact can be integrity-verified.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity", + "notes": "Level 2. Every third-party model artifact is integrity-verifiable" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.2", + "control_name": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.4.3", + "control_name": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection", + "notes": "Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself" } ], "tools": [ @@ -20949,6 +22614,87 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Include external data sources in third-party risk management; assess data quality, provenance practices, and licensing compliance" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.3", + "control_name": "Verify that data integrity is provided when training data is stored and transferred.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Data integrity provided when training data is stored and transferred" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.1.1", + "control_name": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement", + "notes": "Level 1. All model outputs validated against a defined schema and rejected when they do not match" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.4", + "control_name": "Verify that all MCP servers enforce strict schema validation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. All MCP servers enforce strict schema validation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.2", + "control_name": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Automatically generated labels subject to confidence thresholds and consistency checks" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "6.2.3", + "control_name": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring", + "notes": "Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.1", + "control_name": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.3", + "control_name": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it" } ], "tools": [ @@ -21686,6 +23432,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Include data lineage requirements in ICT risk management; define minimum lineage completeness per data sensitivity" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.3", + "control_name": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Tool manifests declare required privileges, resource limits and output validation requirements" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.4", + "control_name": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.1", + "control_name": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.3", + "control_name": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 1. MCP servers reject unrecognized or oversized parameters in function calls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.4", + "control_name": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.6", + "control_name": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 2. Architectural separation between processing of untrusted tool outputs and agent operations" } ], "tools": [ @@ -22378,6 +24187,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Monitor for excessive data aggregation patterns; alert on dataset combinations exceeding defined sensitivity thresholds" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.4", + "control_name": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. Every ingested document tagged at write time with source, writer identity and timestamp" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.1.1", + "control_name": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity", + "notes": "Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, supporting deletion obligations against agent memory" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs" } ], "tools": [ @@ -23073,6 +24945,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Conduct post-incident analysis for data leakage events; identify root cause and update controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Differentially-private optimization when training on sensitive datasets" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.3", + "control_name": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Models used in security-relevant decisions evaluated for bias patterns" } ], "tools": [ @@ -23844,6 +25770,51 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Deploy detection for IP exfiltration attempts; monitor model weight access and download patterns" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.3", + "control_name": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "notes": "Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.2.4", + "control_name": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening", + "notes": "Level 3. Coordinated attacks spanning multiple input types detected and blocked" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.4", + "control_name": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" } ], "tools": [ @@ -24507,6 +26478,51 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Apply lessons learned from synthetic data privacy failures; update generation processes and validation controls" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped" } ], "tools": [ @@ -25196,6 +27212,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Enforce retention policies through automated deletion and crypto-shredding; prevent retention beyond defined periods" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.1", + "control_name": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "notes": "Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.3", + "control_name": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.2.6", + "control_name": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization", + "notes": "Level 2. MCP servers ensure all session artifacts are removed when a session terminates" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.3.2", + "control_name": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation", + "notes": "Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute" } ], "tools": [ @@ -25922,6 +27992,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Map ownership for all AI data assets; document rights, restrictions, and licensing for training data and outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.3", + "control_name": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.1", + "control_name": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.3", + "control_name": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.2", + "control_name": "Verify that tool outputs are validated against schemas.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Tool outputs validated against schemas" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.3", + "control_name": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations" } ], "tools": [ @@ -26615,6 +28748,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Classify AI data misuse as ICT-related incidents where customer or regulatory impact occurs; report per DORA criteria" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.1", + "control_name": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.1", + "control_name": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.2", + "control_name": "Verify that document metadata tags are immutable after the initial write.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Document metadata tags immutable after initial write" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.2", + "control_name": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.1", + "control_name": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.1", + "control_name": "Verify that expired vectors are excluded from retrieval results.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Expired vectors excluded from retrieval results" } ], "tools": [ @@ -27323,6 +29519,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Monitor for AI processing inconsistent with consent status; alert on violations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.3", + "control_name": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.5.4", + "control_name": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement", + "notes": "Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.4", + "control_name": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.1.2", + "control_name": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging", + "notes": "Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose" } ], "tools": [ @@ -28042,6 +30292,60 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Build", "notes": "Document data necessity justification for each AI data asset; map minimum required data per use case" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.2", + "control_name": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.4", + "control_name": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 1. Input length controls reject inputs exceeding token limits rather than truncating them" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.1.3", + "control_name": "Verify that retrieval operations enforce scope constraints.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices", + "notes": "Level 2. Retrieval operations enforce scope constraints" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "2.1.6", + "control_name": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses", + "notes": "Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.4", + "control_name": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.7", + "control_name": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Classification labels propagate to prompt caches and model outputs" } ], "tools": [ @@ -28751,6 +31055,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Monitor for privacy degradation indicators; detect inference attacks, re-identification attempts, and memorisation in model outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.1.3", + "control_name": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity", + "notes": "Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "10.4.7", + "control_name": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation", + "notes": "Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.3.1", + "control_name": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization", + "notes": "Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.3", + "control_name": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 3. Inference runtimes enforce process, memory and file access isolation" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "9.2.1", + "control_name": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls", + "notes": "Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.3.3", + "control_name": "Verify that model-generated output is prevented from triggering outbound requests.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety", + "notes": "Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.1", + "control_name": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms" } ], "tools": [ @@ -29466,6 +31833,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Apply lessons learned from bias incidents; update training data, model parameters, and controls based on fairness assessments" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.1", + "control_name": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Production deployments implement rollout mechanisms with automated rollback triggers" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.3.2", + "control_name": "Verify that rollback capabilities restore the complete model state.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback", + "notes": "Level 2. Rollback capabilities restore the complete model state" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.4", + "control_name": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "3.5.4", + "control_name": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning", + "notes": "Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.1", + "control_name": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.3.2", + "control_name": "Verify that memory can be reset.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation", + "notes": "Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.3", + "control_name": "Verify that all model changes generate immutable audit records.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to" } ], "tools": [ @@ -30155,6 +32585,69 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Map all AI systems subject to governance; ensure complete coverage of AI data assets in governance framework" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.5", + "control_name": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.4", + "control_name": "Verify that training on sensitive datasets employs differentially-private optimization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Training on sensitive datasets employs differentially-private optimization" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.1", + "control_name": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Model-inferred sensitive attributes not returned directly in outputs" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.3", + "control_name": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.1", + "control_name": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed" } ], "tools": [ @@ -30806,6 +33299,51 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Participate in information sharing arrangements for third-party AI data risks; share threat intelligence on data provider compromises" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.3", + "control_name": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.1", + "control_name": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.2.2", + "control_name": "Verify that cryptographic integrity is applied to labeling artifacts.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security", + "notes": "Level 2. Cryptographic integrity applied to labeling artifacts" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.5.2", + "control_name": "Verify that all labeling activities are recorded in logs.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit", + "notes": "Level 1. All labeling activities recorded in logs" } ], "tools": [ @@ -31494,6 +34032,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Map physical and logical locations of all AI data; document processing jurisdictions for training, inference, and storage" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.1", + "control_name": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 1. Query-pattern analysis feeds an extraction-attempt detector" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.2.2", + "control_name": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation", + "notes": "Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.2", + "control_name": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.4", + "control_name": "Verify that detection of suspected extraction triggers response measures.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 3. Detection of suspected extraction triggers response measures" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "11.3.3", + "control_name": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense", + "notes": "Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.1.4", + "control_name": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation", + "notes": "Level 3. Confidential inference services protect model weights during runtime through isolated execution environments" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "4.3.4", + "control_name": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security", + "notes": "Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "5.2.6", + "control_name": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum...", + "tier": "Advanced", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification", + "notes": "Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry" } ], "tools": [ @@ -32364,6 +34974,78 @@ window.CROSSWALK_DATA = [ "tier": "Foundational", "scope": "Both", "notes": "Map all AI data subject to regulatory requirements; ensure complete coverage in compliance programme" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.1", + "control_name": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Training and fine-tuning pipelines implement poisoning detection" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.4", + "control_name": "Verify that disallowed content is detected and removed before training.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 2. Disallowed content detected and removed before training" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.1.2", + "control_name": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security", + "notes": "Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "8.2.4", + "control_name": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation", + "notes": "Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "1.3.5", + "control_name": "Verify that defenses against clean-label poisoning attacks are implemented.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance", + "notes": "Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.1", + "control_name": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "12.3.2", + "control_name": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat...", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection", + "notes": "Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output" + }, + { + "framework": "OWASP AISVS 1.0", + "control_id": "7.4.4", + "control_name": "Verify that generated media is watermarked to prove it was AI-generated.", + "tier": "Hardening", + "scope": "Both", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity", + "notes": "Level 3. Generated media watermarked to prove it was AI-generated" } ], "tools": [ diff --git a/crosswalk/docs/frameworks-registry.js b/crosswalk/docs/frameworks-registry.js index d48f3f6..a86ccd8 100644 --- a/crosswalk/docs/frameworks-registry.js +++ b/crosswalk/docs/frameworks-registry.js @@ -1,6 +1,6 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Generated: 2026-05-04 -// Frameworks: 25 +// Generated: 2026-08-28 +// Frameworks: 26 window.CROSSWALK_FRAMEWORKS = [ { "id": "aiuc-1", @@ -6259,6 +6259,1555 @@ window.CROSSWALK_FRAMEWORKS = [ } ] }, + { + "id": "owasp-aisvs", + "name": "OWASP AISVS 1.0", + "short_name": "AISVS", + "version": "1.0", + "url": "https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/", + "license": "CC BY-SA 4.0", + "publisher": "OWASP", + "category": "appsec", + "last_synced": "2026-08-28", + "source_sha": null, + "controls": [ + { + "control_id": "1.1.1", + "title": "Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "description": "AISVS 1.0 Level 1 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that training data includes only features, attributes, and fields required for the model's stated purpose.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.2", + "title": "Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use constraints, and processing history.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use constraints, and processing history.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.3", + "title": "Verify that data integrity is provided when training data is stored and transferred.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that data integrity is provided when training data is stored and transferred.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.4", + "title": "Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "description": "AISVS 1.0 Level 2 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.1.5", + "title": "Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.", + "description": "AISVS 1.0 Level 3 requirement in section C1.1 Training Data Origin & Data Security, chapter C1 Training Data Integrity & Traceability. Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security" + }, + { + "control_id": "1.2.1", + "title": "Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "description": "AISVS 1.0 Level 1 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security" + }, + { + "control_id": "1.2.2", + "title": "Verify that cryptographic integrity is applied to labeling artifacts.", + "description": "AISVS 1.0 Level 2 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that cryptographic integrity is applied to labeling artifacts.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security" + }, + { + "control_id": "1.2.3", + "title": "Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "description": "AISVS 1.0 Level 2 requirement in section C1.2 Data Labeling and Annotation Security, chapter C1 Training Data Integrity & Traceability. Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security" + }, + { + "control_id": "1.3.1", + "title": "Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in training data.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in training data.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.2", + "title": "Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.3", + "title": "Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that models used in security-relevant decisions are evaluated for bias patterns.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.4", + "title": "Verify that disallowed content is detected and removed before training.", + "description": "AISVS 1.0 Level 2 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that disallowed content is detected and removed before training.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "1.3.5", + "title": "Verify that defenses against clean-label poisoning attacks are implemented.", + "description": "AISVS 1.0 Level 3 requirement in section C1.3 Training Data Quality and Security Assurance, chapter C1 Training Data Integrity & Traceability. Verify that defenses against clean-label poisoning attacks are implemented.", + "parent": null, + "function": "Training Data", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance" + }, + { + "control_id": "2.1.1", + "title": "Verify that input normalization is applied before tokenization or embedding.