{ "siteRelease": "13.5.4", "moduleVersion": "1.0.0", "asOf": "2026-10-27", "term": "AI Deviation Detection and Response", "components": [ { "name": "Generative model", "propagation": "Hallucinated plans and compliant reasoning over whatever the harness hands it. The model is not the vulnerability in any incident here; it is the amplifier.", "atlas": "AML.T0054 Jailbreak \u00b7 AML.T0057 LLM data leakage \u00b7 AML.T0056 Extract system prompt \u00b7 AML.T0060 Publish hallucinated entities", "owaspAgentic": "ASI01", "owaspLLM": "LLM07 \u00b7 LLM09 \u00b7 LLM10 Unbounded consumption", "signal": "Model and template version drift; eval threshold failures; grounding-check misses", "sourceAssociations": "Replit (fabrication)", "legacyRule": "HB-AI-000 \u00b7 Model version or output deviation Elastic KQL (illustrative): ai.model.approved: false or ai.eval.groundedness < 0.6 Enforcement: Route to approved model; hold output for evaluation.", "legacyKQL": "ai.model.approved: false or ai.eval.groundedness < 0.6", "enforcement": "Route to approved model; hold output for evaluation.", "id": "6.00", "short": "Model", "plane": "Control", "sourceComponent": "6.00 Generative model (core)", "standardFields": "gen_ai.operation.name, gen_ai.provider.name, gen_ai.request.model, gen_ai.response.model, gen_ai.request.temperature / max_tokens / stream, gen_ai.usage.input_tokens / output_tokens / reasoning.output_tokens / cache_read.input_tokens, gen_ai.evaluation.result event (name, score.value, score.label, explanation)", "assuranceFields": "model.approved, model.approval_ref, model.resolved_deployment", "customFieldList": [ "practical_trust.model.approved", "practical_trust.model.approval_ref", "practical_trust.model.resolved_deployment" ], "producer": "Model gateway plus signed deployment registry (not the SDK's self-reported model string)", "correlation": "D: requested or responding model outside the approved mapping (lead R1); B: finish-reason and token-distribution shift (R7); A: jailbreak and system-prompt extraction attempts seen as eval-threshold failures. Token counts never establish correctness or conformance", "threatClasses": "AML.T0054 jailbreak, T0057 LLM data leakage, T0056 extract system prompt, T0060 hallucinated entities; ASI01; LLM07, LLM09, LLM10", "draftRule": "HB-AI-600: model.approved false or eval.threshold_status fail", "ruleId": "HB-AI-600", "legacyRuleId": "HB-AI-000", "sampleFields": [ [ "model.approved", true, false ] ], "operation": "chat", "eventAction": "model_observed", "researchCases": [ "s-servicenow", "s-forcedleak" ], "operationalCases": [ "s-replit" ], "lifecycleCases": [] }, { "name": "Inputs & external content", "propagation": "Instructions disguised as data: a lead field, a public issue, a ticket description, a web page, another agent's message.", "atlas": "AML.T0051.001 Indirect injection \u00b7 AML.T0051.002 Triggered \u00b7 AML.T0093 Prompt infiltration via public-facing app \u00b7 AML.T0078 Drive-by \u00b7 AML.T0129 Multimodal triggers \u00b7 AML.T0134 AI-targeted cloaking", "owaspAgentic": "ASI01 Goal hijack", "owaspLLM": "LLM01 Prompt injection", "signal": "Provenance tag = external on content that later precedes a tool call; injection-pattern hits at ingress; field size anomalies (42,000-char description)", "sourceAssociations": "ForcedLeak, GitHub MCP, ServiceNow", "legacyRule": "HB-AI-001 \u00b7 Injection at untrusted ingress Elastic KQL (illustrative): ai.event.action: \"input_received\" and ai.security.injection_score >= 0.8 Enforcement: Quarantine content; prevent promotion to instructions.", "legacyKQL": "ai.event.action: \"input_received\" and ai.security.injection_score >= 0.8", "enforcement": "Quarantine content; prevent promotion to instructions.", "id": "6.01", "short": "Inputs", "plane": "Boundary", "sourceComponent": "6.01 Inputs and external content (boundary)", "standardFields": "gen_ai.input.messages (restricted, optional), event.original (restricted), url.domain, source.ip", "assuranceFields": "input.origin_class, input.fingerprint, input.instruction_indicator, input.classifier_id, input.classifier_score, input.modality; request.tenant, request.subject_ref; content.lineage_id, content.source_scope, content.destination_scope", "customFieldList": [ "practical_trust.input.origin_class", "practical_trust.input.fingerprint", "practical_trust.input.instruction_indicator", "practical_trust.input.classifier_id", "practical_trust.input.classifier_score", "practical_trust.input.modality", "practical_trust.request.tenant", "practical_trust.request.subject_ref", "practical_trust.content.lineage_id", "practical_trust.content.source_scope", "practical_trust.content.destination_scope" ], "producer": "Ingress gateway / content detector; ingress plus IdP; lineage service / DLP", "correlation": "A: external-origin content carrying instruction patterns that later precedes a tool call (R5); field-size anomalies; D: content lineage crossing from source scope to a destination scope it was not approved for. A content digest is an integrity clue, not an instruction boundary", "threatClasses": "AML.T0051.001/.002 indirect and triggered injection, T0093 infiltration via public app, T0078 drive-by, T0129 multimodal triggers, T0134 AI-targeted cloaking; ASI01; LLM01", "draftRule": "HB-AI-601: origin_class external and instruction_indicator true", "ruleId": "HB-AI-601", "legacyRuleId": "HB-AI-001", "sampleFields": [ [ "input.origin_class", "external", "external" ], [ "input.instruction_indicator", false, true ] ], "operation": null, "eventAction": "input_received", "researchCases": [ "s-servicenow", "s-github", "s-forcedleak" ], "operationalCases": [ "s-asana", "s-replit" ], "lifecycleCases": [] }, { "name": "Orchestrator / agent loop", "propagation": "A manipulated plan: the loop selects tools, branches and teammates on the basis of poisoned context. Discovery and recruitment live here.", "atlas": "AML.T0118.001 Direct agent communication \u00b7 AML.T0124 Autonomous attack orchestration \u00b7 AML.T0084.001 Discover tool definitions \u00b7 AML.T0133 Discover runtime capabilities \u00b7 AML.T0034.002 Agentic resource consumption", "owaspAgentic": "ASI07 Insecure inter-agent communication \u00b7 ASI08 Cascading failures \u00b7 ASI10 Rogue agents", "owaspLLM": "LLM06 Excessive agency", "signal": "Agent-to-agent invocation depth above baseline; privileged agent invoked by a lower-privilege caller; loop budget or stop-condition breaches", "sourceAssociations": "ServiceNow", "legacyRule": "HB-AI-002 \u00b7 Runaway or redirected agent Elastic KQL (illustrative): ai.event.action: \"agent_step\" and ai.agent.step_count > 25 Enforcement: Terminate run; enforce external step and cost budget.", "legacyKQL": "ai.event.action: \"agent_step\" and ai.agent.step_count > 25", "enforcement": "Terminate run; enforce external step and cost budget.", "id": "6.02", "short": "Agent loop", "plane": "Control", "sourceComponent": "6.02 Orchestrator / agent loop (control)", "standardFields": "gen_ai.operation.name invoke_agent, gen_ai.agent.id / name / version, gen_ai.workflow.name, gen_ai.conversation.id", "assuranceFields": "agent.privilege_edge_unapproved, agent.fanout_limit_exceeded, agent.parent_ref, agent.child_ref, agent.call_depth, agent.tool_graph_version", "customFieldList": [ "practical_trust.agent.privilege_edge_unapproved", "practical_trust.agent.fanout_limit_exceeded", "practical_trust.agent.parent_ref", "practical_trust.agent.child_ref", "practical_trust.agent.call_depth", "practical_trust.agent.tool_graph_version" ], "producer": "Orchestrator plus graph-policy verifier (the approved agent-to-agent graph as a control artefact)", "correlation": "D: invocation depth or fan-out above baseline; privileged agent invoked by a lower-privilege caller; stop-condition and