@waratahlabs/canopy 0.5.0

package/dist/references/acsc-risks.js

@@ -0,0 +1,232 @@
+/**
+ * ACSC Agentic AI Risk Taxonomy
+ *
+ * Source: "Careful adoption of agentic AI services" (2025)
+ * Authors: Australian Signals Directorate's Australian Cyber Security Centre (ACSC),
+ *          US Cybersecurity and Infrastructure Security Agency (CISA),
+ *          US National Security Agency (NSA),
+ *          Canadian Centre for Cyber Security (Cyber Centre),
+ *          New Zealand National Cyber Security Centre (NCSC-NZ),
+ *          UK National Cyber Security Centre (NCSC-UK / GCHQ)
+ * URL: https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services
+ */
+import { buildHelpers } from "./registry.js";
+export const ACSC_RISKS = [
+    // ── PRIVILEGE ──────────────────────────────────────────────────────────────
+    {
+        id: "acsc-priv-compromise-scope-creep",
+        framework: "acsc",
+        category: "Privilege",
+        name: "Privilege compromise and scope creep",
+        riskType: "security",
+        description: "An agent gains more access rights than necessary for its function, through misconfiguration, overly broad entitlements, or unintended role inheritance. Compromised low-privilege agents can inherit excessive privileges from trusted peers, enabling cascading privilege escalation across the agent network.",
+        aivssMetrics: ["DC", "CS", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0070", // Influence operations via compromised agents
+            "AML.T0056", // Discover ML artifacts (recon enabling privilege abuse)
+        ],
+        sourceSection: "Agentic AI security risks > Privilege risks > Privilege compromise and scope creep",
+    },
+    {
+        id: "acsc-priv-identity-spoofing",
+        framework: "acsc",
+        category: "Privilege",
+        name: "Identity spoofing and agent impersonation",
+        riskType: "security",
+        description: "A malicious actor impersonates an agent or hijacks its credentials (static keys, shared tokens). Operating under a trusted agent identity enables invocation of sensitive operations, bypass of behavioural guardrails, and audit logs that appear legitimate — delaying detection.",
+        aivssMetrics: ["CS", "DC", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0069", // Discover ML model family (recon enabling targeted impersonation)
+            "AML.T0084", // Infer training data membership (credential-adjacent recon)
+        ],
+        sourceSection: "Agentic AI security risks > Privilege risks > Identity spoofing and agent impersonation",
+    },
+    // ── DESIGN AND CONFIGURATION ───────────────────────────────────────────────
+    {
+        id: "acsc-design-static-permissions",
+        framework: "acsc",
+        category: "Design and Configuration",
+        name: "Static permissions and poor segmentation",
+        riskType: "security",
+        description: "Entitlements evaluated once at startup rather than per-request allow malicious actors to exploit stale 'allow' decisions. Poor segmentation between agent enclaves enables lateral movement: a compromise in one enclave pivots into adjacent agents with higher trust.",
+        aivssMetrics: ["DC", "GV", "CS"],
+        atlasTechniqueIds: [
+            "AML.T0010", // ML supply chain compromise (third-party components exploiting static trust)
+        ],
+        sourceSection: "Agentic AI security risks > Design and configuration risks",
+    },
+    {
+        id: "acsc-design-third-party-components",
+        framework: "acsc",
+        category: "Design and Configuration",
+        name: "Unvetted third-party components",
+        riskType: "security",
+        description: "Third-party tools or agents integrated without privilege review may carry excessive or unintended permissions. Dynamic package loading increases exposure to untrusted code. Tool squatting — publishing malicious tools with legitimate-sounding names — is a specific attack vector.",
+        aivssMetrics: ["CS", "GV", "LL"],
+        atlasTechniqueIds: [
+            "AML.T0010", // ML supply chain compromise
+            "AML.T0115.000", // Publish poisoned AI artifacts: datasets (analogue: publish malicious tools)
+        ],
+        sourceSection: "Agentic AI security risks > Design and configuration risks",
+    },
+    // ── BEHAVIOUR ──────────────────────────────────────────────────────────────
+    {
+        id: "acsc-behaviour-goal-misalignment",
+        framework: "acsc",
+        category: "Behaviour",
+        name: "Goal misalignment and specification gaming",
+        riskType: "security",
+        description: "Agents may pursue objectives in ways developers did not anticipate — finding loopholes that technically achieve goals while violating intent or creating security vulnerabilities (e.g. disabling security updates to maximise uptime). Over-optimisation can drive extreme or unsafe actions when boundaries are not clearly enforced.",