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that input normalization is applied before tokenization or embedding.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.2", + "title": "Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validation, policy-based rejection, or explicit marking.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.3", + "title": "Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.4", + "title": "Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than truncating them.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.5", + "title": "Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters that are explicitly required.", + "description": "AISVS 1.0 Level 1 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters that are explicitly required.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.6", + "title": "Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even after user instructions have been processed.", + "description": "AISVS 1.0 Level 2 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even after user instructions have been processed.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.7", + "title": "Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "description": "AISVS 1.0 Level 2 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.1.8", + "title": "Verify that the system can detect many-shot jailbreaking patterns.", + "description": "AISVS 1.0 Level 3 requirement in section C2.1 Prompt Injection Defenses, chapter C2 Input Validation. Verify that the system can detect many-shot jailbreaking patterns.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses" + }, + { + "control_id": "2.2.1", + "title": "Verify that every prompt is scored by a content classifier for violence, self-harm, hate, and sexual content against configurable thresholds. Prompts that exceed those thresholds are rejected or sanitized before reaching the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that every prompt is scored by a content classifier for violence, self-harm, hate, and sexual content against configurable thresholds. Prompts that exceed those thresholds are rejected or sanitized before reaching the model context.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "2.2.2", + "title": "Verify that prompt content classification is evaluated for unsupported languages.", + "description": "AISVS 1.0 Level 1 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that prompt content classification is evaluated for unsupported languages.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "2.2.3", + "title": "Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known attack patterns.", + "description": "AISVS 1.0 Level 2 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known attack patterns.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "2.2.4", + "title": "Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.", + "description": "AISVS 1.0 Level 3 requirement in section C2.2 Content & Policy Screening, chapter C2 Input Validation. Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.", + "parent": null, + "function": "Input Validation", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening" + }, + { + "control_id": "3.1.1", + "title": "Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "description": "AISVS 1.0 Level 1 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that a model registry maintains an inventory of all deployed model artifacts and their origin.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity" + }, + { + "control_id": "3.1.2", + "title": "Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.", + "description": "AISVS 1.0 Level 2 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically signed by authorized entities.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity" + }, + { + "control_id": "3.1.3", + "title": "Verify that model cryptographic signatures are verified at deployment admission and on load.", + "description": "AISVS 1.0 Level 2 requirement in section C3.1 Model Authorization & Integrity, chapter C3 Model Lifecycle Management & Change Control. Verify that model cryptographic signatures are verified at deployment admission and on load.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity" + }, + { + "control_id": "3.2.1", + "title": "Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.", + "description": "AISVS 1.0 Level 1 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that models undergo automated input validation testing, safety evaluation testing, and output sanitization testing before deployment.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing" + }, + { + "control_id": "3.2.2", + "title": "Verify that models subjected to post-training quantization are re-evaluated against the same safety and alignment test suite on the compressed artifact before deployment.", + "description": "AISVS 1.0 Level 2 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that models subjected to post-training quantization are re-evaluated against the same safety and alignment test suite on the compressed artifact before deployment.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing" + }, + { + "control_id": "3.2.3", + "title": "Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "description": "AISVS 1.0 Level 3 requirement in section C3.2 Model Validation & Testing, chapter C3 Model Lifecycle Management & Change Control. Verify that provider model, version, or routing changes trigger security re-evaluation before continued use.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing" + }, + { + "control_id": "3.3.1", + "title": "Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that production deployments implement rollout mechanisms with automated rollback triggers.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback" + }, + { + "control_id": "3.3.2", + "title": "Verify that rollback capabilities restore the complete model state.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that rollback capabilities restore the complete model state.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback" + }, + { + "control_id": "3.3.3", + "title": "Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "description": "AISVS 1.0 Level 2 requirement in section C3.3 Controlled Deployment & Rollback, chapter C3 Model Lifecycle Management & Change Control. Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback" + }, + { + "control_id": "3.4.1", + "title": "Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "description": "AISVS 1.0 Level 1 requirement in section C3.4 Secure Development Practices, chapter C3 Model Lifecycle Management & Change Control. Verify that AI-specific runtime components are not shared across environment boundaries (e.g., development, staging, production).", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices" + }, + { + "control_id": "3.4.2", + "title": "Verify that model training and fine-tuning environments are isolated from production environments.", + "description": "AISVS 1.0 Level 2 requirement in section C3.4 Secure Development Practices, chapter C3 Model Lifecycle Management & Change Control. Verify that model training and fine-tuning environments are isolated from production environments.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c34-secure-development-practices" + }, + { + "control_id": "3.5.1", + "title": "Verify that models used in RLHF fine-tuning are versioned and integrity-verified before use in a training run.", + "description": "AISVS 1.0 Level 2 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that models used in RLHF fine-tuning are versioned and integrity-verified before use in a training run.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "3.5.2", + "title": "Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "3.5.3", + "title": "Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "3.5.4", + "title": "Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "description": "AISVS 1.0 Level 3 requirement in section C3.5 Pipeline Fine-Tuning, chapter C3 Model Lifecycle Management & Change Control. Verify that fine-tuning checkpoints are registered as distinct artifacts.", + "parent": null, + "function": "Model Lifecycle", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning" + }, + { + "control_id": "4.1.1", + "title": "Verify that AI models execute in isolated sandboxes.", + "description": "AISVS 1.0 Level 1 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI models execute in isolated sandboxes.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.1.2", + "title": "Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.", + "description": "AISVS 1.0 Level 1 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.1.3", + "title": "Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.", + "description": "AISVS 1.0 Level 3 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that workload attestation is performed before model loading to provide proof that the execution environment has not been tampered with.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.1.4", + "title": "Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "description": "AISVS 1.0 Level 3 requirement in section C4.1 AI Workload Sandboxing & Validation, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that confidential inference services protect model weights during runtime through isolated execution environments.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation" + }, + { + "control_id": "4.2.1", + "title": "Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.", + "description": "AISVS 1.0 Level 2 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI accelerator (GPU) firmware is version-pinned, signed, and attested at boot.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.2", + "title": "Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.3", + "title": "Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that AI accelerator (GPU) integrity is validated using hardware-based attestation mechanisms before each workload executes.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.4", + "title": "Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that accelerator (GPU) memory is isolated between workloads through partitioning mechanisms with memory sanitization between jobs.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.2.5", + "title": "Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.", + "description": "AISVS 1.0 Level 3 requirement in section C4.2 AI Hardware Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that accelerator interconnects are restricted to approved topologies and authenticated endpoints.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c42-ai-hardware-security" + }, + { + "control_id": "4.3.1", + "title": "Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "description": "AISVS 1.0 Level 1 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.2", + "title": "Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.", + "description": "AISVS 1.0 Level 2 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that models deployed to edge or mobile devices are cryptographically signed during packaging, and that the on-device runtime validates these signatures or checksums before loading or inference.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.3", + "title": "Verify that inference runtimes enforce process, memory, and file access isolation.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that inference runtimes enforce process, memory, and file access isolation.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.4", + "title": "Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "4.3.5", + "title": "Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.", + "description": "AISVS 1.0 Level 3 requirement in section C4.3 Edge & Distributed AI Security, chapter C4 Infrastructure, Configuration & Deployment Security. Verify that models packaged within mobile, IoT, or embedded applications are encrypted at rest, and decrypted only inside a trusted runtime or secure enclave, preventing direct extraction from the app package or filesystem.", + "parent": null, + "function": "Infrastructure", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security" + }, + { + "control_id": "5.1.1", + "title": "Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.", + "description": "AISVS 1.0 Level 3 requirement in section C5.1 Authentication, chapter C5 Access Control & Identity for AI Components & Users. Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication" + }, + { + "control_id": "5.1.2", + "title": "Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "description": "AISVS 1.0 Level 3 requirement in section C5.1 Authentication, chapter C5 Access Control & Identity for AI Components & Users. Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication" + }, + { + "control_id": "5.2.1", + "title": "Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.2", + "title": "Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rather than relying solely on the service account's permissions.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.3", + "title": "Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.4", + "title": "Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.5", + "title": "Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "description": "AISVS 1.0 Level 2 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.6", + "title": "Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.", + "description": "AISVS 1.0 Level 3 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.2.7", + "title": "Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "description": "AISVS 1.0 Level 3 requirement in section C5.2 AI Resource Authorization & Classification, chapter C5 Access Control & Identity for AI Components & Users. Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification" + }, + { + "control_id": "5.3.1", + "title": "Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.", + "description": "AISVS 1.0 Level 2 requirement in section C5.3 Multi-Tenant Isolation, chapter C5 Access Control & Identity for AI Components & Users. Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation" + }, + { + "control_id": "5.3.2", + "title": "Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requires hardware partitioning, confidential computing, or dedicated per-tenant compute allocation.", + "description": "AISVS 1.0 Level 3 requirement in section C5.3 Multi-Tenant Isolation, chapter C5 Access Control & Identity for AI Components & Users. Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requires hardware partitioning, confidential computing, or dedicated per-tenant compute allocation.", + "parent": null, + "function": "Access Control", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation" + }, + { + "control_id": "6.1.1", + "title": "Verify that models are scanned for malicious code before import.", + "description": "AISVS 1.0 Level 1 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that models are scanned for malicious code before import.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.1.2", + "title": "Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "description": "AISVS 1.0 Level 1 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.1.3", + "title": "Verify that every third-party model artifact can be integrity-verified.", + "description": "AISVS 1.0 Level 2 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that every third-party model artifact can be integrity-verified.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.1.4", + "title": "Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "description": "AISVS 1.0 Level 2 requirement in section C6.1 Model Artifact Integrity, chapter C6 Supply Chain Security for Models. Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity" + }, + { + "control_id": "6.2.1", + "title": "Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.", + "description": "AISVS 1.0 Level 1 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring" + }, + { + "control_id": "6.2.2", + "title": "Verify that AI BOMs are cryptographically signed before deployment.", + "description": "AISVS 1.0 Level 2 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that AI BOMs are cryptographically signed before deployment.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring" + }, + { + "control_id": "6.2.3", + "title": "Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "description": "AISVS 1.0 Level 2 requirement in section C6.2 AI BOM & Supply Chain Monitoring, chapter C6 Supply Chain Security for Models. Verify that AI BOM completeness checks fail the build if any component metadata is missing.", + "parent": null, + "function": "Supply Chain", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring" + }, + { + "control_id": "7.1.1", + "title": "Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "description": "AISVS 1.0 Level 1 requirement in section C7.1 Output Format Enforcement, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement" + }, + { + "control_id": "7.1.2", + "title": "Verify that model-generated output is bounded by length limits and termination controls.", + "description": "AISVS 1.0 Level 1 requirement in section C7.1 Output Format Enforcement, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model-generated output is bounded by length limits and termination controls.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement" + }, + { + "control_id": "7.2.1", + "title": "Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "description": "AISVS 1.0 Level 2 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the system assesses the reliability of generated answers using a confidence estimation method.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation" + }, + { + "control_id": "7.2.2", + "title": "Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "description": "AISVS 1.0 Level 2 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation" + }, + { + "control_id": "7.2.3", + "title": "Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "description": "AISVS 1.0 Level 3 requirement in section C7.2 Hallucination Detection & Mitigation, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that for responses classified as high-risk by policy, the system performs an additional verification step.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation" + }, + { + "control_id": "7.3.1", + "title": "Verify that automated classifiers scan every response and block content that matches defined harmful content categories.", + "description": "AISVS 1.0 Level 1 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that automated classifiers scan every response and block content that matches defined harmful content categories.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.3.2", + "title": "Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "description": "AISVS 1.0 Level 2 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that output filters detect and block responses that disclose system prompt content or backend data.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.3.3", + "title": "Verify that model-generated output is prevented from triggering outbound requests.", + "description": "AISVS 1.0 Level 2 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model-generated output is prevented from triggering outbound requests.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.3.4", + "title": "Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.", + "description": "AISVS 1.0 Level 3 requirement in section C7.3 Output Safety, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety" + }, + { + "control_id": "7.4.1", + "title": "Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "description": "AISVS 1.0 Level 1 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "7.4.2", + "title": "Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "description": "AISVS 1.0 Level 1 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "7.4.3", + "title": "Verify that claims in a RAG response can be traced to the retrieved chunk.", + "description": "AISVS 1.0 Level 2 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that claims in a RAG response can be traced to the retrieved chunk.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "7.4.4", + "title": "Verify that generated media is watermarked to prove it was AI-generated.", + "description": "AISVS 1.0 Level 3 requirement in section C7.4 Source Attribution & Citation Integrity, chapter C7 Model Behavior, Output Control & Safety Assurance. Verify that generated media is watermarked to prove it was AI-generated.", + "parent": null, + "function": "Model Behavior", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity" + }, + { + "control_id": "8.1.1", + "title": "Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "description": "AISVS 1.0 Level 1 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices" + }, + { + "control_id": "8.1.2", + "title": "Verify that document metadata tags are immutable after the initial write.", + "description": "AISVS 1.0 Level 2 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that document metadata tags are immutable after the initial write.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices" + }, + { + "control_id": "8.1.3", + "title": "Verify that retrieval operations enforce scope constraints.", + "description": "AISVS 1.0 Level 2 requirement in section C8.1 Access Controls on Memory & RAG Indices, chapter C8 Memory, Embeddings & Vector Database Security. Verify that retrieval operations enforce scope constraints.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices" + }, + { + "control_id": "8.2.1", + "title": "Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "description": "AISVS 1.0 Level 1 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.2", + "title": "Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "description": "AISVS 1.0 Level 2 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.3", + "title": "Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "description": "AISVS 1.0 Level 2 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that agent outputs and tool outputs are not automatically written to trusted agent memory without explicit source validation.