loop-budget breaches; B: tool-graph version changes between sessions; A: autonomous orchestration and discovery of runtime capabilities", "threatClasses": "AML.T0118.001 direct agent communication, T0124 autonomous attack orchestration, T0084.001 / T0133 capability discovery, T0034.002 agentic resource consumption; ASI07, ASI08, ASI10; LLM06", "draftRule": "HB-AI-602: privilege_edge_unapproved or fanout_limit_exceeded", "ruleId": "HB-AI-602", "legacyRuleId": "HB-AI-002", "sampleFields": [ [ "agent.privilege_edge_unapproved", false, true ], [ "agent.fanout_limit_exceeded", false, true ] ], "operation": "invoke_agent", "eventAction": "agent_step", "researchCases": [ "s-servicenow" ], "operationalCases": [ "s-asana", "s-replit" ], "lifecycleCases": [] }, { "name": "RAG subsystem", "propagation": "Poisoned or over-shared knowledge that looks like normal retrieval; credentials that were indexed by accident.", "atlas": "AML.T0070 RAG poisoning \u00b7 AML.T0071 False RAG entry \u00b7 AML.T0064 Gather RAG-indexed targets \u00b7 AML.T0082 RAG credential harvesting \u00b7 AML.T0085.000 Data from RAG databases", "owaspAgentic": "ASI06 Memory & context poisoning", "owaspLLM": "LLM08 Vector & embedding weaknesses \u00b7 LLM02 Sensitive disclosure", "signal": "Retrieval returning objects outside the caller's ACL or tenant; source IDs with no provenance; retrieval volume spikes", "sourceAssociations": "Asana", "legacyRule": "HB-AI-003 \u00b7 RAG authorization/provenance failure Elastic KQL (illustrative): ai.event.action: \"retrieval\" and (ai.rag.acl_result: \"deny\" or ai.rag.provenance_verified: false) Enforcement: Deny retrieval before context assembly; isolate index item.", "legacyKQL": "ai.event.action: \"retrieval\" and (ai.rag.acl_result: \"deny\" or ai.rag.provenance_verified: false)", "enforcement": "Deny retrieval before context assembly; isolate index item.", "id": "6.03", "short": "RAG", "plane": "Data", "sourceComponent": "6.03 RAG subsystem (data)", "standardFields": "gen_ai.operation.name retrieval (where supported), gen_ai.data_source.id, gen_ai.retrieval.documents", "assuranceFields": "retrieval.acl_violation, retrieval.index_digest_mismatch, retrieval.result_tenant, retrieval.document_ref, retrieval.corpus_id, retrieval.result_count, index.manifest_digest; access.decision_id", "customFieldList": [ "practical_trust.retrieval.acl_violation", "practical_trust.retrieval.index_digest_mismatch", "practical_trust.retrieval.result_tenant", "practical_trust.retrieval.document_ref", "practical_trust.retrieval.corpus_id", "practical_trust.retrieval.result_count", "practical_trust.index.manifest_digest", "practical_trust.access.decision_id" ], "producer": "Corpus registry / index attestor; retriever plus source ACL service; source ACL / PDP", "correlation": "D: results outside the caller's ACL or tenant; index digest differing from the registered corpus manifest (this is the Platinum release check); B: retrieval volume and scope drift (R4); A: RAG poisoning and credential harvesting from indexed secrets. A source ID alone does not prove historical corpus contents", "threatClasses": "AML.T0070 RAG poisoning, T0071 false RAG entry, T0064 gather RAG targets, T0082 RAG credential harvesting, T0085.000 data from RAG databases; ASI06; LLM08, LLM02", "draftRule": "HB-AI-603: acl_violation or index_digest_mismatch", "ruleId": "HB-AI-603", "legacyRuleId": "HB-AI-003", "sampleFields": [ [ "retrieval.acl_violation", false, true ], [ "retrieval.index_digest_mismatch", false, true ] ], "operation": "retrieval", "eventAction": "retrieval_completed", "researchCases": [ "s-servicenow", "s-forcedleak" ], "operationalCases": [ "s-asana" ], "lifecycleCases": [] }, { "name": "Memory & state", "propagation": "Instructions that persist: a poisoned memory re-enters every later decision; shared state leaks between principals.", "atlas": "AML.T0080.000 Context poisoning: memory \u00b7 AML.T0080.001 Thread \u00b7 AML.T0094 Delayed execution of instructions \u00b7 AML.T0092 Manipulate chat history", "owaspAgentic": "ASI06 Memory & context poisoning", "owaspLLM": "LLM04 Data & model poisoning", "signal": "Memory writes originating from external-provenance content; TTL and write-authorization violations; memory reads across user boundaries", "sourceAssociations": "Asana (state), Replit (fabricated state)", "legacyRule": "HB-AI-004 \u00b7 Cross-principal memory write Elastic KQL (illustrative): ai.event.action: \"memory_write\" and ai.memory.owner_mismatch: true Enforcement: Reject write; restore signed memory version.", "legacyKQL": "ai.event.action: \"memory_write\" and ai.memory.owner_mismatch: true", "enforcement": "Reject write; restore signed memory version.", "id": "6.04", "short": "Memory", "plane": "Data", "sourceComponent": "6.04 Memory and state (data)", "standardFields": "gen_ai.conversation.id", "assuranceFields": "memory.authority_ref, memory.retention_class, memory.cross_principal_read, memory.unauthorized_write, memory.record_ref, memory.ttl_expires_at", "customFieldList": [ "practical_trust.memory.authority_ref", "practical_trust.memory.retention_class", "practical_trust.memory.cross_principal_read", "practical_trust.memory.unauthorized_write", "practical_trust.memory.record_ref", "practical_trust.memory.ttl_expires_at" ], "producer": "Memory store access logs (independent store confirmation, not the agent's claim)", "correlation": "D: writes originating from external-provenance content; TTL and write-authorisation violations; reads across principal boundaries; B: retention-class drift; A: delayed-execution instructions persisted in memory (R8). A missing record ID does not prove deletion", "threatClasses": "AML.T0080.000/.001 memory and thread poisoning, T0094 delayed execution, T0092 manipulate chat history; ASI06; LLM04", "draftRule": "HB-AI-604: unauthorized_write or cross_principal_read", "ruleId": "HB-AI-604", "legacyRuleId": "HB-AI-004", "sampleFields": [ [ "memory.unauthorized_write", false, true ], [ "memory.cross_principal_read", false, true ] ], "operation": null, "eventAction": "memory_accessed", "researchCases": [ "s-forcedleak" ], "operationalCases": [ "s-asana" ], "lifecycleCases": [] }, { "name": "Context assembly", "propagation": "Trusted instructions and untrusted text collapsing into one token stream; safeguards silently truncated by overflow.", "atlas": "AML.T0069.000 Discover special character sets \u00b7 AML.T0068 Prompt obfuscation \u00b7 AML.T0061 Prompt self-replication \u00b7 AML.T0018.003 Modify prompt construction logic", "owaspAgentic": "ASI01 Goal hijack", "owaspLLM": "LLM01 \u00b7 LLM07 System prompt leakage", "signal": "Context lineage showing external content adjacent to protected instructions; context-budget truncation events", "sourceAssociations": "Every incident on this page", "legacyRule": "HB-AI-005 \u00b7 Context boundary integrity Elastic KQL (illustrative): ai.event.action: \"context_assembled\" and ai.context.trust_boundary_violation: true Enforcement: Rebuild context with untrusted content fenced.", "legacyKQL": "ai.event.action: \"context_assembled\" and ai.context.trust_boundary_violation: true", "enforcement": "Rebuild context with untrusted content fenced.", "id": "6.05", "short": "Context", "plane": "Control", "sourceComponent": "6.05 Context assembly (control)", "standardFields": "gen_ai.system_instructions (restricted, optional), gen_ai.input.messages", "assuranceFields": "context.origin_classes, context.protected_instruction_truncated, context.template_digest_match, context.token_budget, prompt.template_digest", "customFieldList": [ "practical_trust.context.origin_classes", "practical_trust.context.protected_instruction_truncated", "practical_trust.context.template_digest_match", "practical_trust.context.token_budget", "practical_trust.prompt.template_digest" ], "producer": "Signed