+        aivssMetrics: ["AA", "AD", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0054", // LLM jailbreak (boundary violation enabling goal gaming)
+            "AML.T0051", // LLM prompt injection (instruction override enabling misalignment)
+        ],
+        sourceSection: "Agentic AI security risks > Behaviour risks > Goal misalignment and unintended behaviour",
+    },
+    {
+        id: "acsc-behaviour-deceptive",
+        framework: "acsc",
+        category: "Behaviour",
+        name: "Deceptive behaviour",
+        riskType: "security",
+        description: "Agents optimised for performance on evaluation sets may adapt behaviour specifically during evaluation ('awareness'). Some AI systems demonstrate strategic deception — misrepresenting actions to avoid shutdown or concealing vulnerabilities instead of reporting them.",
+        aivssMetrics: ["AA", "GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Behaviour risks > Deceptive behaviour",
+    },
+    {
+        id: "acsc-behaviour-emergent-capabilities",
+        framework: "acsc",
+        category: "Behaviour",
+        name: "Emergent capabilities and unpredictable behaviour",
+        riskType: "security",
+        description: "Complex AI models interacting with real-world systems may develop capabilities designers did not explicitly program. In multi-agent environments, agent interactions can evolve in ways leading to instability. Agents may chain tools in unanticipated sequences, amplifying minor errors into major operational or security issues.",
+        aivssMetrics: ["AA", "AD", "DC"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Behaviour risks > Emergent capabilities and unpredictable behaviour",
+    },
+    {
+        id: "acsc-behaviour-malicious-exploitation",
+        framework: "acsc",
+        category: "Behaviour",
+        name: "Malicious exploitation via prompt injection and data poisoning",
+        riskType: "security",
+        description: "Prompt injection and jailbreaks trick agents into executing unauthorised actions. Data poisoning corrupts training data to degrade or bias decision-making. Adversarial examples cause misclassification in critical security contexts. A compromised AI agent can operate as an insider threat, exfiltrating data or disabling defences while appearing functional.",
+        aivssMetrics: ["MR", "DS", "CS"],
+        atlasTechniqueIds: [
+            "AML.T0051", // LLM prompt injection
+            "AML.T0054", // LLM jailbreak
+            "AML.T0020", // Poison training data
+            "AML.T0018", // Backdoor ML model
+        ],
+        sourceSection: "Agentic AI security risks > Behaviour risks > Malicious exploitation and behaviour",
+    },
+    // ── STRUCTURAL ─────────────────────────────────────────────────────────────
+    {
+        id: "acsc-structural-orchestration-dos",
+        framework: "acsc",
+        category: "Structural",
+        name: "Orchestration overload and sponge attacks",
+        riskType: "security",
+        description: "Poor orchestration configuration enables denial-of-service and sponge attacks — deliberately consuming excessive compute, memory, or API calls to exhaust system capacity. Cascading hallucinations propagate through the agent network, producing poor outputs from downstream components that accept upstream results as true.",
+        aivssMetrics: ["DC", "CS"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Structural risks > Orchestration and resources",
+    },
+    {
+        id: "acsc-structural-tool-misuse",
+        framework: "acsc",
+        category: "Structural",
+        name: "Tool misuse and misleading tool descriptions",
+        riskType: "security",
+        description: "Two-way tool integration allows tools to send potentially arbitrary instructions back to the LLM. Misleading tool descriptions cause agents to select tools unreliably, with persuasive descriptions chosen more often. Agents loading new packages dynamically increase exposure to untrusted code.",
+        aivssMetrics: ["CS", "DC", "AA"],
+        atlasTechniqueIds: [
+            "AML.T0080", // LLM meta-prompt extraction (tool description manipulation)
+        ],
+        sourceSection: "Agentic AI security risks > Structural risks > Tool use",
+    },
+    {
+        id: "acsc-structural-rogue-agents",
+        framework: "acsc",
+        category: "Structural",
+        name: "Rogue agents and multi-agent cascading failure",
+        riskType: "security",
+        description: "In multi-agent systems, a single compromised agent can cause cascading failures by spreading incorrect information, exploiting trust and consensus mechanisms, or operating through hidden channels. Supply chain tampering, poisoned environments, credential theft, communication poisoning, and coordination exploits can weaponise agents to propagate malicious plans peer-to-peer.",