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.4", + "title": "Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "description": "AISVS 1.0 Level 3 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.2.5", + "title": "Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "description": "AISVS 1.0 Level 3 requirement in section C8.2 Embedding Sanitization & Validation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that new content written to memory is checked for contradictions with what is already stored and that conflicts trigger alerts.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation" + }, + { + "control_id": "8.3.1", + "title": "Verify that expired vectors are excluded from retrieval results.", + "description": "AISVS 1.0 Level 2 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that expired vectors are excluded from retrieval results.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation" + }, + { + "control_id": "8.3.2", + "title": "Verify that memory can be reset.", + "description": "AISVS 1.0 Level 2 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that memory can be reset.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation" + }, + { + "control_id": "8.3.3", + "title": "Verify that quarantined content is retained but excluded from all retrieval results.", + "description": "AISVS 1.0 Level 3 requirement in section C8.3 Memory Expiry & Revocation, chapter C8 Memory, Embeddings & Vector Database Security. Verify that quarantined content is retained but excluded from all retrieval results.", + "parent": null, + "function": "Memory and Embeddings", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation" + }, + { + "control_id": "9.1.1", + "title": "Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "description": "AISVS 1.0 Level 1 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers" + }, + { + "control_id": "9.1.2", + "title": "Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "description": "AISVS 1.0 Level 1 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers" + }, + { + "control_id": "9.1.3", + "title": "Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "description": "AISVS 1.0 Level 2 requirement in section C9.1 Execution Budgets, Loop Control, and Circuit Breakers, chapter C9 Orchestration & Agentic Security. Verify that a swarm-level kill-switch exists that can halt all active agent instances.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers" + }, + { + "control_id": "9.2.1", + "title": "Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified.", + "description": "AISVS 1.0 Level 1 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.2", + "title": "Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.3", + "title": "Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.4", + "title": "Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.5", + "title": "Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by enforceable boundaries.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.6", + "title": "Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.7", + "title": "Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.", + "description": "AISVS 1.0 Level 2 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.8", + "title": "Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.9", + "title": "Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.2.10", + "title": "Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain.", + "description": "AISVS 1.0 Level 3 requirement in section C9.2 High-Impact Action Approval and Irreversibility Controls, chapter C9 Orchestration & Agentic Security. Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls" + }, + { + "control_id": "9.3.1", + "title": "Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "description": "AISVS 1.0 Level 1 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.2", + "title": "Verify that tool outputs are validated against schemas.", + "description": "AISVS 1.0 Level 1 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that tool outputs are validated against schemas.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.3", + "title": "Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that tool manifests declare required privileges, resource limits, and output validation requirements.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.4", + "title": "Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.5", + "title": "Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.6", + "title": "Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.7", + "title": "Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.", + "description": "AISVS 1.0 Level 2 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.3.8", + "title": "Verify that policy violations trigger automated tool containment.", + "description": "AISVS 1.0 Level 3 requirement in section C9.3 Component Isolation and Tool Authorization, chapter C9 Orchestration & Agentic Security. Verify that policy violations trigger automated tool containment.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization" + }, + { + "control_id": "9.4.1", + "title": "Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "description": "AISVS 1.0 Level 2 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.4.2", + "title": "Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "description": "AISVS 1.0 Level 2 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.4.3", + "title": "Verify that agent identity credentials rotate on a defined schedule.", + "description": "AISVS 1.0 Level 3 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent identity credentials rotate on a defined schedule.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.4.4", + "title": "Verify that agent state persisted between invocations is integrity-protected.", + "description": "AISVS 1.0 Level 3 requirement in section C9.4 Agent and Orchestrator Identity, chapter C9 Orchestration & Agentic Security. Verify that agent state persisted between invocations is integrity-protected.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity" + }, + { + "control_id": "9.5.1", + "title": "Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which parameter values it may supply.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.2", + "title": "Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization context and is enforced at every downstream call.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that when an agent acts on a user's behalf, the runtime propagates an integrity-protected, scope-limited token that carries the user's authorization context and is enforced at every downstream call.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.3", + "title": "Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.4", + "title": "Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, system prompts, or tool call parameters.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.5", + "title": "Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "description": "AISVS 1.0 Level 2 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that inter-agent task delegation is restricted by an explicit authorization policy.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.5.6", + "title": "Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "description": "AISVS 1.0 Level 3 requirement in section C9.5 Agent Authorization, Delegation, and Continuous Enforcement, chapter C9 Orchestration & Agentic Security. Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement" + }, + { + "control_id": "9.6.1", + "title": "Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "description": "AISVS 1.0 Level 1 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation" + }, + { + "control_id": "9.6.2", + "title": "Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "description": "AISVS 1.0 Level 2 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation" + }, + { + "control_id": "9.6.3", + "title": "Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "description": "AISVS 1.0 Level 3 requirement in section C9.6 Shutdown and Graceful Degradation, chapter C9 Orchestration & Agentic Security. Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.", + "parent": null, + "function": "Agentic Orchestration", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation" + }, + { + "control_id": "10.1.1", + "title": "Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "description": "AISVS 1.0 Level 1 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP components are obtained only from trusted sources and cryptographically verified.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity" + }, + { + "control_id": "10.1.2", + "title": "Verify that only allow-listed MCP servers are permitted.", + "description": "AISVS 1.0 Level 2 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that only allow-listed MCP servers are permitted.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity" + }, + { + "control_id": "10.1.3", + "title": "Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "description": "AISVS 1.0 Level 2 requirement in section C10.1 Component Integrity, chapter C10 Model Context Protocol (MCP) Security. Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity" + }, + { + "control_id": "10.2.1", + "title": "Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate access tokens for each request and do not rely on transport security alone.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.2", + "title": "Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate the presented access token's issuer, audience, expiration, and scope claims in accordance with OAuth 2.1.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.3", + "title": "Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "description": "AISVS 1.0 Level 1 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.4", + "title": "Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.5", + "title": "Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers enforce access control on every tool invocation, validating that the user's access token authorizes both the requested tool and the specific argument values supplied.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.6", + "title": "Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers ensure all session artifacts are removed when a session terminates.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.2.7", + "title": "Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "description": "AISVS 1.0 Level 2 requirement in section C10.2 Authentication & Authorization, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers do not pass through access tokens received from clients to downstream APIs.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization" + }, + { + "control_id": "10.3.1", + "title": "Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "description": "AISVS 1.0 Level 1 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that authenticated, encrypted streamable HTTP is used for MCP transport for remote services.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.2", + "title": "Verify that stdio transport is permitted only in controlled local environments.", + "description": "AISVS 1.0 Level 1 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that stdio transport is permitted only in controlled local environments.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.3", + "title": "Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.", + "description": "AISVS 1.0 Level 2 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers validate both the Origin header and the Host header independently on all HTTP-based transports to prevent DNS rebinding attacks.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.4", + "title": "Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "description": "AISVS 1.0 Level 2 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients enforce a minimum acceptable protocol version and reject initialize responses that propose a version below that minimum.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.3.5", + "title": "Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "description": "AISVS 1.0 Level 3 requirement in section C10.3 Secure Transport, chapter C10 Model Context Protocol (MCP) Security. Verify that access tokens between the MCP client and server are sender-constrained using mTLS or DPoP.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c103-secure-transport" + }, + { + "control_id": "10.4.1", + "title": "Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.2", + "title": "Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.3", + "title": "Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "description": "AISVS 1.0 Level 1 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers reject unrecognized or oversized parameters in function calls.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.4", + "title": "Verify that all MCP servers enforce strict schema validation.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that all MCP servers enforce strict schema validation.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.5", + "title": "Verify that all MCP transports enforce maximum payload size limits.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that all MCP transports enforce maximum payload size limits.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.6", + "title": "Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP servers sign tool responses with a unique nonce and timestamp so MCP clients can detect replay attempts.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.7", + "title": "Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "description": "AISVS 1.0 Level 2 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "10.4.8", + "title": "Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.", + "description": "AISVS 1.0 Level 3 requirement in section C10.4 Schema, Message, and Input Validation, chapter C10 Model Context Protocol (MCP) Security. Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.", + "parent": null, + "function": "MCP Security", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation" + }, + { + "control_id": "11.1.1", + "title": "Verify that the model has undergone alignment and safety training or fine-tuning to prevent the model from generating disallowed content categories.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that the model has undergone alignment and safety training or fine-tuning to prevent the model from generating disallowed content categories.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.2", + "title": "Verify that a version-controlled alignment test suite is run on every model update or release.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that a version-controlled alignment test suite is run on every model update or release.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.3", + "title": "Verify that models are evaluated against known adversarial attack techniques relevant to their modality.", + "description": "AISVS 1.0 Level 1 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that models are evaluated against known adversarial attack techniques relevant to their modality.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.4", + "title": "Verify that models are hardened against adversarial inputs.", + "description": "AISVS 1.0 Level 2 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that models are hardened against adversarial inputs.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.1.5", + "title": "Verify that an automated evaluator measures harmful-content rate and flags regressions beyond a defined threshold.", + "description": "AISVS 1.0 Level 3 requirement in section C11.1 Model Alignment, Safety, and Robustness Testing and Training, chapter C11 Adversarial Robustness. Verify that an automated evaluator measures harmful-content rate and flags regressions beyond a defined threshold.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training" + }, + { + "control_id": "11.2.1", + "title": "Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "description": "AISVS 1.0 Level 1 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that model-inferred sensitive attributes are not directly returned in outputs.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.2", + "title": "Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.", + "description": "AISVS 1.0 Level 1 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.3", + "title": "Verify that model outputs are calibrated to reduce overconfident predictions.", + "description": "AISVS 1.0 Level 2 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that model outputs are calibrated to reduce overconfident predictions.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.4", + "title": "Verify that training on sensitive datasets employs differentially-private optimization.", + "description": "AISVS 1.0 Level 2 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that training on sensitive datasets employs differentially-private optimization.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.2.5", + "title": "Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "description": "AISVS 1.0 Level 3 requirement in section C11.2 Membership-Inference and Model-Inversion Mitigation, chapter C11 Adversarial Robustness. Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation" + }, + { + "control_id": "11.3.1", + "title": "Verify that query-pattern analysis feeds an extraction-attempt detector.", + "description": "AISVS 1.0 Level 1 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that query-pattern analysis feeds an extraction-attempt detector.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.3.2", + "title": "Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.", + "description": "AISVS 1.0 Level 2 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction risk level.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.3.3", + "title": "Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "description": "AISVS 1.0 Level 3 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.3.4", + "title": "Verify that detection of suspected extraction triggers response measures.", + "description": "AISVS 1.0 Level 3 requirement in section C11.3 Model-Extraction Defense, chapter C11 Adversarial Robustness. Verify that detection of suspected extraction triggers response measures.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense" + }, + { + "control_id": "11.4.1", + "title": "Verify that inputs from external or untrusted sources pass through anomaly detection before model inference.", + "description": "AISVS 1.0 Level 2 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that inputs from external or untrusted sources pass through anomaly detection before model inference.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection" + }, + { + "control_id": "11.4.2", + "title": "Verify that inputs flagged as anomalous trigger gating actions.", + "description": "AISVS 1.0 Level 2 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that inputs flagged as anomalous trigger gating actions.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection" + }, + { + "control_id": "11.4.3", + "title": "Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement mechanism.", + "description": "AISVS 1.0 Level 3 requirement in section C11.4 Model Runtime Anomaly Detection, chapter C11 Adversarial Robustness. Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement mechanism.", + "parent": null, + "function": "Adversarial Robustness", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection" + }, + { + "control_id": "12.1.1", + "title": "Verify that AI interactions are logged with session context and AI-specific telemetry.", + "description": "AISVS 1.0 Level 1 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that AI interactions are logged with session context and AI-specific telemetry.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.1.2", + "title": "Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.1.3", + "title": "Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.1.4", + "title": "Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "description": "AISVS 1.0 Level 2 requirement in section C12.1 Request & Response Logging, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging" + }, + { + "control_id": "12.2.1", + "title": "Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "description": "AISVS 1.0 Level 1 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.2", + "title": "Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that behavioral anomaly detection identifies unusual conversation patterns, excessive retry attempts, or probing behaviors.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.3", + "title": "Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.4", + "title": "Verify that extraction-alert events include offending query metadata to support investigation.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that extraction-alert events include offending query metadata to support investigation.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.5", + "title": "Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "description": "AISVS 1.0 Level 2 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.2.6", + "title": "Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.", + "description": "AISVS 1.0 Level 3 requirement in section C12.2 Detection and Alerting, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that LLM API traffic is monitored for covert-channel indicators and communication signatures to identify malware and command-and-control (C2) activity.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting" + }, + { + "control_id": "12.3.1", + "title": "Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the input data type (e.g., KS test or PSI for tabular numeric features, embedding-distance metrics for text or image).", + "description": "AISVS 1.0 Level 1 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the input data type (e.g., KS test or PSI for tabular numeric features, embedding-distance metrics for text or image).", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.3.2", + "title": "Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information.", + "description": "AISVS 1.0 Level 2 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.3.3", + "title": "Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "description": "AISVS 1.0 Level 2 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.3.4", + "title": "Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "description": "AISVS 1.0 Level 3 requirement in section C12.3 Model, Data, and Performance Drift Detection, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that unexplained behavioral shifts are distinguished from gradual, expected operational drift.