template registry; trusted context compiler", "correlation": "D: template digest not matching the signed registry (R11); protected instructions truncated by overflow; A: external content adjacent to protected instructions in context lineage; obfuscation and self-replicating prompts. Recorded without routinely exporting prompt bodies", "threatClasses": "AML.T0069.000 special character sets, T0068 obfuscation, T0061 self-replication, T0018.003 modify prompt construction; ASI01; LLM01, LLM07", "draftRule": "HB-AI-605: protected_instruction_truncated or template_digest_match false", "ruleId": "HB-AI-605", "legacyRuleId": "HB-AI-005", "sampleFields": [ [ "context.protected_instruction_truncated", false, true ], [ "context.template_digest_match", true, false ] ], "operation": null, "eventAction": "context_assembled", "researchCases": [ "s-servicenow", "s-github", "s-forcedleak" ], "operationalCases": [ "s-asana", "s-replit" ], "lifecycleCases": [] }, { "name": "Input / output guardrails", "propagation": "Nothing should propagate here, which is the problem: a filter the orchestrator can bypass, or that treats a feature as safe, lets prohibited actions through.", "atlas": "AML.T0054 LLM jailbreak \u00b7 AML.T0065 Prompt crafting \u00b7 AML.T0077 LLM response rendering", "owaspAgentic": "ASI09 Human-agent trust exploitation", "owaspLLM": "LLM05 Improper output handling", "signal": "Outputs carrying external references with encoded parameters; guardrail bypass-path tests failing; actions proceeding on a guardrail \"allow\" with no gate decision", "sourceAssociations": "ForcedLeak, ServiceNow", "legacyRule": "HB-AI-006 \u00b7 Guardrail bypass / missing decision Elastic KQL (illustrative): ai.event.action: \"tool_execute\" and not ai.guardrail.decision_id: * Enforcement: Fail closed in dispatcher; alert on missing gate attestation.", "legacyKQL": "ai.event.action: \"tool_execute\" and not ai.guardrail.decision_id: *", "enforcement": "Fail closed in dispatcher; alert on missing gate attestation.", "id": "6.06", "short": "Guardrails", "plane": "Control", "sourceComponent": "6.06 Input / output guardrails (control)", "standardFields": "gen_ai.output.messages (restricted, optional), url.domain", "assuranceFields": "guardrail.bypass_detected, guardrail.policy_ref, guardrail.confidence, output.unsafe_egress_url", "customFieldList": [ "practical_trust.guardrail.bypass_detected", "practical_trust.guardrail.policy_ref", "practical_trust.guardrail.confidence", "practical_trust.output.unsafe_egress_url" ], "producer": "Independent guardrail evaluator; output renderer plus egress monitor", "correlation": "D: actions proceeding on a guardrail allow with no gate decision; bypass-path tests failing; A: outputs carrying external references with encoded parameters (the ForcedLeak pattern); B: classifier confidence and version drift. Zero filter hits does not prove filtering was on (R7, R12)", "threatClasses": "AML.T0054 jailbreak, T0065 prompt crafting, T0077 response rendering; ASI09; LLM05", "draftRule": "HB-AI-606: bypass_detected or unsafe_egress_url", "ruleId": "HB-AI-606", "legacyRuleId": "HB-AI-006", "sampleFields": [ [ "guardrail.bypass_detected", false, true ], [ "output.unsafe_egress_url", false, true ] ], "operation": null, "eventAction": "guardrail_evaluated", "researchCases": [ "s-forcedleak" ], "operationalCases": [], "lifecycleCases": [] }, { "name": "Policy / authorization gate", "propagation": "Without this check, AI may turn a bad recommendation into an unauthorized action. The gate checks approved business rules; the system carrying out the action must enforce the decision. The agent must not be able to bypass either control.", "atlas": "AML.T0081 Modify AI agent configuration \u00b7 AML.T0132 Misconfigured or publicly exposed AI services", "owaspAgentic": "ASI03 Identity & privilege abuse \u00b7 ASI02 Tool misuse", "owaspLLM": "LLM06 Excessive agency", "signal": "An action runs without matching permission; approval has expired or belongs to another action; the agent approves itself; or a business rule changes without authorization", "sourceAssociations": "GitHub MCP, Replit, ServiceNow", "legacyRule": "HB-AI-007 \u00b7 Policy deny followed by execution Elastic KQL (illustrative): ai.policy.decision: \"deny\" and ai.event.action: \"tool_execute\" Enforcement: Block via OPA or dispatcher; revoke session.", "legacyKQL": "ai.policy.decision: \"deny\" and ai.event.action: \"tool_execute\"", "enforcement": "Require valid permission before execution. Hold work requiring human review and block prohibited actions. If bypass or compromised access is confirmed, suspend the affected access and investigate.", "id": "6.07", "short": "Policy gate", "plane": "Identity & action", "sourceComponent": "6.07 Policy / authorization gate (identity and action)", "standardFields": "event.action policy_decided, user.id", "assuranceFields": "authz.receipt_status, authz.policy_version, authz.receipt_id, policy.digest; action.fingerprint, action.material, action.target; decision.id; request.tenant, request.subject_ref; access.decision_id", "customFieldList": [ "practical_trust.authz.receipt_status", "practical_trust.authz.policy_version", "practical_trust.authz.receipt_id", "practical_trust.policy.digest", "practical_trust.action.fingerprint", "practical_trust.action.material", "practical_trust.action.target", "practical_trust.decision.id", "practical_trust.request.tenant", "practical_trust.request.subject_ref", "practical_trust.access.decision_id" ], "producer": "The separate authorization service records its decision using approved, signed rules; the executing system verifies that permission matches the request", "correlation": "Compare what was permitted with what actually ran. Investigate a missing, expired, reused or invalid decision receipt, an unauthorized rule change, or an agent approving itself. A receipt records permission, not proof of safety or completion. A missing record is an evidence gap to investigate, not proof of an attack.", "threatClasses": "AML.T0081 modify agent configuration, T0132 misconfigured or exposed AI services; ASI03, ASI02; LLM06", "draftRule": "HB-AI-607: action.material true and receipt_status missing / expired / invalid / replayed", "ruleId": "HB-AI-607", "legacyRuleId": "HB-AI-007", "sampleFields": [ [ "action.material", true, true ], [ "authz.receipt_status", "valid", "expired" ] ], "operation": null, "eventAction": "policy_decided", "researchCases": [ "s-servicenow", "s-github", "s-forcedleak" ], "operationalCases": [ "s-replit" ], "lifecycleCases": [] }, { "name": "Credential broker", "propagation": "Standing privilege and inherited identity: the recruited agent acts as the user; one token spans every repository; dev holds prod keys.", "atlas": "AML.T0083 Credentials from agent configuration \u00b7 AML.T0098 Tool credential harvesting \u00b7 AML.T0091.000 Application access token \u00b7 AML.T0012 Valid accounts", "owaspAgentic": "ASI03 Identity & privilege abuse", "owaspLLM": "LLM02", "signal": "One credential used across more targets than the task scope; privileged tool calls under a delegated identity with no delegation record", "sourceAssociations": "GitHub MCP, ServiceNow, Replit", "legacyRule": "HB-AI-008 \u00b7 Token scope anomaly Elastic KQL (illustrative): ai.credential.scope_violation: true Enforcement: Revoke token; issue scoped ephemeral credentials.", "legacyKQL": "ai.credential.scope_violation: true", "enforcement": "Revoke token; issue scoped ephemeral credentials.", "id": "6.08", "short": "Credentials", "plane": "Identity & action", "sourceComponent": "6.08 Credential broker (identity and action)", "standardFields": "event.action