+        aivssMetrics: ["CS", "AA", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0080", // Influence operations via agent network
+            "AML.T0010", // ML supply chain compromise
+        ],
+        sourceSection: "Agentic AI security risks > Structural risks > Rogue agents",
+    },
+    {
+        id: "acsc-structural-communication",
+        framework: "acsc",
+        category: "Structural",
+        name: "Insecure inter-agent communication",
+        riskType: "security",
+        description: "Agents using insecure protocols or authentication expose communications to eavesdropping, replay, and spoofing. Altered or replayed messages between agentic components enable command injection, compromising receiving components and reducing availability. Data and instructions exfiltrated via tool calls may go undetected.",
+        aivssMetrics: ["CS", "DC"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Structural risks > Communication",
+    },
+    // ── ACCOUNTABILITY ─────────────────────────────────────────────────────────
+    {
+        id: "acsc-accountability-opacity",
+        framework: "acsc",
+        category: "Accountability",
+        name: "Action and decision-making opacity",
+        riskType: "compliance",
+        description: "Agent decision processes are opaque, making agentic AI systems difficult to monitor and audit. Increased autonomy introduces sub-agent spawning and extended delegation chains not always visible to operators. Even identical prompts may produce different actions due to stochastic model behaviour, complicating reproducibility and assurance.",
+        aivssMetrics: ["GV", "LL", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Accountability risks > Actions and processes",
+    },
+    {
+        id: "acsc-accountability-hallucination",
+        framework: "acsc",
+        category: "Accountability",
+        name: "Accuracy limitations and hallucination",
+        riskType: "ethical",
+        description: "LLMs may incorrectly interpolate or hallucinate plausible-sounding responses when internal knowledge is insufficient. In agentic systems operating in critical roles, hallucinated outputs propagate downstream and are accepted as ground truth by subsequent agents, compounding inaccuracy without detection.",
+        aivssMetrics: ["AA", "EI", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Accountability risks > Accuracy",
+    },
+    {
+        id: "acsc-accountability-visibility",
+        framework: "acsc",
+        category: "Accountability",
+        name: "Monitoring visibility gaps",
+        riskType: "compliance",
+        description: "Agentic system processes can outpace human monitoring capability. Tools performing actions for an agentic system may operate outside the system's monitoring boundary. Malicious or compromised agents may use tools as a stealthy exfiltration channel. Long reasoning chains and large contextual data create substantial log sizes with low signal density.",
+        aivssMetrics: ["GV", "LL"],
+        atlasTechniqueIds: [],
+        sourceSection: "Agentic AI security risks > Accountability risks > Visibility",
+    },
+];
+export const ACSC_CITATION = {
+    id: "acsc",
+    title: "Careful adoption of agentic AI services",
+    year: 2025,
+    authors: [
+        "Australian Signals Directorate's Australian Cyber Security Centre (ACSC)",
+        "US Cybersecurity and Infrastructure Security Agency (CISA)",
+        "US National Security Agency (NSA)",
+        "Canadian Centre for Cyber Security (Cyber Centre)",
+        "New Zealand National Cyber Security Centre (NCSC-NZ)",
+        "UK National Cyber Security Centre (NCSC-UK / GCHQ)",
+    ],
+    url: "https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services",
+};
+export const { getRisksForMetric, getRisksByType, getRiskById } = buildHelpers(ACSC_RISKS);
+export const ACSC_ADAPTER = {
+    citation: ACSC_CITATION,
+    risks: ACSC_RISKS,
+    getRisksForMetric,
+    getRisksByType,
+    getRiskById,
+};
+//# sourceMappingURL=acsc-risks.js.map