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection" + }, + { + "control_id": "12.4.1", + "title": "Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring" + }, + { + "control_id": "12.4.2", + "title": "Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that audit logs capture security-critical proactive actions, including approver identity, timestamp, action parameters, and decision outcomes.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring" + }, + { + "control_id": "12.4.3", + "title": "Verify that kill-switch activations and override commands are logged.", + "description": "AISVS 1.0 Level 2 requirement in section C12.4 Proactive Security Behavior Monitoring, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that kill-switch activations and override commands are logged.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c124-proactive-security-behavior-monitoring" + }, + { + "control_id": "12.5.1", + "title": "Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "description": "AISVS 1.0 Level 1 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + }, + { + "control_id": "12.5.2", + "title": "Verify that all labeling activities are recorded in logs.", + "description": "AISVS 1.0 Level 1 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that all labeling activities are recorded in logs.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + }, + { + "control_id": "12.5.3", + "title": "Verify that all model changes generate immutable audit records.", + "description": "AISVS 1.0 Level 2 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that all model changes generate immutable audit records.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + }, + { + "control_id": "12.5.4", + "title": "Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "description": "AISVS 1.0 Level 2 requirement in section C12.5 Training Data & Model Lifecycle Audit, chapter C12 Monitoring, Logging & Anomaly Detection. Verify that every ingested document is tagged at write time with source, writer identity, and timestamp.", + "parent": null, + "function": "Monitoring and Logging", + "url": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit" + } + ], + "changelog": [ + { + "date": "2026-08-28", + "change": "Initial submission. OWASP AISVS 1.0 (frozen 1.0/en, June 2026): 12 chapters, 44 sections, 191 verification requirements. Levels map to tiers as L1 Foundational, L2 Hardening, L3 Advanced.", + "author": "ottosulin" + } + ] + }, { "id": "owasp-asvs", "name": "OWASP ASVS 4.0.3", diff --git a/crosswalk/docs/incidents.js b/crosswalk/docs/incidents.js index 6b1c180..8a973a1 100644 --- a/crosswalk/docs/incidents.js +++ b/crosswalk/docs/incidents.js @@ -1,5 +1,5 @@ // Auto-generated by scripts/generate.js — do not edit manually -// Generated: 2026-05-04 +// Generated: 2026-08-28 // Incidents: 114 window.CROSSWALK_INCIDENTS = [ { diff --git a/crosswalk/dsgai-2026/DSGAI_AISVS.md b/crosswalk/dsgai-2026/DSGAI_AISVS.md new file mode 100644 index 0000000..b094cf2 --- /dev/null +++ b/crosswalk/dsgai-2026/DSGAI_AISVS.md @@ -0,0 +1,955 @@ + + +# OWASP GenAI Data Security Risks 2026 × OWASP AISVS 1.0 + +Mapping the [OWASP GenAI Data Security Risks 2026](https://genai.owasp.org/resource/genai-data-security-risks/) to the [OWASP Artificial Intelligence Security Verification Standard 1.0](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/), a technical verification standard of 191 testable requirements across 12 chapters, used by engineers and auditors to verify that a specific AI system implements a control rather than merely documents it. + +--- + +## Why AISVS for this source list + +Most frameworks already in this crosswalk answer the question of what an organisation should govern. AISVS answers a different question: given a running AI system, what does an assessor check, and what does a pass look like. Every requirement is written to be independently verifiable and starts with the words Verify that. + +That makes this mapping the bridge between a risk in this source list and a concrete test an engineer can run. Where ISO 42001 or NIST AI RMF establish that a control must exist, AISVS states the condition that demonstrates it does. The two are complements, not substitutes, and reading them together turns a control objective into an audit step. + +AISVS also assigns each requirement a level from 1 to 3 reflecting implementation difficulty and how situational the control is. That maps cleanly onto the tier model used throughout this crosswalk, so the tier column below carries real information about sequencing rather than a subjective judgement. + +--- + +## AISVS structure + +| Chapter | Description | Requirements | +|---|---|---| +| [C1 Training Data Integrity & Traceability](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md) | This chapter addresses protecting the integrity and traceability of training data as it is sourced, handled, and maintained. | 13 | +| [C2 Input Validation](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C02-Input-Validation.md) | This chapter addresses validation of all inputs as a first-line defense against prompt injection, one of the most damaging attacks on AI systems. | 12 | +| [C3 Model Lifecycle Management & Change Control](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md) | This chapter addresses control of model changes so that unauthorized or unsafe modifications cannot reach production. | 15 | +| [C4 Infrastructure, Configuration & Deployment Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C04-Infrastructure.md) | This chapter addresses hardening AI-specific infrastructure components against model theft, data leakage, and cross-tenant contamination. | 14 | +| [C5 Access Control & Identity for AI Components & Users](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C05-Access-Control-and-Identity.md) | This chapter addresses access control challenges that AI systems introduce beyond traditional application security. | 11 | +| [C6 Supply Chain Security for Models](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C06-Supply-Chain.md) | This chapter addresses defending against AI supply chain attacks that exploit third-party models, frameworks, or datasets to embed backdoors, bias, or exploitable code. | 7 | +| [C7 Model Behavior, Output Control & Safety Assurance](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C07-Model-Behavior.md) | This chapter addresses constraining, validating, and monitoring model outputs so that unsafe, malformed, or high-risk responses cannot reach users or downstream systems. | 13 | +| [C8 Memory, Embeddings & Vector Database Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md) | This chapter addresses securing the embeddings and vector stores that act as semi-persistent and persistent "memory" for AI systems through Retrieval-Augmented Generation (RAG). | 11 | +| [C9 Orchestration & Agentic Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md) | This chapter addresses ensuring autonomous and multi-agent systems execute only authorized, intended, and bounded actions. | 34 | +| [C10 Model Context Protocol (MCP) Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C10-MCP-Security.md) | This chapter addresses secure discovery, authentication, authorization, transport, and use of MCP-based tool and resource integrations. | 23 | +| [C11 Adversarial Robustness](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C11-Adversarial-Robustness.md) | This chapter addresses keeping AI systems reliable and abuse-resistant when facing evasion, inference, extraction, or poisoning attacks. | 17 | +| [C12 Monitoring, Logging & Anomaly Detection](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C12-Monitoring-and-Logging.md) | This chapter addresses real-time and forensic visibility into what the model and other AI components see, do, and return, so that AI-specific threats can be detected and triaged. | 21 | + +Levels map to crosswalk tiers as Level 1 Foundational, Level 2 Hardening, Level 3 Advanced. Where an entry maps to requirements at several levels, the tier column below reports the level most of its requirements sit at. + +--- + +## Quick-reference summary + +| ID | Name | Severity | Primary AISVS Controls | Tier | Scope | +|---|---|---|---|---|---| +| DSGAI01 | Sensitive Data Leakage | Critical | C5.2, C8.2, C11.2, C1.1, C7.3 | Hardening | Both | +| DSGAI02 | Agent Identity and Credential Exposure | Critical | C9.5, C10.2, C9.4, C5.1, C9.2 | Hardening | Both | +| DSGAI03 | Shadow AI and Unsanctioned Data Flows | High | C6.1, C10.1, C3.1, C1.1, C12.1, C3.2 | Hardening | Both | +| DSGAI04 | Data Model and Artifact Poisoning | Critical | C1.3, C1.1, C3.1, C6.1, C8.2, C3.5, C11.4 | Hardening | Both | +| DSGAI05 | Data Integrity and Validation Failures | High | C1.1, C7.1, C9.3, C10.4, C1.3, C6.2, C12.3, C3.5 | Hardening | Both | +| DSGAI06 | Tool Plugin and Agent Data Exchange | High | C9.3, C10.4, C10.2 | Hardening | Both | +| DSGAI07 | Data Governance and Lifecycle | High | C1.1, C12.5, C3.1, C8.3, C5.2 | Hardening | Both | +| DSGAI08 | Non-Compliance and Regulatory Violations | High | C1.1, C12.5, C1.2, C11.2, C1.3 | Hardening | Both | +| DSGAI09 | Multimodal Cross-Channel Leakage | High | C2.2, C7.3, C8.2, C5.2 | Hardening | Both | +| DSGAI10 | Synthetic Data and Anonymization Pitfalls | Medium | C11.2, C1.2, C8.2 | Hardening | Both | +| DSGAI11 | Cross-Context Conversation Bleed | High | C5.3, C8.1, C3.3, C10.2, C8.3 | Hardening | Both | +| DSGAI12 | Unsafe Natural Language Data Gateways | Critical | C9.5, C5.2, C2.1, C9.3, C9.2 | Hardening | Both | +| DSGAI13 | Vector Store Platform Security | High | C5.2, C8.1, C8.2, C8.3 | Hardening | Both | +| DSGAI14 | Excessive Telemetry and Monitoring Leakage | High | C12.1, C9.5, C5.2, C1.2 | Hardening | Both | +| DSGAI15 | Over-Broad Context Windows | High | C5.2, C2.1, C8.1 | Hardening | Both | +| DSGAI16 | Endpoint and Browser Overreach | High | C10.1, C10.4, C9.3, C4.3, C9.2, C7.3 | Hardening | Both | +| DSGAI17 | Data Availability and Resilience Failures | High | C3.3, C1.1, C3.5, C12.5, C8.3 | Hardening | Both | +| DSGAI18 | Inference and Data Reconstruction | High | C11.2, C11.3, C1.1 | Hardening | Both | +| DSGAI19 | Human-in-Loop and Labeler Overexposure | Medium | C1.2, C1.3, C12.5 | Hardening | Both | +| DSGAI20 | Model Exfiltration and IP Replication | High | C11.3, C11.2, C4.1, C4.3, C5.2 | Advanced | Both | +| DSGAI21 | Disinformation via Data Poisoning | High | C1.3, C1.1, C8.2, C7.4, C12.3 | Hardening | Both | + +--- + +## Target audience + +| Role | Sections to prioritise | +|---|---| +| Security engineer | C2 Input Validation, C9 Orchestration and Agentic Security, C10 MCP Security | +| Developer | C7 Model Behavior and Output Control, C8 Memory and Embeddings, C5 Access Control | +| ML engineer | C1 Training Data, C3 Model Lifecycle, C11 Adversarial Robustness | +| Auditor | The whole standard. Every requirement is written as a verifiable test | +| Compliance and GRC | C1 Training Data, C6 Supply Chain, C12 Monitoring and Logging | +| Red teamer | C2 Input Validation, C11 Adversarial Robustness, C9 Orchestration | + +--- + +## Detailed mappings + +--- + +### DSGAI01 - Sensitive Data Leakage + +AISVS enforces authorization at the retrieval boundary rather than the response. C5.2.2 requires the end-user context at each retrieval and assembly stage, C5.2.4 filters post-inference, and C5.2.7 propagates classification labels into embeddings, caches and outputs so the aggregation effect stays governed. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. | [5.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive | +| Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ... | [5.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage, the direct control for RAG over-retrieval | +| Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. | [8.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped | +| Verify that model-inferred sensitive attributes are not directly returned in outputs. | [11.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 1. Model-inferred sensitive attributes not returned directly in outputs | +| Verify that training data includes only features, attributes, and fields required for the model's stated purpose. | [1.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 1. Training data limited to features required for the stated purpose, bounding memorisation exposure at source | +| Verify that output filters detect and block responses that disclose system prompt content or backend data. | [7.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 2. Output filters block responses disclosing system prompt content or backend data | +| Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). | [5.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Classification labels propagate to embeddings, prompt caches and outputs, addressing the aggregation effect this risk names | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 8.2.1: Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. +- 11.2.1: Verify that model-inferred sensitive attributes are not directly returned in outputs. +- 1.1.1: Verify that training data includes only features, attributes, and fields required for the model's stated purpose. + +**Tier 2 - Short-term (first 30 days):** +- 5.2.4: Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. +- 5.2.2: Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rat... +- 7.3.2: Verify that output filters detect and block responses that disclose system prompt content or backend data. + +**Tier 3 - Strategic:** +- 5.2.7: Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). + +#### Cross-references + +- LLM Top 10: LLM02, LLM01, LLM03, LLM07 +- Agentic: ASI03, ASI06, ASI01, ASI02 +- DSGAI: N/A +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI02 - Agent Identity and Credential Exposure + +AISVS keeps credentials out of the model's reach entirely. C9.5.4 excludes secrets from the context window, system prompts and tool call parameters, C10.2.3 stops MCP resource servers persisting tokens, and C10.2.7 blocks the token pass-through that propagates one compromise across services. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi... | [9.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Secrets and credentials required at runtime not exposed within the model observable context including context window, system prompts and tool call parameters, the direct control | +| Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials. | [10.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 1. MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials | +| Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. | [9.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 2. Each agent instance has a unique cryptographic identity and authenticates as a first-class principal, so a shared credential is not the identity | +| Verify that MCP servers do not pass through access tokens received from clients to downstream APIs. | [10.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 2. MCP servers do not pass through client access tokens to downstream APIs, blocking the confused-deputy propagation this risk describes | +| Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens. | [5.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c51-authentication) | Level 3. Short-lived, minimal-scoped, cryptographically signed tokens for agents in federated deployments, bounding the value of a leaked credential | +| Verify that agent identity credentials rotate on a defined schedule. | [9.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c94-agent-and-orchestrator-identity) | Level 3. Agent identity credentials rotate on a defined schedule | +| Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime. | [9.2.9](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 3. Key material or credentials used to issue approvals isolated from the agent runtime | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 10.2.3: Verify that MCP servers acting as OAuth 2.1 resource servers do not store or persist access tokens or user credentials. + +**Tier 2 - Short-term (first 30 days):** +- 9.5.4: Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, syst... +- 9.4.1: Verify that each agent instance has a unique cryptographic identity and authenticates as a first-class principal to downstream systems. +- 10.2.7: Verify that MCP servers do not pass through access tokens received from clients to downstream APIs. + +**Tier 3 - Strategic:** +- 5.1.2: Verify that AI agents in federated or multi-system deployments authenticate using short-lived, minimal-scoped, cryptographically signed tokens. +- 9.4.3: Verify that agent identity credentials rotate on a defined schedule. +- 9.2.9: Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime. + +#### Cross-references + +- LLM Top 10: LLM06, LLM04, LLM03, LLM05, LLM09 +- Agentic: ASI03, ASI07, ASI04, ASI09 +- DSGAI: DSGAI01 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI03 - Shadow AI and Unsanctioned Data Flows + +AISVS gives shadow AI a technical rather than policy answer. C10.1.2 allow-lists MCP servers, C6.1.2 restricts model and dataset sources to approved ones, and C12.1.3 requires a structured inference log carrying the provider name so unsanctioned egress is visible. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. | [6.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources | +| Verify that only allow-listed MCP servers are permitted. | [10.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 2. Only allow-listed MCP servers permitted, the technical gate on unsanctioned tool and data channels | +| Verify that a model registry maintains an inventory of all deployed model artifacts and their origin. | [3.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity) | Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin | +| Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int... | [1.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method and use constraints | +| Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ... | [12.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging) | Level 2. Structured inference log schema including model identifier, token usage, provider name and operation type, giving per-provider visibility of where data is going | +| Verify that provider model, version, or routing changes trigger security re-evaluation before continued use. | [3.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c32-model-validation--testing) | Level 3. Provider model, version or routing changes trigger security re-evaluation before continued use | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 6.1.2: Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. +- 3.1.1: Verify that a model registry maintains an inventory of all deployed model artifacts and their origin. + +**Tier 2 - Short-term (first 30 days):** +- 10.1.2: Verify that only allow-listed MCP servers are permitted. +- 1.1.2: Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use ... +- 12.1.3: Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and... + +**Tier 3 - Strategic:** +- 3.2.3: Verify that provider model, version, or routing changes trigger security re-evaluation before continued use. + +#### Cross-references + +- LLM Top 10: LLM03, LLM02, LLM05, LLM06 +- Agentic: ASI04, ASI10 +- DSGAI: DSGAI07, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI04 - Data Model and Artifact Poisoning + +AISVS covers poisoning across training data, artifacts and the RAG store. C1.3 requires pipeline poisoning detection, C3.1.3 verifies signatures at deployment admission and on load, and C11.4.3 protects the safety feedback loop itself from adversarial manipulation. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru... | [1.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Training and fine-tuning pipelines implement poisoning detection | +| Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. | [1.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Integrity monitoring guards training data against unauthorized modification or corruption | +| Verify that model cryptographic signatures are verified at deployment admission and on load. | [3.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity) | Level 2. Model cryptographic signatures verified at deployment admission and on load, blocking a poisoned artifact from reaching production | +| Verify that every third-party model artifact can be integrity-verified. | [6.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 2. Every third-party model artifact is integrity-verifiable | +| Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. | [8.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, covering RAG-store poisoning | +| Verify that defenses against clean-label poisoning attacks are implemented. | [1.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 3. Clean-label poisoning defenses | +| Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization. | [3.5.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning) | Level 3. RLHF training stages include automated detection of reward hacking or reward model over-optimization | +| Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the i... | [11.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c114-model-runtime-anomaly-detection) | Level 3. Safety violation feedback pipeline includes poisoning detection and human review gates, protecting the improvement loop itself | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- No AISVS Level 1 requirement maps to this entry + +**Tier 2 - Short-term (first 30 days):** +- 1.3.1: Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in t... +- 1.1.4: Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. +- 3.1.3: Verify that model cryptographic signatures are verified at deployment admission and on load. +- 6.1.3: Verify that every third-party model artifact can be integrity-verified. + +**Tier 3 - Strategic:** +- 8.2.4: Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. +- 1.3.5: Verify that defenses against clean-label poisoning attacks are implemented. +- 3.5.2: Verify that RLHF training stages include automated detection of reward hacking or reward model over-optimization. +- 11.4.3: Verify that the safety violation feedback pipeline includes poisoning detection and human review gates to prevent adversarial manipulation of the improvement... + +#### Cross-references + +- LLM Top 10: LLM03, LLM04, LLM08, LLM05 +- Agentic: ASI06, ASI04 +- DSGAI: N/A +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI05 - Data Integrity and Validation Failures + +AISVS requires schema validation at each system boundary. C7.1.1 validates model output, C9.3.2 validates tool output, C10.4.3 and C10.4.4 validate MCP parameters and messages, and C6.2.3 turns missing component metadata into a build failure rather than a silent gap. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that data integrity is provided when training data is stored and transferred. | [1.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Data integrity provided when training data is stored and transferred | +| Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. | [7.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement) | Level 1. All model outputs validated against a defined schema and rejected when they do not match | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas | +| Verify that all MCP servers enforce strict schema validation. | [10.4.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 2. All MCP servers enforce strict schema validation | +| Verify that MCP servers reject unrecognized or oversized parameters in function calls. | [10.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 1. MCP servers reject unrecognized or oversized parameters in function calls | +| Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels. | [1.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Automatically generated labels subject to confidence thresholds and consistency checks | +| Verify that AI BOM completeness checks fail the build if any component metadata is missing. | [6.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring) | Level 2. AI BOM completeness checks fail the build if any component metadata is missing, turning silent pipeline gaps into build failures | +| Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods match... | [12.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection) | Level 1. Data drift detection monitors input distribution changes using statistically validated methods matched to the data type, catching silent pipeline corruption | +| Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage. | [3.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning) | Level 3. Each fine-tuning stage output integrity-verified before the next stage consumes it | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 7.1.1: Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. +- 9.3.2: Verify that tool outputs are validated against schemas. +- 10.4.3: Verify that MCP servers reject unrecognized or oversized parameters in function calls. +- 12.3.1: Verify that data drift detection monitors input distribution changes that may impact model performance, using statistically validated methods matched to the ... + +**Tier 2 - Short-term (first 30 days):** +- 1.1.3: Verify that data integrity is provided when training data is stored and transferred. +- 10.4.4: Verify that all MCP servers enforce strict schema validation. +- 1.3.2: Verify that automatically generated labels are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels. +- 6.2.3: Verify that AI BOM completeness checks fail the build if any component metadata is missing. + +**Tier 3 - Strategic:** +- 3.5.3: Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage. + +#### Cross-references + +- LLM Top 10: LLM05, LLM04, LLM01, LLM03 +- Agentic: ASI02, ASI08, ASI04, ASI06 +- DSGAI: DSGAI13, DSGAI04 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI06 - Tool Plugin and Agent Data Exchange + +AISVS treats the tool boundary as a trust boundary with a declared contract. C9.3.3 and C9.3.4 require manifests to declare privileges and output validation and the runtime to enforce them, and C10.4.1 validates MCP responses against declared schemas before they enter the model context. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas | +| Verify that tool manifests declare required privileges, resource limits, and output validation requirements. | [9.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Tool manifests declare required privileges, resource limits and output validation requirements | +| Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests. | [9.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Runtime enforces the privileges, resource limits and output validation declared in manifests | +| Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context. | [10.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 1. MCP tools/list and tools/call responses validated against declared schemas before injection into model context | +| Verify that MCP servers reject unrecognized or oversized parameters in function calls. | [10.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 1. MCP servers reject unrecognized or oversized parameters in function calls | +| Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes. | [10.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 2. MCP tools/list returns only tools permitted by the resource owner authorized scopes | +| Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. | [9.3.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Architectural separation between processing of untrusted tool outputs and agent operations | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.3.2: Verify that tool outputs are validated against schemas. +- 10.4.1: Verify that MCP tools/list and tools/call responses are validated against their declared schemas before being injected into the model context. +- 10.4.3: Verify that MCP servers reject unrecognized or oversized parameters in function calls. + +**Tier 2 - Short-term (first 30 days):** +- 9.3.3: Verify that tool manifests declare required privileges, resource limits, and output validation requirements. +- 9.3.4: Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests. +- 10.2.4: Verify that MCP tools/list returns only tools permitted by resource owners' authorized scopes. +- 9.3.6: Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM06, LLM03, LLM05, LLM02 +- Agentic: ASI02, ASI04, ASI07, ASI06 +- DSGAI: N/A +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI07 - Data Governance and Lifecycle + +AISVS supplies the technical substrate governance depends on. C1.1.2 inventories every training-data source with license and use constraints, C12.5.1 records dataset lineage across transformations and merges, and C8.3 gives expiry and reset on the retrieval layer so deletion obligations reach the RAG store. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int... | [1.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, intended use constraints and processing history | +| Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. | [12.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 1. Dataset lineage records each dataset and its components including all transformations, augmentations and merges | +| Verify that every ingested document is tagged at write time with source, writer identity, and timestamp. | [12.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 2. Every ingested document tagged at write time with source, writer identity and timestamp | +| Verify that a model registry maintains an inventory of all deployed model artifacts and their origin. | [3.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity) | Level 1. Model registry maintains an inventory of all deployed model artifacts and their origin | +| Verify that expired vectors are excluded from retrieval results. | [8.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Expired vectors excluded from retrieval results, the retention control on the RAG layer | +| Verify that memory can be reset. | [8.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Memory can be reset, supporting deletion obligations against agent memory | +| Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). | [5.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Data classification labels propagate to downstream resources including embeddings, prompt caches and model outputs | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 12.5.1: Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. +- 3.1.1: Verify that a model registry maintains an inventory of all deployed model artifacts and their origin. + +**Tier 2 - Short-term (first 30 days):** +- 1.1.2: Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use ... +- 12.5.4: Verify that every ingested document is tagged at write time with source, writer identity, and timestamp. +- 8.3.1: Verify that expired vectors are excluded from retrieval results. +- 8.3.2: Verify that memory can be reset. + +**Tier 3 - Strategic:** +- 5.2.7: Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). + +#### Cross-references + +- LLM Top 10: LLM02, LLM06, LLM03, LLM08 +- Agentic: ASI03, ASI02, ASI06 +- DSGAI: DSGAI08, DSGAI01 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI08 - Non-Compliance and Regulatory Violations + +AISVS is a technical standard and deliberately excludes governance, so it meets this risk only where a regulatory obligation has a concrete technical control. C1.1.1 is data minimisation expressed as a verifiable requirement, and C12.5.1 lineage is the evidence base for deletion and data-subject requests. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that training data includes only features, attributes, and fields required for the model's stated purpose. | [1.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 1. Training data includes only features required for the model stated purpose, the technical expression of data minimisation and purpose limitation | +| Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int... | [1.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Source inventory records license and intended use constraints per training-data source, evidencing lawful basis and use limitation | +| Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. | [12.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 1. Dataset lineage across transformations, augmentations and merges, the evidence base for deletion and data-subject obligations | +| Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. | [1.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security) | Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact | +| Verify that training on sensitive datasets employs differentially-private optimization. | [11.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 2. Differentially-private optimization when training on sensitive datasets | +| Verify that models used in security-relevant decisions are evaluated for bias patterns. | [1.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Models used in security-relevant decisions evaluated for bias patterns | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 1.1.1: Verify that training data includes only features, attributes, and fields required for the model's stated purpose. +- 12.5.1: Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. + +**Tier 2 - Short-term (first 30 days):** +- 1.1.2: Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use ... +- 1.2.3: Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. +- 11.2.4: Verify that training on sensitive datasets employs differentially-private optimization. +- 1.3.3: Verify that models used in security-relevant decisions are evaluated for bias patterns. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM02, LLM08, LLM07, LLM01 +- Agentic: ASI06, ASI01, ASI02, ASI03 +- DSGAI: DSGAI07 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI09 - Multimodal Cross-Channel Leakage + +AISVS extends input screening beyond text. C2.2.3 requires non-text inputs to be checked for adversarial perturbations, steganographic payloads and hidden embedded content, and C2.2.4 covers attacks coordinated across several modalities at once. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or ... | [2.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening) | Level 2. Non-text inputs including image, video and audio checked for adversarial perturbations, steganographic payloads, hidden or embedded content and known attack patterns, the direct control for the modality gap this risk names | +| Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are ... | [2.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c22-content--policy-screening) | Level 3. Coordinated attacks spanning multiple input types detected and blocked | +| Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi... | [7.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 3. Outputs checked for hidden, encoded or misleading content created through homoglyphs, formatting, metadata or structured fields | +| Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. | [8.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, applied to extracted multimodal content | +| Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. | [5.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 8.2.1: Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. + +**Tier 2 - Short-term (first 30 days):** +- 2.2.3: Verify that non-text inputs (image/video/audio) are checked for adversarial perturbations, steganographic payloads, hidden or embedded content, or known atta... +- 5.2.4: Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. + +**Tier 3 - Strategic:** +- 2.2.4: Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected a... +- 7.3.4: Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields. + +#### Cross-references + +- LLM Top 10: LLM02, LLM04, LLM08, LLM03, LLM05 +- Agentic: ASI03, ASI04 +- DSGAI: DSGAI01, DSGAI14 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI10 - Synthetic Data and Anonymization Pitfalls + +AISVS tests anonymisation empirically rather than accepting it as done. C11.2.5 requires membership-inference simulations to demonstrate attack accuracy no better than random guessing, and C11.2.4 requires differentially-private optimization where a formal guarantee is needed. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data. | [11.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing, the direct re-identification test | +| Verify that training on sensitive datasets employs differentially-private optimization. | [11.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 2. Training on sensitive datasets employs differentially-private optimization, the formal guarantee ad hoc anonymisation lacks | +| Verify that model outputs are calibrated to reduce overconfident predictions. | [11.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the signal linkage attacks exploit | +| Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. | [1.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security) | Level 2. Sensitive information in labels redacted, anonymized or encrypted before use in any labeling artifact | +| Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. | [8.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 8.2.1: Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. + +**Tier 2 - Short-term (first 30 days):** +- 11.2.4: Verify that training on sensitive datasets employs differentially-private optimization. +- 11.2.3: Verify that model outputs are calibrated to reduce overconfident predictions. +- 1.2.3: Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. + +**Tier 3 - Strategic:** +- 11.2.5: Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data. + +#### Cross-references + +- LLM Top 10: LLM02, LLM01, LLM08, LLM09, LLM03 +- Agentic: ASI03, ASI06, ASI09 +- DSGAI: DSGAI08, DSGAI18 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI11 - Cross-Context Conversation Bleed + +AISVS addresses context bleed as a tenancy and session lifecycle problem. C5.3.1 stops one tenant's operations influencing or observing another's on shared serving infrastructure, C8.1.1 enforces per-tenant namespace uniqueness, and C10.2.6 removes session artifacts at termination. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing... | [5.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation) | Level 2. Shared model serving infrastructure prevents one tenant fine-tuning, inference or embedding operations from influencing or observing another tenant, the direct control | +| Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions. | [8.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions | +| Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments. | [3.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback) | Level 2. Model versions running in parallel use isolated runtime state so AI-specific shared resources are not shared across deployments | +| Verify that MCP servers ensure all session artifacts are removed when a session terminates. | [10.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c102-authentication--authorization) | Level 2. MCP servers ensure all session artifacts are removed when a session terminates | +| Verify that memory can be reset. | [8.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Memory can be reset, so residual context from a prior session can be cleared rather than carried into the next | +| Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typica... | [5.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c53-multi-tenant-isolation) | Level 3. Hardware partitioning, confidential computing or dedicated per-tenant compute so one tenant cannot influence or observe another through shared compute | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 8.1.1: Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions. + +**Tier 2 - Short-term (first 30 days):** +- 5.3.1: Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another t... +- 3.3.3: Verify that model versions running in parallel use isolated runtime state so that AI-specific shared resources are not shared across deployments. +- 10.2.6: Verify that MCP servers ensure all session artifacts are removed when a session terminates. +- 8.3.2: Verify that memory can be reset. + +**Tier 3 - Strategic:** +- 5.3.2: Verify that one tenant cannot influence or observe another tenant's operations through shared compute resources. Satisfying this requirement typically requir... + +#### Cross-references + +- LLM Top 10: LLM02, LLM07, LLM03, LLM08 +- Agentic: ASI06, ASI03 +- DSGAI: DSGAI13 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI12 - Unsafe Natural Language Data Gateways + +AISVS answers the NL-to-query bypass directly. C9.5.3 requires every access control decision to be made by application logic or a policy engine and never by the model, and C5.2.2 keeps the end-user authorization context enforced through the retrieval path rather than a service account. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself. | [9.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. All access control decisions enforced by application logic or a policy engine, never by the AI model itself, the direct answer to NL-to-query authorization bypass | +| Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ... | [5.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions | +| Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w... | [9.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Fine-grained runtime policy over which tools an agent may invoke and which parameter values it may supply, constraining generated queries | +| Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,... | [2.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. All inputs able to steer model behavior screened by an injection ruleset or classifier | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas | +| Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. | [5.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive | +| Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible. | [9.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. High-impact actions carry a trusted reversibility classification, distinguishing read queries from data-store mutations | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 2.1.3: Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flag... +- 9.3.2: Verify that tool outputs are validated against schemas. + +**Tier 2 - Short-term (first 30 days):** +- 9.5.3: Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself. +- 5.2.2: Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rat... +- 9.5.1: Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which param... +- 5.2.4: Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. +- 9.2.3: Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM05, LLM01, LLM02, LLM03, LLM09 +- Agentic: ASI02, ASI05, ASI01, ASI04, ASI09 +- DSGAI: DSGAI14 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI13 - Vector Store Platform Security + +AISVS covers the vector store as a first-class AI resource. C5.2.1 requires default-deny access control on vector collections and embedding indices, and C8.1 plus C8.2 add namespace isolation, metadata immutability, scope-constrained retrieval and adversarial vector quarantine. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explici... | [5.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Every AI resource including vector collections and embedding indices enforces access controls with explicit allow-lists and default-deny policies, the direct platform control | +| Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions. | [8.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions | +| Verify that retrieval operations enforce scope constraints. | [8.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Retrieval operations enforce scope constraints | +| Verify that document metadata tags are immutable after the initial write. | [8.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Document metadata tags immutable after initial write | +| Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices. | [8.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices, the adversarial-vector injection control | +| Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. | [8.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped, limiting what embedding inversion can recover | +| Verify that expired vectors are excluded from retrieval results. | [8.