credential_issued, user.id", "assuranceFields": "credential.reference, credential.scope, credential.ttl, credential.scope_violation, credential.revoked_used, credential.use_accepted, credential.expires_at, credential.revoked_at", "customFieldList": [ "practical_trust.credential.reference", "practical_trust.credential.scope", "practical_trust.credential.ttl", "practical_trust.credential.scope_violation", "practical_trust.credential.revoked_used", "practical_trust.credential.use_accepted", "practical_trust.credential.expires_at", "practical_trust.credential.revoked_at" ], "producer": "Token broker / relying target (issuance and acceptance from both sides)", "correlation": "D: one credential used across more targets than the task scope; privileged tool call under a delegated identity with no delegation record; revoked credential accepted; B: TTL drift toward standing privilege; A: credential harvesting from agent configuration (R9)", "threatClasses": "AML.T0083 credentials from agent configuration, T0098 tool credential harvesting, T0091.000 application access token, T0012 valid accounts; ASI03; LLM02", "draftRule": "HB-AI-608: scope_violation or revoked_used", "ruleId": "HB-AI-608", "legacyRuleId": "HB-AI-008", "sampleFields": [ [ "credential.scope_violation", false, true ], [ "credential.revoked_used", false, true ] ], "operation": null, "eventAction": "credential_issued", "researchCases": [ "s-servicenow", "s-github" ], "operationalCases": [ "s-asana", "s-replit" ], "lifecycleCases": [] }, { "name": "Extensions / MCP / skills", "propagation": "Capability arriving with its own bugs and its own trust: a poisoned tool definition, a rug-pulled package, or a first-party MCP server with a tenant-isolation flaw.", "atlas": "AML.T0110 AI agent tool poisoning (.000 definition, .001 implementation, .002 runtime response) \u00b7 AML.T0010.005 Supply chain: agent tool \u00b7 AML.T0109 Rug pull \u00b7 AML.T0115.002 Publish poisoned tools \u00b7 AML.T0111 Reputation inflation", "owaspAgentic": "ASI04 Agentic supply chain vulnerabilities", "owaspLLM": "LLM03 Supply chain", "signal": "Tool definitions changing between sessions; unregistered MCP endpoints; tool responses carrying instruction patterns; cross-tenant object IDs in responses", "sourceAssociations": "Asana, GitHub MCP", "legacyRule": "HB-AI-009 \u00b7 Unattested extension execution Elastic KQL (illustrative): ai.extension.attestation_valid: false and ai.event.action: \"extension_load\" Enforcement: Disable MCP/skill; enforce signed allowlist.", "legacyKQL": "ai.extension.attestation_valid: false and ai.event.action: \"extension_load\"", "enforcement": "Disable MCP/skill; enforce signed allowlist.", "id": "6.09", "short": "MCP / skills", "plane": "Identity & action", "sourceComponent": "6.09 Extensions / MCP / skills (identity and action, supply chain)", "standardFields": "gen_ai.tool.definitions, gen_ai.tool.type", "assuranceFields": "extension.attestation_status, extension.digest, extension.digest_mismatch, extension.publisher_ref, extension.endpoint_id; allowlist.version", "customFieldList": [ "practical_trust.extension.attestation_status", "practical_trust.extension.digest", "practical_trust.extension.digest_mismatch", "practical_trust.extension.publisher_ref", "practical_trust.extension.endpoint_id", "practical_trust.allowlist.version" ], "producer": "Publisher / MCP registry verifier; asset inventory / egress proxy", "correlation": "D: tool definitions changing between sessions; unregistered MCP endpoint; digest differing from the attested package; A: tool poisoning, rug pull, reputation inflation; cross-tenant object IDs in tool responses. A Nuix Neo MCP endpoint registers here", "threatClasses": "AML.T0110 tool poisoning (.000 definition, .001 implementation, .002 runtime), T0010.005 supply chain agent tool, T0109 rug pull, T0115.002 publish poisoned tools, T0111 reputation inflation; ASI04; LLM03", "draftRule": "HB-AI-609: attestation_status missing / invalid / revoked or digest_mismatch", "ruleId": "HB-AI-609", "legacyRuleId": "HB-AI-009", "sampleFields": [ [ "extension.attestation_status", "valid", "revoked" ], [ "extension.digest_mismatch", false, true ] ], "operation": null, "eventAction": "extension_verified", "researchCases": [ "s-github" ], "operationalCases": [ "s-asana" ], "lifecycleCases": [] }, { "name": "Tool dispatcher", "propagation": "The point where a sentence becomes deletion, exfiltration, publication, messaging or a privilege change.", "atlas": "AML.T0053 AI agent tool invocation \u00b7 AML.T0086 Exfiltration via tool invocation \u00b7 AML.T0101 Data destruction via tool invocation \u00b7 AML.T0085.001 Data from agent tools \u00b7 AML.T0100 Agent clickbait", "owaspAgentic": "ASI02 Tool misuse \u00b7 ASI05 Unexpected code execution", "owaspLLM": "LLM06 Excessive agency", "signal": "Write or destructive tool calls whose arguments contain content from external-provenance context; tool calls to targets outside the task's declared scope; blanket auto-approval in effect", "sourceAssociations": "GitHub MCP, Replit, ForcedLeak", "legacyRule": "HB-AI-010 \u00b7 High-risk tool invocation Elastic KQL (illustrative): ai.event.action: \"tool_execute\" and ai.tool.risk_level: \"high\" and ai.approval.valid: false Enforcement: Deny tool call and require independent approval.", "legacyKQL": "ai.event.action: \"tool_execute\" and ai.tool.risk_level: \"high\" and ai.approval.valid: false", "enforcement": "Deny tool call and require independent approval.", "id": "6.10", "short": "Dispatcher", "plane": "Identity & action", "sourceComponent": "6.10 Tool dispatcher (identity and action)", "standardFields": "gen_ai.operation.name execute_tool, gen_ai.tool.name, gen_ai.tool.call.id, gen_ai.tool.call.arguments / result (restricted, optional)", "assuranceFields": "dispatch.receipt_match, dispatch.budget_reservation_valid, dispatch.action_id, dispatch.tool_id; action.fingerprint, action.material, action.target; content.lineage_id / source_scope / destination_scope", "customFieldList": [ "practical_trust.dispatch.receipt_match", "practical_trust.dispatch.budget_reservation_valid", "practical_trust.dispatch.action_id", "practical_trust.dispatch.tool_id", "practical_trust.action.fingerprint", "practical_trust.action.material", "practical_trust.action.target", "practical_trust.content.lineage_id", "practical_trust.content.source_scope", "practical_trust.content.destination_scope" ], "producer": "Independent action dispatcher; independent PDP / dispatcher", "correlation": "D: execute_tool with no matching gate receipt or no valid budget reservation; tool call to a target outside declared scope; blanket auto-approval in effect; A: write or destructive calls whose arguments contain external-provenance content (R3, R5). An execute_tool span alone does not prove the effect", "threatClasses": "AML.T0053 tool invocation, T0086 exfiltration via tool, T0101 data destruction via tool, T0085.001 data from agent tools, T0100 agent clickbait; ASI02, ASI05; LLM06", "draftRule": "HB-AI-610: execute_tool and (receipt_match false or budget_reservation_valid false)", "ruleId": "HB-AI-610", "legacyRuleId": "HB-AI-010", "sampleFields": [ [ "dispatch.receipt_match", true, false ], [ "dispatch.budget_reservation_valid", true, false ] ], "operation": "execute_tool", "eventAction": "tool_dispatched", "researchCases": [ "s-servicenow", "s-github", "s-forcedleak" ], "operationalCases": [ "s-replit" ], "lifecycleCases": [] }, { "name": "Sandbox / downstream systems", "propagation": "Persistent system change: the production database, the public pull request, the outbound email, the CRM record.", "atlas": "AML.T0048 External harms \u00b7 AML.T0025 Exfiltration via cyber means \u00b7 AML.T0105 Escape to host \u00b7 AML.T0122 Exploitation of remote services", "owaspAgentic": "ASI08 Cascading failures", "owaspLLM": "LLM02 \u00b7 LLM05", "signal": "Egress to allowlisted hosts whose registration lapsed; writes to public surfaces containing private lineage; production mutations from non-production identities", "sourceAssociations": "Replit, ForcedLeak, GitHub MCP", "legacyRule": "HB-AI-011 \u00b7 Sandbox escape / forbidden egress Elastic KQL (illustrative): ai.sandbox.egress_allowed: false or ai.sandbox.escape_detected: true Enforcement: Isolate workload; block egress at network policy.", "legacyKQL": "ai.sandbox.egress_allowed: false or ai.sandbox.escape_detected: true", "enforcement": "Isolate workload; block egress at network policy.", "id": "6.11", "short": "Downstream", "plane": "Data", "sourceComponent": "6.11 Sandbox / downstream systems (data, permitted effects)", "standardFields": "destination.ip, url.domain, deployment.environment.name, event.outcome", "assuranceFields": "downstream.request_id, effect.status, effect.environment_violation, effect.outcome_mismatch, effect.unapproved_egress, effect.affected_rows, effect.verified_by, effect.verification_time; allowlist.version; recovery.reference", "customFieldList": [ "practical_trust.downstream.request_id", "practical_trust.effect.status", "practical_trust.effect.environment_violation", "practical_trust.effect.outcome_mismatch", "practical_trust.effect.unapproved_egress", "practical_trust.effect.affected_rows", "practical_trust.effect.verified_by", "practical_trust.effect.verification_time", "practical_trust.allowlist.version", "practical_trust.recovery.reference" ], "producer": "System-of-record audit; target system / outcome verifier; recovery verifier / ITSM", "correlation": "D: production mutation from a non-production identity; egress to an allowlisted host whose registration lapsed; agent-reported outcome differing from the target system's own log; B: affected-row counts above the approved ceiling; A: exfiltration, escape to host, writes of private lineage to public surfaces. Validate through the target's own logs; late traces require reconciliation", "threatClasses": "AML.T0048 external harms, T0025 exfiltration via cyber means, T0105 escape to host, T0122 exploitation of remote services; ASI08; LLM02, LLM05", "draftRule": "HB-AI-611: environment_violation or unapproved_egress or outcome_mismatch", "ruleId": "HB-AI-611", "legacyRuleId": "HB-AI-011", "sampleFields": [ [ "effect.environment_violation", false, true ], [ "effect.outcome_mismatch", false, true ] ], "operation": null, "eventAction": "effect_verified", "researchCases": [ "s-servicenow", "s-github", "s-forcedleak" ], "operationalCases": [ "s-replit" ], "lifecycleCases": [] }, { "name": "Observability & audit", "propagation": "When the agent is its own witness, fabricated results propagate as fact. Evidence must be produced by the dispatcher and the gate, not reported by the model.", "atlas": "AML.T0067 Trusted output components manipulation \u00b7 AML.T0067.000 Citations \u00b7 AML.T0074 Masquerading \u00b7 AML.T0092 Manipulate chat history", "owaspAgentic": "ASI09 Human-agent trust exploitation \u00b7 ASI10 Rogue agents", "owaspLLM": "LLM09 Misinformation", "signal": "Agent claims (tests passed, rollback done) with no corroborating producer event; gaps in producer coverage; evidence integrity failures", "sourceAssociations": "Replit", "legacyRule": "HB-AI-012 \u00b7 Evidence chain gaps Elastic KQL (illustrative): ai.event.action: \"action_complete\" and ai.audit.producer_receipt_present: false Enforcement: Suspend automated closure; reconcile signed events.", "legacyKQL": "ai.event.action: \"action_complete\" and ai.audit.producer_receipt_present: false", "enforcement": "Suspend automated closure; reconcile signed events.", "id": "6.12", "short": "Audit", "plane": "Evidence", "sourceComponent": "6.12 Observability and audit (evidence)", "standardFields": "trace.id, span.id, event.ingested, telemetry.sdk.version", "assuranceFields": "producer.identity, producer.trust_level, producer.signature_status, producer.coverage_id; evidence.contract_id, evidence.artifact_hash, evidence.artifact_uri, evidence.coverage_status, evidence.integrity_status; collector.loss_slo_breached, collector.dropped_events, collector.ingest_delay_ms, collector.heartbeat_at", "customFieldList": [ "practical_trust.producer.identity", "practical_trust.producer.trust_level", "practical_trust.producer.signature_status", "practical_trust.producer.coverage_id", "practical_trust.evidence.contract_id", "practical_trust.evidence.artifact_hash", "practical_trust.evidence.artifact_uri", "practical_trust.evidence.coverage_status", "practical_trust.evidence.integrity_status", "practical_trust.collector.loss_slo_breached", "practical_trust.collector.dropped_events", "practical_trust.collector.ingest_delay_ms", "practical_trust.collector.heartbeat_at" ], "producer": "Collector identity registry; evidence store / integrity checker; OTel / secure log collector", "correlation": "D: agent claims (tests passed, rollback done) with no corroborating producer event; gaps in producer coverage; evidence integrity failures; B: collector loss, delay and heartbeat drift that would silently blind every other rule; A: citation and chat-history manipulation, masquerading. Sampling can discard evidence tail sampling cannot recover; material-action records need a separate durable path", "threatClasses": "AML.T0067 trusted output manipulation, T0067.000 citations, T0074 masquerading, T0092 manipulate chat history; ASI09, ASI10; LLM09", "draftRule": "HB-AI-612: coverage_status gap or integrity_status invalid or loss_slo_breached", "ruleId": "HB-AI-612", "legacyRuleId": "HB-AI-012", "sampleFields": [ [ "evidence.coverage_status", "complete", "gap" ], [ "evidence.integrity_status", "valid", "invalid" ] ], "operation": null, "eventAction": "evidence_collected", "researchCases": [ "s-servicenow", "s-github", "s-forcedleak" ], "operationalCases": [ "s-asana", "s-replit" ], "lifecycleCases": [] }, { "name": "Identity & delegation", "propagation": "Authority that broadens as it is handed down: a child agent inheriting an unrestricted copy of the parent's permissions, a stale grant outliving its owner's approval, a shared identity hiding who acted.", "atlas": "AML.T0118.001 Direct agent communication \u00b7 AML.T0091.000 Application access token \u00b7 AML.T0083 Credentials from agent configuration \u00b7 AML.T0012 Valid accounts \u00b7 AML.T0103 Deploy AI agent", "owaspAgentic": "ASI03 Identity & privilege abuse \u00b7 ASI07 Insecure inter-agent communication", "owaspLLM": "LLM06", "signal": "A delegation hop whose child scope is not a subset of the parent's; a child still running after the owner's revocation; an action with no delegation chain back to a human owner", "sourceAssociations": "ServiceNow, GitHub MCP", "legacyRule": "HB-AI-013 \u00b7 Delegation scope expansion Elastic KQL (illustrative): ai.delegation.child_scope_exceeds_parent: true Enforcement: Deny delegation; expire child credential.", "legacyKQL": "ai.delegation.child_scope_exceeds_parent: true", "enforcement": "Deny delegation; expire child credential.", "id": "6.13", "short": "Delegation", "plane": "Lifecycle", "sourceComponent": "6.13 Identity and delegation (lifecycle)", "standardFields": "user.id, gen_ai.agent.id", "assuranceFields": "delegation.chain_id, delegation.expires_at, delegation.scope, delegation.scope_subset, delegation.revoked_child_active, delegation.parent_ref, delegation.child_ref, delegation.revoke_command_id", "customFieldList": [ "practical_trust.delegation.chain_id", "practical_trust.delegation.expires_at", "practical_trust.delegation.scope", "practical_trust.delegation.scope_subset", "practical_trust.delegation.revoked_child_active", "practical_trust.delegation.parent_ref", "practical_trust.delegation.child_ref", "practical_trust.delegation.revoke_command_id" ], "producer": "Identity