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Expired vectors excluded from retrieval results | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 8.1.1: Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions. +- 8.2.1: Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. + +**Tier 2 - Short-term (first 30 days):** +- 5.2.1: Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-li... +- 8.1.3: Verify that retrieval operations enforce scope constraints. +- 8.1.2: Verify that document metadata tags are immutable after the initial write. +- 8.2.2: Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices. +- 8.3.1: Verify that expired vectors are excluded from retrieval results. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM08, LLM07, LLM06, LLM03 +- Agentic: ASI06, ASI05, ASI01, ASI02 +- DSGAI: N/A +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI14 - Excessive Telemetry and Monitoring Leakage + +AISVS bounds what telemetry carries rather than only requiring more of it. C12.1.3 fixes a structured schema for inference logs, C12.1.2 and C12.1.4 scope safety-decision and RAG retrieval logging to defined purposes, and C9.5.4 keeps credentials out of the tool parameters that reach logs. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage ... | [12.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging) | Level 2. Log entries for inference events follow a structured, interoperable schema with a defined field set (model identifier, token usage, provider, operation type), bounding what telemetry carries | +| Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi... | [9.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Secrets and credentials not exposed within the model observable context including tool call parameters, which are a primary source of credentials reaching logs | +| Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). | [5.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Data classification labels propagate to downstream resources, so sensitive content retains its handling requirement when it reaches telemetry | +| Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. | [1.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security) | Level 2. Sensitive information redacted, anonymized or encrypted before being used in any labeling artifact | +| Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source. | [12.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging) | Level 2. RAG retrieval events logged with query, documents retrieved and knowledge source, which is exactly the high-value content this risk says logging infrastructure accumulates | +| Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content m... | [12.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c121-request--response-logging) | Level 2. Safety filtering and policy decisions logged with sufficient detail for audit, debugging and forensics, scoping moderation telemetry to a defined purpose | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- No AISVS Level 1 requirement maps to this entry + +**Tier 2 - Short-term (first 30 days):** +- 12.1.3: Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and... +- 9.5.4: Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, syst... +- 1.2.3: Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. +- 12.1.4: Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source. +- 12.1.2: Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation ... + +**Tier 3 - Strategic:** +- 5.2.7: Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). + +#### Cross-references + +- LLM Top 10: LLM02, LLM03, LLM06 +- Agentic: ASI09, ASI02 +- DSGAI: DSGAI01, DSGAI07, DSGAI12 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI15 - Over-Broad Context Windows + +AISVS keeps authorization attached to content as the context is assembled. C5.2.2 requires enforcement at each retrieval and assembly stage rather than once at the start, C2.1.6 maintains instruction hierarchy inside a mixed-trust context, and C2.1.4 rejects oversized input rather than truncating it. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ... | [5.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval AND assembly stage, the direct control for a context assembled from multiple sources | +| Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe... | [2.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. Input length controls reject inputs exceeding token limits rather than truncating them | +| Verify that retrieval operations enforce scope constraints. | [8.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Retrieval operations enforce scope constraints | +| Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu... | [2.1.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 2. Instruction hierarchy maintains trust separation inside a context holding mixed-trust content | +| Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. | [5.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Post-inference filtering prevents responses including data the requester is not authorized to receive | +| Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). | [5.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Classification labels propagate to prompt caches and model outputs | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 2.1.4: Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than tru... + +**Tier 2 - Short-term (first 30 days):** +- 5.2.2: Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rat... +- 8.1.3: Verify that retrieval operations enforce scope constraints. +- 2.1.6: Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even a... +- 5.2.4: Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. + +**Tier 3 - Strategic:** +- 5.2.7: Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). + +#### Cross-references + +- LLM Top 10: LLM07, LLM02, LLM08, LLM06 +- Agentic: ASI01, ASI06, ASI02 +- DSGAI: DSGAI03 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI16 - Endpoint and Browser Overreach + +AISVS covers endpoint assistants through the local MCP and sandboxing requirements. C10.1.3 requires locally launched servers to run least-privilege with restricted file system and network access, C10.4.7 requires explicit install consent, and C7.3.3 blocks the outbound request path. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access. | [10.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c101-component-integrity) | Level 2. Locally launched MCP servers run in a least-privilege sandbox with restricted file system, network and system access, the direct control for local assistant overreach | +| Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server. | [10.4.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 2. MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server | +| Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. | [9.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Each tool or plugin executes in a least-privilege sandbox or is isolated from model operations | +| Verify that inference runtimes enforce process, memory, and file access isolation. | [4.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security) | Level 3. Inference runtimes enforce process, memory and file access isolation | +| Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve... | [9.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified | +| Verify that model-generated output is prevented from triggering outbound requests. | [7.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 2. Model-generated output prevented from triggering outbound requests, the exfiltration-to-provider path | +| Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms. | [4.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security) | Level 1. Edge AI devices authenticate to central infrastructure using strong authentication mechanisms | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.3.1: Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. +- 9.2.1: Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified. +- 4.3.1: Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms. + +**Tier 2 - Short-term (first 30 days):** +- 10.1.3: Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access. +- 10.4.7: Verify that MCP clients present users with explicit consent dialogue and cancellation options upon installation of a local MCP server. +- 7.3.3: Verify that model-generated output is prevented from triggering outbound requests. + +**Tier 3 - Strategic:** +- 4.3.3: Verify that inference runtimes enforce process, memory, and file access isolation. + +#### Cross-references + +- LLM Top 10: LLM06, LLM03, LLM08, LLM01, LLM02 +- Agentic: ASI10, ASI02, ASI03, ASI07, ASI09 +- DSGAI: DSGAI03, DSGAI17 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI17 - Data Availability and Resilience Failures + +AISVS covers resilience through lifecycle controls rather than a backup chapter. C3.3.1 and C3.3.2 require automated rollback triggers and complete model state restoration, C3.5.4 registers fine-tuning checkpoints as discrete recovery points, and C12.5.1 lineage enables reconstruction. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that production deployments implement rollout mechanisms with automated rollback triggers. | [3.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback) | Level 2. Production deployments implement rollout mechanisms with automated rollback triggers | +| Verify that rollback capabilities restore the complete model state. | [3.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c33-controlled-deployment--rollback) | Level 2. Rollback capabilities restore the complete model state | +| Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. | [1.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Integrity monitoring guards training data against unauthorized modification or corruption, detecting the corruption event that recovery must answer | +| Verify that fine-tuning checkpoints are registered as distinct artifacts. | [3.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning) | Level 3. Fine-tuning checkpoints registered as distinct artifacts, giving discrete recovery points | +| Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. | [12.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling reconstruction | +| Verify that memory can be reset. | [8.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Memory can be reset, giving a defined recovery action for a corrupted agent memory or RAG store | +| Verify that all model changes generate immutable audit records. | [12.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 2. All model changes generate immutable audit records, establishing the known-good state to recover to | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 12.5.1: Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. + +**Tier 2 - Short-term (first 30 days):** +- 3.3.1: Verify that production deployments implement rollout mechanisms with automated rollback triggers. +- 3.3.2: Verify that rollback capabilities restore the complete model state. +- 1.1.4: Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. +- 8.3.2: Verify that memory can be reset. +- 12.5.3: Verify that all model changes generate immutable audit records. + +**Tier 3 - Strategic:** +- 3.5.4: Verify that fine-tuning checkpoints are registered as distinct artifacts. + +#### Cross-references + +- LLM Top 10: LLM10, LLM03, LLM04, LLM09 +- Agentic: ASI08, ASI07, ASI09 +- DSGAI: N/A +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI18 - Inference and Data Reconstruction + +AISVS gives reconstruction defense its own section. C11.2 requires differentially-private training, calibrated outputs, threat-model-sized rate limits and empirical membership-inference testing, and C1.1.1 bounds what could be reconstructed by limiting what was trained on. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data. | [11.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 3. Membership-inference attack simulations demonstrate attack accuracy does not exceed random guessing on evaluated data | +| Verify that training on sensitive datasets employs differentially-private optimization. | [11.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 2. Training on sensitive datasets employs differentially-private optimization | +| Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ... | [11.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model rather than as a generic API throttle | +| Verify that model-inferred sensitive attributes are not directly returned in outputs. | [11.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 1. Model-inferred sensitive attributes not returned directly in outputs | +| Verify that model outputs are calibrated to reduce overconfident predictions. | [11.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 2. Model outputs calibrated to reduce overconfident predictions, lowering the confidence signal reconstruction attacks exploit | +| Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ... | [11.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense) | Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level | +| Verify that training data includes only features, attributes, and fields required for the model's stated purpose. | [1.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 1. Training data includes only features required for the stated purpose, bounding what can be reconstructed | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 11.2.2: Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle. +- 11.2.1: Verify that model-inferred sensitive attributes are not directly returned in outputs. +- 1.1.1: Verify that training data includes only features, attributes, and fields required for the model's stated purpose. + +**Tier 2 - Short-term (first 30 days):** +- 11.2.4: Verify that training on sensitive datasets employs differentially-private optimization. +- 11.2.3: Verify that model outputs are calibrated to reduce overconfident predictions. +- 11.3.2: Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction... + +**Tier 3 - Strategic:** +- 11.2.5: Verify that membership-inference attack simulations demonstrate that attack accuracy does not exceed random guessing on evaluated data. + +#### Cross-references + +- LLM Top 10: LLM02, LLM08, LLM06, LLM05, LLM09 +- Agentic: ASI04, ASI09 +- DSGAI: DSGAI10, DSGAI15 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI19 - Human-in-Loop and Labeler Overexposure + +AISVS addresses annotator exposure in the labeling section. C1.2.3 requires sensitive information in labels to be redacted, anonymized or encrypted before use in any labeling artifact, and C1.2.1 restricts who can create, modify or approve annotations. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. | [1.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security) | Level 2. Sensitive information in labels redacted, anonymized or encrypted before being used in any labeling artifact, the direct control for annotator exposure | +| Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations. | [1.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security) | Level 1. Labeling platforms enforce access controls restricting who can create, modify or approve annotations | +| Verify that disallowed content is detected and removed before training. | [1.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Disallowed content detected and removed before training, reducing harmful content reaching human reviewers | +| Verify that cryptographic integrity is applied to labeling artifacts. | [1.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c12-data-labeling-and-annotation-security) | Level 2. Cryptographic integrity applied to labeling artifacts | +| Verify that all labeling activities are recorded in logs. | [12.5.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 1. All labeling activities recorded in logs | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 1.2.1: Verify that labeling platforms enforce access controls that restrict who can create, modify, or approve annotations. +- 12.5.2: Verify that all labeling activities are recorded in logs. + +**Tier 2 - Short-term (first 30 days):** +- 1.2.3: Verify that sensitive information in labels is redacted, anonymized, or encrypted before being used in any labeling artifact. +- 1.3.4: Verify that disallowed content is detected and removed before training. +- 1.2.2: Verify that cryptographic integrity is applied to labeling artifacts. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM02, LLM05, LLM03 +- Agentic: ASI10, ASI04 +- DSGAI: DSGAI07, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI20 - Model Exfiltration and IP Replication + +AISVS treats extraction as a detect-and-respond problem as well as a prevention one. C11.3 requires query-pattern analysis feeding an extraction detector, response measures on detection, and watermarking or fingerprinting so unauthorized copies remain identifiable. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that query-pattern analysis feeds an extraction-attempt detector. | [11.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense) | Level 1. Query-pattern analysis feeds an extraction-attempt detector | +| Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ... | [11.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 1. Inference endpoints enforce per-principal and global rate limits sized to the extraction threat model | +| Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the ... | [11.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense) | Level 2. Raw model outputs not exposed beyond the application backend, with externally visible responses calibrated to the extraction risk level | +| Verify that detection of suspected extraction triggers response measures. | [11.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense) | Level 3. Detection of suspected extraction triggers response measures | +| Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified. | [11.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense) | Level 3. Model watermarking or fingerprinting so unauthorized copies can be identified | +| Verify that confidential inference services protect model weights during runtime through isolated execution environments. | [4.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation) | Level 3. Confidential inference services protect model weights during runtime through isolated execution environments | +| Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves. | [4.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c43-edge--distributed-ai-security) | Level 3. Model weights and sensitive parameters stored locally encrypted using hardware-backed key stores or secure enclaves | +| Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum... | [5.2.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Just-in-time privileged access to model weights with maximum session duration and automatic expiry | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 11.3.1: Verify that query-pattern analysis feeds an extraction-attempt detector. +- 11.2.2: Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle. + +**Tier 2 - Short-term (first 30 days):** +- 11.3.2: Verify that raw model outputs are not directly exposed beyond the application backend, and that externally visible responses are calibrated to the extraction... + +**Tier 3 - Strategic:** +- 11.3.4: Verify that detection of suspected extraction triggers response measures. +- 11.3.3: Verify that model watermarking or fingerprinting techniques are applied so that unauthorized copies can be identified. +- 4.1.4: Verify that confidential inference services protect model weights during runtime through isolated execution environments. +- 4.3.4: Verify that model weights and sensitive parameters stored locally are encrypted using hardware-backed key stores or secure enclaves. +- 5.2.6: Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session d... + +#### Cross-references + +- LLM Top 10: LLM02, LLM04, LLM07, LLM05 +- Agentic: ASI04 +- DSGAI: DSGAI18, DSGAI04 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### DSGAI21 - Disinformation via Data Poisoning + +AISVS covers disinformation injection through the same controls as poisoning, plus provenance. C1.3 detects poisoned and disallowed training content, C8.2.4 covers the RAG corpus path, and C7.4 attribution lets a reader trace a claim back to its source document. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru... | [1.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Training and fine-tuning pipelines implement poisoning detection | +| Verify that disallowed content is detected and removed before training. | [1.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Disallowed content detected and removed before training | +| Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int... | [1.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Current inventory of every training-data source with origin, responsible party and collection method, enabling attribution of an injected corpus | +| Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. | [8.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization, the RAG-corpus disinformation path | +| Verify that defenses against clean-label poisoning attacks are implemented. | [1.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 3. Clean-label poisoning defenses, which is the form targeted disinformation injection usually takes | +| Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. | [7.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 1. RAG responses include attribution to the source documents, letting a reader check a poisoned claim against its source | +| Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat... | [12.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection) | Level 2. Hallucination detection monitors identify and flag factually incorrect, inconsistent or fabricated output | +| Verify that generated media is watermarked to prove it was AI-generated. | [7.4.