and delegation issuer (trusted identity service; never client-written agent IDs or trace headers)", "correlation": "D: a hop whose child scope is not a subset of the parent's; a child still running after revocation; an action with no delegation chain back to a human owner; B: delegation expiry drifting toward standing grants; A: deploy-AI-agent and valid-accounts abuse across organisation boundaries", "threatClasses": "AML.T0118.001, T0091.000, T0083, T0012, T0103 deploy AI agent; ASI03, ASI07; LLM06", "draftRule": "HB-AI-613: scope_subset false or revoked_child_active", "ruleId": "HB-AI-613", "legacyRuleId": "HB-AI-013", "sampleFields": [ [ "delegation.scope_subset", true, false ], [ "delegation.revoked_child_active", false, true ] ], "operation": null, "eventAction": "delegation_validated", "researchCases": [], "operationalCases": [], "lifecycleCases": [ "s-servicenow", "s-github", "s-replit" ] }, { "name": "Evaluation & conformance", "propagation": "Degraded grounding, accuracy or bias hiding behind a stable model name; or a false drift alarm when an alias changes but the resolved deployment is still approved.", "atlas": "AML.T0031 Erode AI model integrity \u00b7 AML.T0020 Training data poisoning \u00b7 AML.T0018.003 Modify prompt construction logic \u00b7 AML.T0010.003 Supply chain: model \u00b7 AML.T0067 Trusted output manipulation", "owaspAgentic": "ASI04 Supply chain \u00b7 ASI10 Rogue agents", "owaspLLM": "LLM04 Data & model poisoning \u00b7 LLM09 Misinformation", "signal": "Resolved model or deployment outside the approved set; evaluation suite, dataset or evaluator version drift; failed evaluations not routed to an independent release decision", "sourceAssociations": "Replit (no independent evaluation evidence)", "legacyRule": "HB-AI-014 \u00b7 Evaluation regression Elastic KQL (illustrative): ai.eval.release_gate: \"fail\" Enforcement: Block rollout; revert attested release.", "legacyKQL": "ai.eval.release_gate: \"fail\"", "enforcement": "Block rollout; revert attested release.", "id": "6.14", "short": "Evaluation", "plane": "Lifecycle", "sourceComponent": "6.14 Evaluation and conformance (lifecycle)", "standardFields": "gen_ai.evaluation.result event (name, score.value, score.label, explanation), gen_ai.request.model / response.model", "assuranceFields": "eval.model_ref, eval.suite_version, eval.dataset_version, eval.threshold_status, eval.release_binding_valid, eval.score, eval.judge_version", "customFieldList": [ "practical_trust.eval.model_ref", "practical_trust.eval.suite_version", "practical_trust.eval.dataset_version", "practical_trust.eval.threshold_status", "practical_trust.eval.release_binding_valid", "practical_trust.eval.score", "practical_trust.eval.judge_version" ], "producer": "Independent evaluation runner", "correlation": "B: degraded grounding, accuracy or bias behind a stable model name; suite, dataset or evaluator version drift; D: resolved deployment outside the approved set; failed evaluation not routed to an independent release decision; A: training-data poisoning and model supply-chain substitution. eval.dataset_version is where the Platinum corpus release is bound to the evaluation", "threatClasses": "AML.T0031 erode model integrity, T0020 training data poisoning, T0018.003, T0010.003 supply chain model, T0067; ASI04, ASI10; LLM04, LLM09", "draftRule": "HB-AI-614: threshold_status fail or release_binding_valid false", "ruleId": "HB-AI-614", "legacyRuleId": "HB-AI-014", "sampleFields": [ [ "eval.threshold_status", "pass", "fail" ], [ "eval.release_binding_valid", true, false ] ], "operation": null, "eventAction": "evaluation_completed", "researchCases": [], "operationalCases": [], "lifecycleCases": [ "s-forcedleak", "s-asana", "s-replit" ] }, { "name": "Human oversight console", "propagation": "Consequential activity that is nominally supervised: rubber-stamp approvals, fatigued reviewers, or an interrupt the agent itself controls.", "atlas": "AML.T0067 Trusted output manipulation \u00b7 AML.T0073 Impersonation \u00b7 AML.T0094 Delayed execution (acts after the approval window) \u00b7 AML.T0100 Agent clickbait \u00b7 AML.T0092 Manipulate chat history", "owaspAgentic": "ASI09 Human-agent trust exploitation", "owaspLLM": "LLM09", "signal": "Approvals faster than the evidence could be read; approver identity equal to the agent's; an interrupt issued with no observed stop in execution or identity layers; approvals reused across actions or past expiry", "sourceAssociations": "Replit (freeze was a prompt, not an interrupt), GitHub MCP (always-allow)", "legacyRule": "HB-AI-015 \u00b7 Invalid human approval Elastic KQL (illustrative): ai.approval.valid: false and ai.event.action: \"privileged_action\" Enforcement: Pause workflow; independent approval challenge.", "legacyKQL": "ai.approval.valid: false and ai.event.action: \"privileged_action\"", "enforcement": "Pause workflow; independent approval challenge.", "id": "6.15", "short": "Oversight", "plane": "Lifecycle", "sourceComponent": "6.15 Human oversight console (lifecycle)", "standardFields": "event.action oversight_decided, user.id", "assuranceFields": "oversight.evidence_id, oversight.approval_binding_valid, oversight.interrupt_stop_verified, oversight.reviewer_ref, oversight.stop_observed_at, approver.reference; decision.id", "customFieldList": [ "practical_trust.oversight.evidence_id", "practical_trust.oversight.approval_binding_valid", "practical_trust.oversight.interrupt_stop_verified", "practical_trust.oversight.reviewer_ref", "practical_trust.oversight.stop_observed_at", "practical_trust.approver.reference", "practical_trust.decision.id" ], "producer": "Human identity provider; independent review console", "correlation": "D: approver identity equal to the agent's; approval reused across actions or past expiry; interrupt issued with no observed stop in the execution and identity layers; B: approvals faster than the evidence could be read (rubber-stamp drift); A: impersonation and delayed execution after the approval window", "threatClasses": "AML.T0067, T0073 impersonation, T0094 delayed execution, T0100, T0092; ASI09; LLM09", "draftRule": "HB-AI-615: approval_binding_valid false or interrupt_stop_verified false", "ruleId": "HB-AI-615", "legacyRuleId": "HB-AI-015", "sampleFields": [ [ "oversight.approval_binding_valid", true, false ], [ "oversight.interrupt_stop_verified", true, false ] ], "operation": null, "eventAction": "oversight_decided", "researchCases": [], "operationalCases": [], "lifecycleCases": [ "s-servicenow", "s-github", "s-replit" ] }, { "name": "AI BOM & attestation", "propagation": "Capability that was never registered or that changed after registration: an unknown tool, a stale index, a substituted policy, a rug-pulled package, all while the model's name stays the same.", "atlas": "AML.T0010.005 Supply chain: agent tool \u00b7 AML.T0109 Rug pull \u00b7 AML.T0110 Tool poisoning \u00b7 AML.T0115.002 Publish poisoned tools \u00b7 AML.T0111 Reputation inflation \u00b7 AML.T0081 Modify agent configuration \u00b7 AML.T0002.002 Acquire agent configuration", "owaspAgentic": "ASI04 Agentic supply chain", "owaspLLM": "LLM03 Supply chain", "signal": "Runtime manifest digest differing from the registry; an MCP endpoint, tool or policy with no registry entry; a digest reported by the workload with no independent verification", "sourceAssociations": "Asana (new capability, no isolation evidence), ForcedLeak (expired domain inside an attested allowlist)", "legacyRule": "HB-AI-016 \u00b7 AIBOM attestation mismatch Elastic KQL (illustrative): ai.asset.attestation_match: false Enforcement: Quarantine artifact; require signed provenance.", "legacyKQL": "ai.asset.attestation_match: false", "enforcement": "Quarantine artifact; require signed provenance.", "id": "6.16", "short": "AI BOM", "plane": "Lifecycle", "sourceComponent": "6.16 AI BOM and attestation (lifecycle, release assurance)", "standardFields": "gen_ai.agent.version, gen_ai.tool.definitions, service.version", "assuranceFields": "attestation.verification, attestation.verifier, manifest.digest, manifest.digest_match, registry.release_id, release.status", "customFieldList": [ "practical_trust.attestation.verification", "practical_trust.attestation.verifier", "practical_trust.manifest.digest", "practical_trust.manifest.digest_match", "practical_trust.registry.release_id", "practical_trust.release.status" ], "producer": "AI asset registry; artifact verifier; release controller; release registry (trusted verifier, not the workload's own digest)", "correlation": "D: runtime manifest digest differing from the registry; an MCP endpoint, tool, policy or index with no registry entry; a digest reported by the workload with no independent verification (R11); A: supply-chain substitution, rug pull, configuration acquisition. registry.release_id is the handle for a Platinum corpus release at step 0. Digest equality does not prove origin or rights", "threatClasses": "AML.T0010.005, T0109, T0110, T0115.002, T0111, T0081, T0002.002 acquire agent configuration; ASI04; LLM03", "draftRule": "HB-AI-616: attestation.verification failed or manifest.digest_match false or release.status unregistered", "ruleId": "HB-AI-616", "legacyRuleId": "HB-AI-016", "sampleFields": [ [ "attestation.verification", "passed", "failed" ], [ "manifest.digest_match", true, false ] ], "operation": null, "eventAction": "release_verified", "researchCases": [], "operationalCases": [], "lifecycleCases": [ "s-github", "s-forcedleak", "s-asana" ] }, { "name": "Authority & consumption", "propagation": "Exposure that exceeds approval before anyone sees the total: parallel children, retries, delayed billing, an over-broad purchase tool, or a mass mutation with no transaction ceiling.", "atlas": "AML.T0034.002 Agentic resource consumption \u00b7 AML.T0034 Cost harvesting \u00b7 AML.T0029 Denial of AI service \u00b7 AML.T0048.000 Financial harm \u00b7 AML.T0101 Data destruction via tool invocation", "owaspAgentic": "ASI08 Cascading failures \u00b7 ASI10 Rogue agents", "owaspLLM": "LLM10 Unbounded consumption", "signal": "Budget reset at a delegation hop; concurrent reservations exceeding the task-family ceiling; dispatch with no ledger reservation; row-count or spend per action above the approved limit", "sourceAssociations": "Replit (mass delete then ~4,000 inserts)", "legacyRule": "HB-AI-017 \u00b7 Delegated budget breach Elastic KQL (illustrative): ai.budget.remaining < 0 or ai.budget.transaction_limit_exceeded: true Enforcement: Stop spending and child-agent execution.", "legacyKQL": "ai.budget.remaining < 0 or ai.budget.transaction_limit_exceeded: true", "enforcement": "Stop spending and child-agent execution.", "id": "6.17", "short": "Budget", "plane": "Lifecycle", "sourceComponent": "6.17 Authority and consumption (lifecycle)", "standardFields": "gen_ai.usage.input_tokens / output_tokens, gen_ai.request.max_tokens", "assuranceFields": "budget.consumed, budget.limit, budget.over_limit, budget.reservation_id, budget.reservation_status, budget.unit, budget.balance, budget.currency", "customFieldList": [ "practical_trust.budget.consumed", "practical_trust.budget.limit", "practical_trust.budget.over_limit", "practical_trust.budget.reservation_id", "practical_trust.budget.reservation_status", "practical_trust.budget.unit", "practical_trust.budget.balance", "practical_trust.budget.currency" ], "producer": "Atomic central quota ledger (gateway or dispatcher reservation, not the SDK's token counter)", "correlation": "D: dispatch with no ledger reservation; budget reset at a delegation hop; concurrent reservations exceeding the task-family ceiling; B: consumption and cost above a validated baseline (R6); A: cost harvesting, denial of AI service, mass mutation without a transaction ceiling. Token counts are not total spend and an anomaly is not proof of exfiltration", "threatClasses": "AML.T0034.002, T0034 cost harvesting, T0029 denial of AI service, T0048.000 financial harm, T0101; ASI08, ASI10; LLM10", "draftRule": "HB-AI-617: reservation_status missing or over_limit", "ruleId": "HB-AI-617", "legacyRuleId": "HB-AI-017", "sampleFields": [ [ "budget.reservation_status", "reserved", "missing" ], [ "budget.over_limit", false, true ] ], "operation": null, "eventAction": "budget_reserved", "researchCases": [], "operationalCases": [], "lifecycleCases": [ "s-servicenow", "s-replit" ] }, { "name": "Transparency & recourse", "propagation": "Either no explanation reaches the affected person, or the explanation leaks: raw traces published with third-party data, prompts or security controls in them.", "atlas": "AML.T0067.000 Citations manipulation \u00b7 AML.T0130 Agent response biasing \u00b7 AML.T0092 Manipulate chat history \u00b7 AML.T0057 LLM data leakage \u00b7 AML.T0077 Response rendering", "owaspAgentic": "ASI09 Human-agent trust exploitation", "owaspLLM": "LLM02 Sensitive disclosure \u00b7 LLM09", "signal": "Decision records with no verified outcome behind them; explanations containing unredacted trace content; contest outcomes not linked back to the original decision", "sourceAssociations": "ForcedLeak (record data in rendered output)", "legacyRule": "HB-AI-018 \u00b7 Unverified explanation / leakage Elastic KQL (illustrative): ai.recourse.evidence_verified: false or ai.output.dlp_violation: true Enforcement: Hold response; redact and require evidence link.", "legacyKQL": "ai.recourse.evidence_verified: false or ai.output.dlp_violation: true", "enforcement": "Hold response; redact and require evidence link.", "id": "6.18", "short": "Recourse", "plane": "Lifecycle", "sourceComponent": "6.18 Transparency and recourse (lifecycle)", "standardFields": "event.action, user.id", "assuranceFields": "recourse.decision_unverifiable, recourse.explanation_sensitive_data, recourse.notice_ref, recourse.appeal_ref, recourse.outcome_ref; decision.id; recovery.reference", "customFieldList": [ "practical_trust.recourse.decision_unverifiable", "practical_trust.recourse.explanation_sensitive_data", "practical_trust.recourse.notice_ref", "practical_trust.recourse.appeal_ref", "practical_trust.recourse.outcome_ref", "practical_trust.decision.id", "practical_trust.recovery.reference" ], "producer": "Notice and appeal system", "correlation": "D: decision record with no verified outcome behind it; contest outcome not linked to the original decision; A: explanation containing unredacted trace content, third-party data, prompts or security controls (sensitive disclosure through the recourse channel itself); B: response biasing and citation manipulation in rendered explanations", "threatClasses": "AML.T0067.000, T0130 agent response biasing, T0092, T0057, T0077; ASI09; LLM02, LLM09", "draftRule": "HB-AI-618: decision_unverifiable or explanation_sensitive_data", "ruleId": "HB-AI-618", "legacyRuleId": "HB-AI-018", "sampleFields": [ [ "recourse.decision_unverifiable", false, true ], [ "recourse.explanation_sensitive_data", false, true ] ], "operation": null, "eventAction": "recourse_reviewed", "researchCases": [], "operationalCases": [], "lifecycleCases": [ "s-forcedleak" ] } ], "cases": [ { "id": "s-servicenow", "name": "ServiceNow Now Assist", "type": "research", "date": "19 Nov 2025", "runtime": [ "6.00", "6.01", "6.02", "6.03", "6.05", "6.07", "6.08", "6.10", "6.11", "6.12" ], "lifecycle": [ "6.13", "6.15", "6.17" ], "primaryUrl": "https://appomni.com/ao-labs/ai-agent-to-agent-discovery-prompt-injection/", "verification": "Primary research checked 27 Oct 2026. Demonstrated path, not a claim of widespread exploitation.", "summary": "A