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 3. Generated media watermarked to prove it was AI-generated | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 7.4.1: Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. + +**Tier 2 - Short-term (first 30 days):** +- 1.3.1: Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in t... +- 1.3.4: Verify that disallowed content is detected and removed before training. +- 1.1.2: Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use ... +- 12.3.2: Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information. + +**Tier 3 - Strategic:** +- 8.2.4: Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. +- 1.3.5: Verify that defenses against clean-label poisoning attacks are implemented. +- 7.4.4: Verify that generated media is watermarked to prove it was AI-generated. + +#### Cross-references + +- LLM Top 10: LLM04, LLM09, LLM06, LLM07, LLM02 +- Agentic: ASI06, ASI09, ASI02 +- DSGAI: DSGAI01, DSGAI03, DSGAI07, DSGAI08, DSGAI02, DSGAI06, DSGAI12, DSGAI13, DSGAI04, DSGAI05, DSGAI11, DSGAI18, DSGAI17, DSGAI14, DSGAI15, DSGAI09, DSGAI16, DSGAI10, DSGAI19, DSGAI20 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +## Implementation priority table + +| Priority | AISVS components | Entries addressed | +|---|---|---| +| P1 - Pre-production gate | All Level 1 requirements | DSGAI01, DSGAI02, DSGAI03, DSGAI05, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI10, DSGAI11, DSGAI12, DSGAI13, DSGAI15, DSGAI16, DSGAI17, DSGAI18, DSGAI19, DSGAI20, DSGAI21 | +| P2 - First 30 days | All Level 2 requirements | DSGAI01, DSGAI02, DSGAI03, DSGAI04, DSGAI05, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI10, DSGAI11, DSGAI12, DSGAI13, DSGAI14, DSGAI15, DSGAI16, DSGAI17, DSGAI18, DSGAI19, DSGAI20, DSGAI21 | +| P3 - Programme maturity | All Level 3 requirements | DSGAI01, DSGAI02, DSGAI03, DSGAI04, DSGAI05, DSGAI07, DSGAI09, DSGAI10, DSGAI11, DSGAI14, DSGAI15, DSGAI16, DSGAI17, DSGAI18, DSGAI20, DSGAI21 | + +--- + +## References + +- [OWASP AISVS project page](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/) +- [OWASP AISVS 1.0 frozen text](https://github.com/OWASP/AISVS/tree/main/1.0/en) +- [OWASP GenAI Data Security Risks 2026 - OWASP](https://genai.owasp.org/resource/genai-data-security-risks/) +- [shared/TEMPLATE.md](../shared/TEMPLATE.md) + +--- + +## Changelog + +| Version | Date | Change | +|---|---|---| +| 1.0.0 | 2026-08-28 | Initial release - full mapping of DSGAI01-DSGAI21 to OWASP AISVS 1.0 | + +--- + +*Part of the [OWASP GenAI Crosswalk](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative/tree/main/crosswalk) - maintained by the [OWASP GenAI Data Security Initiative](https://genai.owasp.org)* +*License: [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)* diff --git a/crosswalk/llm-top10/LLM_AISVS.md b/crosswalk/llm-top10/LLM_AISVS.md new file mode 100644 index 0000000..0f02ebb --- /dev/null +++ b/crosswalk/llm-top10/LLM_AISVS.md @@ -0,0 +1,521 @@ + + +# OWASP Top 10 for LLM Applications 2025 × OWASP AISVS 1.0 + +Mapping the [OWASP Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/) to the [OWASP Artificial Intelligence Security Verification Standard 1.0](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/), a technical verification standard of 191 testable requirements across 12 chapters, used by engineers and auditors to verify that a specific AI system implements a control rather than merely documents it. + +--- + +## Why AISVS for this source list + +Most frameworks already in this crosswalk answer the question of what an organisation should govern. AISVS answers a different question: given a running AI system, what does an assessor check, and what does a pass look like. Every requirement is written to be independently verifiable and starts with the words Verify that. + +That makes this mapping the bridge between a risk in this source list and a concrete test an engineer can run. Where ISO 42001 or NIST AI RMF establish that a control must exist, AISVS states the condition that demonstrates it does. The two are complements, not substitutes, and reading them together turns a control objective into an audit step. + +AISVS also assigns each requirement a level from 1 to 3 reflecting implementation difficulty and how situational the control is. That maps cleanly onto the tier model used throughout this crosswalk, so the tier column below carries real information about sequencing rather than a subjective judgement. + +--- + +## AISVS structure + +| Chapter | Description | Requirements | +|---|---|---| +| [C1 Training Data Integrity & Traceability](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md) | This chapter addresses protecting the integrity and traceability of training data as it is sourced, handled, and maintained. | 13 | +| [C2 Input Validation](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C02-Input-Validation.md) | This chapter addresses validation of all inputs as a first-line defense against prompt injection, one of the most damaging attacks on AI systems. | 12 | +| [C3 Model Lifecycle Management & Change Control](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md) | This chapter addresses control of model changes so that unauthorized or unsafe modifications cannot reach production. | 15 | +| [C4 Infrastructure, Configuration & Deployment Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C04-Infrastructure.md) | This chapter addresses hardening AI-specific infrastructure components against model theft, data leakage, and cross-tenant contamination. | 14 | +| [C5 Access Control & Identity for AI Components & Users](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C05-Access-Control-and-Identity.md) | This chapter addresses access control challenges that AI systems introduce beyond traditional application security. | 11 | +| [C6 Supply Chain Security for Models](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C06-Supply-Chain.md) | This chapter addresses defending against AI supply chain attacks that exploit third-party models, frameworks, or datasets to embed backdoors, bias, or exploitable code. | 7 | +| [C7 Model Behavior, Output Control & Safety Assurance](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C07-Model-Behavior.md) | This chapter addresses constraining, validating, and monitoring model outputs so that unsafe, malformed, or high-risk responses cannot reach users or downstream systems. | 13 | +| [C8 Memory, Embeddings & Vector Database Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md) | This chapter addresses securing the embeddings and vector stores that act as semi-persistent and persistent "memory" for AI systems through Retrieval-Augmented Generation (RAG). | 11 | +| [C9 Orchestration & Agentic Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md) | This chapter addresses ensuring autonomous and multi-agent systems execute only authorized, intended, and bounded actions. | 34 | +| [C10 Model Context Protocol (MCP) Security](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C10-MCP-Security.md) | This chapter addresses secure discovery, authentication, authorization, transport, and use of MCP-based tool and resource integrations. | 23 | +| [C11 Adversarial Robustness](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C11-Adversarial-Robustness.md) | This chapter addresses keeping AI systems reliable and abuse-resistant when facing evasion, inference, extraction, or poisoning attacks. | 17 | +| [C12 Monitoring, Logging & Anomaly Detection](https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C12-Monitoring-and-Logging.md) | This chapter addresses real-time and forensic visibility into what the model and other AI components see, do, and return, so that AI-specific threats can be detected and triaged. | 21 | + +Levels map to crosswalk tiers as Level 1 Foundational, Level 2 Hardening, Level 3 Advanced. Where an entry maps to requirements at several levels, the tier column below reports the level most of its requirements sit at. + +--- + +## Quick-reference summary + +| ID | Name | Severity | Primary AISVS Controls | Tier | Scope | +|---|---|---|---|---|---| +| LLM01 | Prompt Injection | Critical | C2.1, C10.4, C12.2 | Foundational | Both | +| LLM02 | Sensitive Information Disclosure | High | C5.2, C11.2, C8.2, C7.3, C1.1 | Hardening | Both | +| LLM03 | Supply Chain Vulnerabilities | High | C6.1, C4.1, C6.2, C3.1 | Foundational | Both | +| LLM04 | Data and Model Poisoning | Critical | C1.3, C1.1, C3.5, C12.5 | Hardening | Both | +| LLM05 | Insecure Output Handling | High | C7.1, C7.3, C9.3 | Foundational | Both | +| LLM06 | Excessive Agency | High | C9.2, C9.1, C9.3, C9.5, C9.6 | Foundational | Both | +| LLM07 | System Prompt Leakage | High | C7.3, C2.1, C9.5, C12.2, C11.3 | Hardening | Both | +| LLM08 | Vector and Embedding Weaknesses | Medium | C8.1, C8.2, C8.3 | Hardening | Both | +| LLM09 | Misinformation | Medium | C7.4, C7.2, C12.3, C11.1 | Hardening | Both | +| LLM10 | Unbounded Consumption | Medium | C9.1, C2.1, C11.2, C7.1, C12.2 | Foundational | Both | + +--- + +## Target audience + +| Role | Sections to prioritise | +|---|---| +| Security engineer | C2 Input Validation, C9 Orchestration and Agentic Security, C10 MCP Security | +| Developer | C7 Model Behavior and Output Control, C8 Memory and Embeddings, C5 Access Control | +| ML engineer | C1 Training Data, C3 Model Lifecycle, C11 Adversarial Robustness | +| Auditor | The whole standard. Every requirement is written as a verifiable test | +| Compliance and GRC | C1 Training Data, C6 Supply Chain, C12 Monitoring and Logging | +| Red teamer | C2 Input Validation, C11 Adversarial Robustness, C9 Orchestration | + +--- + +## Detailed mappings + +--- + +### LLM01 - Prompt Injection + +AISVS treats prompt injection as an input validation problem with a dedicated chapter. C2.1 carries eight requirements covering normalization, encoding smuggling, classifier screening, instruction hierarchy and special-token handling, and C10.4 extends the same screening to MCP tool responses as an indirect injection path. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier,... | [2.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. Direct control: all inputs able to steer model behavior are treated as untrusted and screened by an injection ruleset or classifier, with flagged inputs blocked | +| Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu... | [2.1.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 2. Instruction hierarchy so system and developer messages keep precedence over user and other untrusted input, including after user text is processed | +| Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema... | [2.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. Encoding and representation smuggling defeated by canonicalization, strict schema validation, policy rejection or explicit marking | +| Verify that input normalization is applied before tokenization or embedding. | [2.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. Input normalization applied before tokenization or embedding, closing the pre-tokenizer bypass class | +| Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context. | [2.1.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 2. Reserved special tokens encoded as literals so control tokens cannot be injected into the model context | +| Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only cha... | [2.1.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. Character set restricted by allow-list to only explicitly required characters, removing the exotic-codepoint smuggling surface | +| Verify that the system can detect many-shot jailbreaking patterns. | [2.1.8](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 3. Many-shot jailbreaking pattern detection for long-context in-context-learning attacks | +| Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context. | [10.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md#c104-schema-message-and-input-validation) | Level 1. Indirect injection path: MCP tools/list and tools/call responses screened before entering model context | +| Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs. | [12.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 1. Detection layer: known jailbreak patterns, injection attempts and adversarial inputs alerted on | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 2.1.3: Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flag... +- 2.1.2: Verify that encoding and representation smuggling in inputs is detected and mitigated. Approved mitigations include canonicalization, strict schema validatio... +- 2.1.1: Verify that input normalization is applied before tokenization or embedding. +- 2.1.5: Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach that permits only characters th... +- 10.4.2: Verify that MCP tools/list and tools/call responses are screened for indirect prompt injection before being injected into the model context. +- 12.2.1: Verify that the system detects and alerts on known jailbreak patterns, prompt injection attempts, and adversarial inputs. + +**Tier 2 - Short-term (first 30 days):** +- 2.1.6: Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even a... +- 2.1.7: Verify that reserved special tokens are encoded as literal characters and cannot be injected into the model context. + +**Tier 3 - Strategic:** +- 2.1.8: Verify that the system can detect many-shot jailbreaking patterns. + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI01, ASI02 +- DSGAI: DSGAI01, DSGAI15, DSGAI12 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM02 - Sensitive Information Disclosure + +AISVS splits disclosure across the retrieval boundary and the response boundary. C5.2 requires the end-user authorization context to be enforced at retrieval rather than the service account, and C7.3 plus C11.2 stop what does get generated from carrying data the requester may not receive. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. | [5.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Post-inference filtering prevents responses containing data the requester is not authorized to receive | +| Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly ... | [5.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 2. Retrieval pipelines enforce the end-user authorization context at each retrieval and assembly stage rather than the service account permissions | +| Verify that model-inferred sensitive attributes are not directly returned in outputs. | [11.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 1. Model-inferred sensitive attributes are not returned directly in outputs | +| Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. | [8.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 1. Sensitive fields detected and masked, tokenized or dropped before embedding, so disclosure is prevented at the index rather than the response | +| Verify that output filters detect and block responses that disclose system prompt content or backend data. | [7.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 2. Output filters block responses disclosing system prompt content or backend data | +| Verify that training on sensitive datasets employs differentially-private optimization. | [11.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 2. Differentially-private optimization when training on sensitive datasets, limiting memorisation-driven disclosure | +| Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). | [5.2.7](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md#c52-ai-resource-authorization--classification) | Level 3. Data classification labels propagate to embeddings, prompt caches and model outputs so downstream handling matches the source sensitivity | +| Verify that training data includes only features, attributes, and fields required for the model's stated purpose. | [1.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 1. Training data restricted to features required for the stated purpose, reducing what can be disclosed at all | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 11.2.1: Verify that model-inferred sensitive attributes are not directly returned in outputs. +- 8.2.1: Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. +- 1.1.1: Verify that training data includes only features, attributes, and fields required for the model's stated purpose. + +**Tier 2 - Short-term (first 30 days):** +- 5.2.4: Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive. +- 5.2.2: Verify that retrieval pipelines (e.g., RAG queries, embedding lookups) enforce the end-user's authorization context at each retrieval and assembly stage, rat... +- 7.3.2: Verify that output filters detect and block responses that disclose system prompt content or backend data. +- 11.2.4: Verify that training on sensitive datasets employs differentially-private optimization. + +**Tier 3 - Strategic:** +- 5.2.7: Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs). + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI03, ASI06, ASI02, ASI05 +- DSGAI: DSGAI01, DSGAI10, DSGAI18, DSGAI07, DSGAI08, DSGAI06, DSGAI03, DSGAI05, DSGAI12, DSGAI16 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM03 - Supply Chain Vulnerabilities + +AISVS treats the model artifact as the supply chain unit. C6 requires approved sources, malware scanning, integrity verification and a signed AI BOM, and C4.1.2 closes the deserialization path that turns a downloaded artifact into code execution. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. | [6.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 1. Model weights, datasets and fine-tuning adapters downloaded only from approved sources | +| Verify that models are scanned for malicious code before import. | [6.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 1. Models scanned for malicious code before import | +| Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during dese... | [4.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md#c41-ai-workload-sandboxing--validation) | Level 1. Model artifact loading restricted to an allow-list of serialization formats that cannot execute code on deserialization, the pickle class of supply chain RCE | +| Verify that every third-party model artifact can be integrity-verified. | [6.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 2. Every third-party model artifact is integrity-verifiable | +| Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin state... | [6.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring) | Level 1. Version-controlled machine-readable AI BOM listing datasets, weights, licenses and data-origin statements | +| Verify that AI BOMs are cryptographically signed before deployment. | [6.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c62-ai-bom--supply-chain-monitoring) | Level 2. AI BOMs cryptographically signed before deployment | +| Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographi... | [3.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c31-model-authorization--integrity) | Level 2. Weights, configurations, tokenizers, base models, fine-tunes, adapters and safety models signed by authorized entities | +| Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment. | [6.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md#c61-model-artifact-integrity) | Level 2. Behavioral acceptance test suite passed before promotion beyond development, catching backdoors that signature checks cannot | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 6.1.2: Verify that model weights, datasets, and fine-tuning adapters are downloaded only from approved sources. +- 6.1.1: Verify that models are scanned for malicious code before import. +- 4.1.2: Verify that model artifact loading enforces an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization. +- 6.2.1: Verify that every model artifact publishes a version-controlled, machine-readable AI BOM listing datasets, weights, licenses, and data-origin statements. + +**Tier 2 - Short-term (first 30 days):** +- 6.1.3: Verify that every third-party model artifact can be integrity-verified. +- 6.2.2: Verify that AI BOMs are cryptographically signed before deployment. +- 3.1.2: Verify that all model artifacts (weights, configurations, tokenizers, base models, fine-tunes, adapters, and safety/policy models) are cryptographically sign... +- 6.1.4: Verify that models pass a behavioral acceptance test suite before being promoted to any non-development environment. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI04, ASI07, ASI06 +- DSGAI: DSGAI04, DSGAI03, DSGAI06, DSGAI16, DSGAI17, DSGAI05 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM04 - Data and Model Poisoning + +AISVS puts poisoning defense in the training data chapter. C1.3 requires poisoning detection in training and fine-tuning pipelines including the clean-label case, and C1.1 plus C12.5 give the integrity monitoring and lineage needed to attribute a poisoned corpus after the fact. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corru... | [1.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Training and fine-tuning pipelines implement poisoning detection for deliberate poisoning and unintentional corruption | +| Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. | [1.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Integrity monitoring guards training data against unauthorized modification or corruption | +| Verify that data integrity is provided when training data is stored and transferred. | [1.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Data integrity provided for training data in storage and in transit | +| Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, int... | [1.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c11-training-data-origin--data-security) | Level 2. Current inventory of every training-data source with origin, responsible party, license, collection method, use constraints and processing history | +| Verify that disallowed content is detected and removed before training. | [1.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 2. Disallowed content detected and removed before training | +| Verify that defenses against clean-label poisoning attacks are implemented. | [1.3.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md#c13-training-data-quality-and-security-assurance) | Level 3. Clean-label poisoning defenses, the attack class that survives label inspection | +| Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage. | [3.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md#c35-pipeline-fine-tuning) | Level 3. Each stage output integrity-verified before the next stage consumes it in multi-stage fine-tuning | +| Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. | [12.