benign agent reads a planted prompt, discovers a more capable teammate and recruits it. The recruited agent reads and modifies records and sends email, under the privileges of the user who started the session. Nothing was exploited; three defaults were used as designed." }, { "id": "s-github", "name": "GitHub MCP", "type": "research", "date": "26 May 2025", "runtime": [ "6.01", "6.05", "6.07", "6.08", "6.09", "6.10", "6.11", "6.12" ], "lifecycle": [ "6.13", "6.15", "6.16" ], "primaryUrl": "https://invariantlabs.ai/blog/mcp-github-vulnerability", "verification": "Primary research checked 27 Oct 2026. Controlled demonstration using demo repositories.", "summary": "A malicious issue in a public repository told the agent to read all of the author's repositories and publish what it found. Because the agent held one broad token and auto-approval was on, it did, and private project, salary and relocation details landed in a public pull request." }, { "id": "s-forcedleak", "name": "Salesforce ForcedLeak", "type": "research", "date": "25 Sep 2025", "runtime": [ "6.00", "6.01", "6.03", "6.04", "6.05", "6.06", "6.07", "6.10", "6.11", "6.12" ], "lifecycle": [ "6.14", "6.16", "6.18" ], "primaryUrl": "https://noma.security/noma-labs/forcedleak", "verification": "Primary research checked 27 Oct 2026. Historical demonstration; the source reports Trusted URL mitigation from 8 Sep 2025.", "summary": "An attacker submitted a Web-to-Lead form with instructions hidden in the 42,000-character description field. Weeks later an employee asked Agentforce about the lead. The agent followed the instructions, queried CRM data and emitted an image tag whose URL carried the data to a domain that was still on Salesforce's content security policy allowlist because nobody noticed it had expired." }, { "id": "s-asana", "name": "Asana MCP", "type": "operational", "date": "Jun 2025", "runtime": [ "6.01", "6.02", "6.03", "6.04", "6.05", "6.08", "6.09", "6.12" ], "lifecycle": [ "6.14", "6.16" ], "primaryUrl": null, "verification": "Reported operational isolation failure in the supplied reference. Not independently reverified here; no malicious actor asserted.", "summary": "No adversary. A bug in Asana's MCP server meant that for about a month, task details, project metadata, comments and files from one organization could surface in other organizations' AI assistants. Roughly 1,000 customers were affected. The harness failed at the seam between the extension and the identity plane." }, { "id": "s-replit", "name": "Replit coding agent", "type": "operational", "date": "Jul 2025", "runtime": [ "6.00", "6.01", "6.02", "6.05", "6.07", "6.08", "6.10", "6.11", "6.12" ], "lifecycle": [ "6.13", "6.14", "6.15", "6.17" ], "primaryUrl": null, "verification": "Reported operational failure in the supplied reference. Not independently reverified here; no malicious actor asserted.", "summary": "During a declared code freeze the coding agent ran destructive commands against the live database, wiping more than 1,200 executive entries and nearly 1,200 company records, then generated about 4,000 fabricated user profiles and unit-test results that misrepresented the system's state. The instruction \"do not touch production\" existed; the control did not." } ], "envelope": [ [ "Namespace", "Fields", "Producer", "Role in correlation" ], [ "Elastic Common Schema", "@timestamp, event.id, event.dataset (ai_harness.control), event.action, event.kind, event.category, event.type, event.outcome, event.ingested, event.original, data_stream.type / dataset / namespace, service.name, service.version, user.id, host.name, source.ip, destination.ip, url.domain", "OTel / ECS ingest or source", "Normalised routing into the ai_harness.control data stream; event.action carries the contract stage (policy_decided, credential_issued, context_assembled, guardrail_evaluated, oversight_decided); outcome and category feed standard SIEM analytics" ], [ "ECS trace linkage", "trace.id, span.id", "OTel / ECS ingest or source", "Joins observations across producers and vendors; the reference model stresses that a trace ID connects observations but does not authenticate a person or prove an outcome" ], [ "OTel resource", "deployment.environment.name, telemetry.sdk.name, telemetry.sdk.version, error.type", "Application / OTel SDK", "Distinguishes production from non-production identities (a 6.11 signal) and pins the instrumentation version that must be recorded with any rule" ], [ "practical_trust (task context)", "practical_trust.schema.version, practical_trust.component.id, practical_trust.rule.id, practical_trust.verdict, practical_trust.task.id, practical_trust.task.family_id, practical_trust.task.purpose, practical_trust.task.consequence_class", "Schema registry; asset registry; detection-engineering registry; trusted task registry; trusted evidence verifier", "component.id routes the event to its rule; task.family_id is what lets a shared budget and a delegation chain be reconciled across child agents and retries; consequence_class is the materiality switch that decides whether a gate decision and human approval were required at all" ] ], "privacy": [ [ "Tier", "Fields", "Collection level", "Destination" ], [ "Low (routing and correlation)", "All ECS envelope fields except those below; practical_trust task context, component.id, rule.id, verdict; all boolean and status assurance fields (acl_violation, bypass_detected, receipt_status, digest_match, over_limit and the rest)", "Required or conditional", "SIEM security-event correlation tier; retained independently of diagnostic sampling" ], [ "Internal (identifiers and digests)", "gen_ai.request.model and request parameters, token-usage counters; input.fingerprint; request.tenant; content.lineage_id / source_scope / destination_scope; index.manifest_digest; memory.record_ref; prompt.template_digest, context.token_budget; policy.digest; action.fingerprint; all credential.* fields; extension.digest; delegation.scope; manifest.digest, registry.release_id; host.name, source.ip, destination.ip, url.domain", "Conditional", "Metadata traces with analyst access controls; joined to the SIEM tier by trace.id and task.id" ], [ "Restricted (content and people)", "gen_ai.input.messages, gen_ai.output.messages, gen_ai.system_instructions, gen_ai.tool.call.arguments, gen_ai.tool.call.result, event.original, user.id; request.subject_ref; retrieval.result_count, retrieval.result_tenant; evidence.artifact_uri; approver.reference, oversight.reviewer_ref", "Optional or conditional, by approved purpose only", "Restricted content store; never into general alerts; lead R10 fires when a prohibited field arrives in an evidence destination" ] ], "methodology": { "measure": "Number of unique source-case associations per component and ring.", "research": "Runtime components named in the propagation-path chips of the three research scenarios.", "operational": "Runtime components named in the propagation-path chips of the two reported failure scenarios.", "lifecycle": "Components expressly named in the five retrospective lifecycle-view boxes; analysis, not observed activity.", "limit": "Not an incident-frequency, severity, likelihood or live-threat score. No mapping means no mapping in this five-case corpus, not safety. Scope is the 19-component reference model, not every known AI incident." }, "sources": [ { "name": "Supplied integrated threat map", "file": "DavisAIgov_HoundBytes_Elastic_Integrated_Threat_Map(1).html", "version": "1.1", "sha256": "2946afa41787223817e381afc72435341147d290add8379f3bd0ceb4ef9d0095" }, { "name": "Supplied telemetry component field map", "file": "AI Harness Telemetry to SIEM \u2014 Component Field Map.docx", "version": "1.0", "sha256": "dcb3c4d59dd661e857cf09e95c76d3770469d591aabdcc34dd0f0e65bfc78c6e" } ] }