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c125-training-data--model-lifecycle-audit) | Level 1. Dataset lineage records each dataset and its components including transformations, augmentations and merges, enabling post-hoc poisoning attribution | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 12.5.1: Verify that dataset lineage records each dataset and its components, including all transformations, augmentations, and merges. + +**Tier 2 - Short-term (first 30 days):** +- 1.3.1: Verify that training and fine-tuning pipelines implement poisoning detection techniques to identify potential data poisoning or unintentional corruption in t... +- 1.1.4: Verify that integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. +- 1.1.3: Verify that data integrity is provided when training data is stored and transferred. +- 1.1.2: Verify that an up-to-date inventory is kept of every training-data source, including its origin, responsible party, license, collection method, intended use ... +- 1.3.4: Verify that disallowed content is detected and removed before training. + +**Tier 3 - Strategic:** +- 1.3.5: Verify that defenses against clean-label poisoning attacks are implemented. +- 3.5.3: Verify that in multi-stage fine-tuning pipelines, each stage's output is integrity-verified before it is consumed by the next stage. + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI06, ASI08 +- DSGAI: DSGAI04, DSGAI21, DSGAI03, DSGAI02, DSGAI09, DSGAI17 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM05 - Insecure Output Handling + +AISVS treats model output as untrusted input to whatever consumes it. C7.1 requires schema validation and rejection of non-conforming output, and C7.3.3 blocks the outbound request path that turns rendered output into exfiltration. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. | [7.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement) | Level 1. All model outputs validated against a defined schema, non-matching output rejected | +| Verify that model-generated output is bounded by length limits and termination controls. | [7.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement) | Level 1. Model-generated output bounded by length limits and termination controls | +| Verify that model-generated output is prevented from triggering outbound requests. | [7.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 2. Model-generated output prevented from triggering outbound requests | +| Verify that tool outputs are validated against schemas. | [9.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Tool outputs validated against schemas before the agent consumes them | +| Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. | [9.3.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 2. Architectural separation between processing of untrusted tool outputs and agent operations | +| Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fi... | [7.3.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 3. Outputs checked for hidden, encoded or misleading content via homoglyphs, formatting, metadata or structured fields | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 7.1.1: Verify that the application validates all model outputs against a defined schema and rejects any output that does not match. +- 7.1.2: Verify that model-generated output is bounded by length limits and termination controls. +- 9.3.2: Verify that tool outputs are validated against schemas. + +**Tier 2 - Short-term (first 30 days):** +- 7.3.3: Verify that model-generated output is prevented from triggering outbound requests. +- 9.3.6: Verify that there is architectural separation between processing of untrusted tool outputs and agent operations. + +**Tier 3 - Strategic:** +- 7.3.4: Verify that model outputs are checked for hidden, encoded, or misleading content created through homoglyphs, formatting, metadata, or structured fields. + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI02, ASI05, ASI04, ASI10 +- DSGAI: DSGAI05, DSGAI12, DSGAI04, DSGAI19 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM06 - Excessive Agency + +AISVS bounds agency with runtime enforcement rather than prompt instructions. C9.2 gates high-impact and irreversible actions behind verified human approval, C9.5.3 requires access control decisions to be made by a policy engine and never by the model, and C9.1 caps budgets. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and ve... | [9.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 1. Agent runtime blocks privileged, high-impact or irreversible actions until explicit human approval is received and verified | +| Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. | [9.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-execution budgets for recursion depth, token use and monetary spend configured and enforced by the runtime | +| Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. | [9.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c93-component-isolation-and-tool-authorization) | Level 1. Each tool or plugin executes in a least-privilege sandbox or is otherwise isolated from model operations | +| Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself. | [9.5.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. All access control decisions enforced by application logic or a policy engine, never by the model itself | +| Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. | [9.6.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c96-shutdown-and-graceful-degradation) | Level 1. Manual kill-switch to immediately halt model inference and outputs | +| Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and w... | [9.5.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Fine-grained runtime policy restricting which tools an agent may invoke and which parameter values it may supply | +| Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible. | [9.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Each high-impact action carries a trusted reversibility classification | +| Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact ... | [9.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c92-high-impact-action-approval-and-irreversibility-controls) | Level 2. Runtime enforces reversibility classifications by blocking, requiring approval or restricting the action | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.2.1: Verify that the agent runtime blocks execution of privileged, high-impact, or irreversible actions until explicit human approval is received and verified. +- 9.1.2: Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. +- 9.3.1: Verify that each tool/plugin executes in a least-privilege sandbox or is otherwise isolated from model operations. +- 9.6.1: Verify that a manual kill-switch mechanism exists to immediately halt AI model inference and outputs. + +**Tier 2 - Short-term (first 30 days):** +- 9.5.3: Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself. +- 9.5.1: Verify that agent actions are authorized against fine-grained policies enforced by the runtime that restrict which tools an agent may invoke, and which param... +- 9.2.3: Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible. +- 9.2.4: Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and abilit... + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI01, ASI02, ASI10, ASI09, ASI03, ASI07 +- DSGAI: DSGAI06, DSGAI16, DSGAI12, DSGAI02, DSGAI07 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM07 - System Prompt Leakage + +AISVS handles prompt leakage as an output filtering and secret hygiene problem. C7.3.2 blocks responses disclosing system prompt or backend content, and C9.5.4 keeps credentials out of the observable context so a leaked prompt is not also a leaked secret. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that output filters detect and block responses that disclose system prompt content or backend data. | [7.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c73-output-safety) | Level 2. Output filters detect and block responses that disclose system prompt content or backend data | +| Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inpu... | [2.1.6](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 2. Instruction hierarchy resists the override-then-reveal extraction pattern | +| Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context wi... | [9.5.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c95-agent-authorization-delegation-and-continuous-enforcement) | Level 2. Secrets and credentials kept out of the model observable context including context window, system prompts and tool call parameters, so a leaked prompt is not a leaked credential | +| Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction atte... | [12.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 2. Custom rules detect coordinated jailbreak attempts, injection and system prompt extraction attempts | +| Verify that query-pattern analysis feeds an extraction-attempt detector. | [11.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c113-model-extraction-defense) | Level 1. Query-pattern analysis feeds an extraction-attempt detector, covering iterative prompt reconstruction | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 11.3.1: Verify that query-pattern analysis feeds an extraction-attempt detector. + +**Tier 2 - Short-term (first 30 days):** +- 7.3.2: Verify that output filters detect and block responses that disclose system prompt content or backend data. +- 2.1.6: Verify that the system enforces an instruction hierarchy in which system and developer messages override user instructions and other untrusted inputs, even a... +- 9.5.4: Verify that secrets and credentials required by an agent at runtime are not exposed within the model's observable context, including the context window, syst... +- 12.2.3: Verify that custom rules detect AI-specific threat patterns for coordinated jailbreak attempts, prompt injection, and system prompt extraction attempts. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM01 +- Agentic: ASI01, ASI02 +- DSGAI: DSGAI15, DSGAI08 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM08 - Vector and Embedding Weaknesses + +AISVS gives embeddings and vector stores their own chapter. C8.1 covers tenant namespace isolation, metadata immutability and scope-constrained retrieval, and C8.2 covers sanitization before embedding plus detection of vectors crafted to manipulate retrieval. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions. | [8.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 1. Vector identifiers and namespaces enforce per-tenant uniqueness and prevent cross-tenant collisions | +| Verify that retrieval operations enforce scope constraints. | [8.1.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Retrieval operations enforce scope constraints | +| Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. | [8.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 1. Sensitive fields detected before embedding and masked, tokenized or dropped | +| Verify that document metadata tags are immutable after the initial write. | [8.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c81-access-controls-on-memory--rag-indices) | Level 2. Document metadata tags immutable after initial write, blocking post-hoc retrieval manipulation | +| Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices. | [8.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 2. Vectors outside normal clustering patterns flagged and quarantined before entering production indices | +| Verify that expired vectors are excluded from retrieval results. | [8.3.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c83-memory-expiry--revocation) | Level 2. Expired vectors excluded from retrieval results | +| Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. | [8.2.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md#c82-embedding-sanitization--validation) | Level 3. Content crafted to manipulate retrieval results detected and rejected or quarantined before vectorization | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 8.1.1: Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions. +- 8.2.1: Verify that sensitive fields are detected before embedding and are masked, tokenized, or dropped. + +**Tier 2 - Short-term (first 30 days):** +- 8.1.3: Verify that retrieval operations enforce scope constraints. +- 8.1.2: Verify that document metadata tags are immutable after the initial write. +- 8.2.2: Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices. +- 8.3.1: Verify that expired vectors are excluded from retrieval results. + +**Tier 3 - Strategic:** +- 8.2.4: Verify that content crafted to manipulate retrieval results is detected and rejected or quarantined before vectorization. + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI06 +- DSGAI: DSGAI13, DSGAI18, DSGAI08, DSGAI09, DSGAI04, DSGAI05 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM09 - Misinformation + +AISVS attacks misinformation through provenance and confidence. C7.4 requires RAG attribution derived from retrieval metadata rather than generated by the model, and C7.2 plus C12.3 require confidence estimation, fallback behaviour and hallucination rate tracking over time. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. | [7.4.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 1. RAG responses include attribution to the source documents | +| Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated. | [7.4.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 1. RAG attributions derived from retrieval metadata rather than generated by the model, so provenance cannot be fabricated | +| Verify that the system assesses the reliability of generated answers using a confidence estimation method. | [7.2.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation) | Level 2. Reliability of generated answers assessed using a confidence estimation method | +| Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold. | [7.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation) | Level 2. Answers blocked or a fallback message returned when the confidence score falls below a defined threshold | +| Verify that claims in a RAG response can be traced to the retrieved chunk. | [7.4.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c74-source-attribution--citation-integrity) | Level 2. Claims in a RAG response traceable to the retrieved chunk | +| Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated informat... | [12.3.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection) | Level 2. Hallucination detection monitors flag factually incorrect, inconsistent or fabricated output | +| Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation. | [12.3.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c123-model-data-and-performance-drift-detection) | Level 2. Hallucination rates tracked as continuous time-series metrics to detect sustained degradation | +| Verify that for responses classified as high-risk by policy, the system performs an additional verification step. | [7.2.3](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c72-hallucination-detection--mitigation) | Level 3. Additional verification step for responses classified as high-risk by policy | +| Verify that a version-controlled alignment test suite is run on every model update or release. | [11.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c111-model-alignment-safety-and-robustness-testing-and-training) | Level 1. Version-controlled alignment test suite run on every model update or release, catching factuality regressions before they ship | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 7.4.1: Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents. +- 7.4.2: Verify that RAG attributions are derived from retrieval metadata and are not generated by the model, so provenance cannot be fabricated. +- 11.1.2: Verify that a version-controlled alignment test suite is run on every model update or release. + +**Tier 2 - Short-term (first 30 days):** +- 7.2.1: Verify that the system assesses the reliability of generated answers using a confidence estimation method. +- 7.2.2: Verify that the application automatically blocks answers or switches to a fallback message if the confidence score drops below a defined threshold. +- 7.4.3: Verify that claims in a RAG response can be traced to the retrieved chunk. +- 12.3.2: Verify that hallucination detection monitors identify and flag model outputs that contain factually incorrect, inconsistent, or fabricated information. +- 12.3.3: Verify that hallucination rates are tracked as continuous time-series metrics to enable trend analysis and detection of sustained model degradation. + +**Tier 3 - Strategic:** +- 7.2.3: Verify that for responses classified as high-risk by policy, the system performs an additional verification step. + +#### Cross-references + +- LLM Top 10: N/A +- Agentic: ASI09 +- DSGAI: DSGAI21, DSGAI10, DSGAI17 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +### LLM10 - Unbounded Consumption + +AISVS bounds consumption at the runtime rather than the gateway. C9.1 requires per-tool quotas and per-execution budgets covering recursion depth, tokens and monetary spend, and C11.2.2 requires rate limits sized to the threat model rather than a generic API throttle. + +#### AISVS mapping + +| AISVS requirement | Control | How it applies | +|---|---|---| +| Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. | [9.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-execution budgets for max recursion depth, token use and monetary spend enforced by the runtime | +| Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. | [9.1.1](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md#c91-execution-budgets-loop-control-and-circuit-breakers) | Level 1. Per-tool quotas and timeouts for CPU, memory, disk, egress and execution time | +| Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rathe... | [2.1.4](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md#c21-prompt-injection-defenses) | Level 1. Input length controls reject inputs exceeding token limits rather than truncating them | +| Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API ... | [11.2.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md#c112-membership-inference-and-model-inversion-mitigation) | Level 1. Per-principal and global rate limits sized to the threat model rather than as a generic API throttle | +| Verify that model-generated output is bounded by length limits and termination controls. | [7.1.2](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md#c71-output-format-enforcement) | Level 1. Output bounded by length limits and termination controls, capping runaway generation | +| Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace. | [12.2.5](https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C12-Monitoring-and-Logging.md#c122-detection-and-alerting) | Level 2. Token usage tracked per user, session, feature endpoint and team so cost abuse is attributable | + +#### Three-tier mitigations + +**Tier 1 - Immediate (pre-production gate):** +- 9.1.2: Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are configured and enforced by the runtime. +- 9.1.1: Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced. +- 2.1.4: Verify that input length controls prevent content from exceeding the context window. The controls must reject inputs that exceed token limits rather than tru... +- 11.2.2: Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle. +- 7.1.2: Verify that model-generated output is bounded by length limits and termination controls. + +**Tier 2 - Short-term (first 30 days):** +- 12.2.5: Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace. + +**Tier 3 - Strategic:** +- No AISVS Level 3 requirement maps to this entry + +#### Cross-references + +- LLM Top 10: LLM01, LLM06, LLM07, LLM02, LLM05, LLM03, LLM04, LLM08, LLM09 +- Agentic: ASI08, ASI10 +- DSGAI: DSGAI17 +- See also: the AISVS chapters listed above at https://github.com/OWASP/AISVS/tree/main/1.0/en + +--- + +## Implementation priority table + +| Priority | AISVS components | Entries addressed | +|---|---|---| +| P1 - Pre-production gate | All Level 1 requirements | LLM01, LLM02, LLM03, LLM04, LLM05, LLM06, LLM07, LLM08, LLM09, LLM10 | +| P2 - First 30 days | All Level 2 requirements | LLM01, LLM02, LLM03, LLM04, LLM05, LLM06, LLM07, LLM08, LLM09, LLM10 | +| P3 - Programme maturity | All Level 3 requirements | LLM01, LLM02, LLM04, LLM05, LLM08, LLM09 | + +--- + +## References + +- [OWASP AISVS project page](https://owasp.org/www-project-artificial-intelligence-security-verification-standard-aisvs-docs/) +- [OWASP AISVS 1.0 frozen text](https://github.com/OWASP/AISVS/tree/main/1.0/en) +- [OWASP Top 10 for LLM Applications 2025 - OWASP](https://genai.owasp.org/llm-top-10/) +- [shared/TEMPLATE.md](../shared/TEMPLATE.md) + +--- + +## Changelog + +| Version | Date | Change | +|---|---|---| +| 1.0.0 | 2026-08-28 | Initial release - full mapping of LLM01-LLM10 to OWASP AISVS 1.0 | + +--- + +*Part of the [OWASP GenAI Crosswalk](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative/tree/main/crosswalk) - maintained by the [OWASP GenAI Data Security Initiative](https://genai.owasp.org)* +*License: [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)* diff --git a/crosswalk/scripts/generate.js b/crosswalk/scripts/generate.js index 4bf6885..481d684 100644 --- a/crosswalk/scripts/generate.js +++ b/crosswalk/scripts/generate.js @@ -111,6 +111,7 @@ const FRAMEWORK_FILES = [ { rel: 'llm-top10/LLM_SP800218A.md', framework: 'NIST SP 800-218A', ids: LLM_IDS }, { rel: 'llm-top10/LLM_FedRAMP.md', framework: 'FedRAMP', ids: LLM_IDS }, { rel: 'llm-top10/LLM_DORA.md', framework: 'DORA', ids: LLM_IDS }, + { rel: 'llm-top10/LLM_AISVS.md', framework: 'OWASP AISVS 1.0', ids: LLM_IDS }, // Agentic Top 10 { rel: 'agentic-top10/Agentic_MITREATLAS.md', framework: 'MITRE ATLAS', ids: ASI_IDS }, @@ -158,6 +159,8 @@ const FRAMEWORK_FILES = [ { rel: 'dsgai-2026/DSGAI_SP800218A.md', framework: 'NIST SP 800-218A', ids: DSGAI_IDS }, { rel: 'dsgai-2026/DSGAI_FedRAMP.md', framework: 'FedRAMP', ids: DSGAI_IDS }, { rel: 'dsgai-2026/DSGAI_DORA.md', framework: 'DORA', ids: DSGAI_IDS }, + { rel: 'agentic-top10/Agentic_AISVS.md', framework: 'OWASP AISVS 1.0', ids: ASI_IDS }, + { rel: 'dsgai-2026/DSGAI_AISVS.md', framework: 'OWASP AISVS 1.0', ids: DSGAI_IDS }, ]; // ─── Audience role mapping ────────────────────────────────────────────────────