package/dist/references/acsc-risks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acsc-risks.js","sourceRoot":"","sources":["../../src/references/acsc-risks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,CAAC,MAAM,UAAU,GAAoB;IACzC,8EAA8E;IAE9E;QACE,EAAE,EAAE,kCAAkC;QACtC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,sCAAsC;QAC5C,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,iTAAiT;QACnT,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,8CAA8C;YAC3D,WAAW,EAAE,yDAAyD;SACvE;QACD,aAAa,EAAE,oFAAoF;KACpG;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,2CAA2C;QACjD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,qRAAqR;QACvR,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,mEAAmE;YAChF,WAAW,EAAE,6DAA6D;SAC3E;QACD,aAAa,EAAE,yFAAyF;KACzG;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,0BAA0B;QACpC,IAAI,EAAE,0CAA0C;QAChD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,yQAAyQ;QAC3Q,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,8EAA8E;SAC5F;QACD,aAAa,EAAE,4DAA4D;KAC5E;IACD;QACE,EAAE,EAAE,oCAAoC;QACxC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,0BAA0B;QACpC,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,wRAAwR;QAC1R,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,6BAA6B;YAC1C,eAAe,EAAE,8EAA8E;SAChG;QACD,aAAa,EAAE,4DAA4D;KAC5E;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,kCAAkC;QACtC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,4CAA4C;QAClD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,yUAAyU;QAC3U,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,0DAA0D;YACvE,WAAW,EAAE,oEAAoE;SAClF;QACD,aAAa,EAAE,0FAA0F;KAC1G;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,4QAA4Q;QAC9Q,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,mEAAmE;KACnF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,mDAAmD;QACzD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,uUAAuU;QACzU,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iGAAiG;KACjH;IACD;QACE,EAAE,EAAE,uCAAuC;QAC3C,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,gEAAgE;QACtE,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,sWAAsW;QACxW,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,uBAAuB;YACpC,WAAW,EAAE,gBAAgB;YAC7B,WAAW,EAAE,uBAAuB;YACpC,WAAW,EAAE,oBAAoB;SAClC;QACD,aAAa,EAAE,oFAAoF;KACpG;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,mCAAmC;QACvC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,2CAA2C;QACjD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,kUAAkU;QACpU,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,4EAA4E;KAC5F;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,8CAA8C;QACpD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,sSAAsS;QACxS,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,6DAA6D;SAC3E;QACD,aAAa,EAAE,yDAAyD;KACzE;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,gDAAgD;QACtD,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,0XAA0X;QAC5X,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,yCAAyC;YACtD,WAAW,EAAE,6BAA6B;SAC3C;QACD,aAAa,EAAE,6DAA6D;KAC7E;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,UAAU;QACpB,WAAW,EACT,oUAAoU;QACtU,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,8DAA8D;KAC9E;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,YAAY;QACtB,WAAW,EACT,qVAAqV;QACvV,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,0EAA0E;KAC1F;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,wCAAwC;QAC9C,QAAQ,EAAE,SAAS;QACnB,WAAW,EACT,kTAAkT;QACpT,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6DAA6D;KAC7E;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,YAAY;QACtB,WAAW,EACT,gWAAgW;QAClW,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,+DAA+D;KAC/E;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,yCAAyC;IAChD,IAAI,EAAE,IAAI;IACV,OAAO,EAAE;QACP,0EAA0E;QAC1E,4DAA4D;QAC5D,mCAAmC;QACnC,mDAAmD;QACnD,sDAAsD;QACtD,oDAAoD;KACrD;IACD,GAAG,EAAE,4HAA4H;CAClI,CAAC;AAEF,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,GAC7D,YAAY,CAAC,UAAU,CAAC,CAAC;AAE3B,MAAM,CAAC,MAAM,YAAY,GAA6C;IACpE,QAAQ,EAAE,aAAa;IACvB,KAAK,EAAE,UAAU;IACjB,iBAAiB;IACjB,cAAc;IACd,WAAW;CACZ,CAAC"}

package/dist/references/aicm.d.ts

@@ -0,0 +1,41 @@
+/**
+ * CSA AI Controls Matrix (AICM) v1.1.1
+ *
+ * Source: "AI Controls Matrix" (AICM v1.1.1) + "AI CAIQ" v1.1.0
+ * Author: Cloud Security Alliance (CSA)
+ * URL: https://cloudsecurityalliance.org/artifacts/ai-controls-matrix
+ * Machine-readable bundle: https://cloudsecurityalliance.org/artifacts/aicm-machine-readable-bundle-json-yaml-oscal
+ * Published: 2026-07-22 (OSCAL/JSON/YAML bundle generation date)
+ *
+ * AICM extends CSA's Cloud Controls Matrix (CCM) with AI-specific controls across
+ * 18 domains and 247 total controls, each tagged by `control_type`:
+ * "AI-Specific" (novel to AICM), "Cloud & AI Related" (CCM controls with AI-relevant
+ * scope extensions), or "Cloud-Specific" (unmodified CCM — out of scope here).
+ *
+ * Sub-set selection rationale (mirrors the NIST AI RMF adapter's precedent — curate
+ * to the agentic-AI-security use case rather than transcribe every control verbatim):
+ * this adapter covers the 31 controls CSA itself tags "AI-Specific" — the layer AICM
+ * actually adds beyond cloud security baseline, and the layer with the tightest
+ * correspondence to AIVSS metrics and ATLAS technique coverage. The 200 "Cloud & AI
+ * Related" and 15 "Cloud-Specific" controls are general cloud-security hygiene
+ * (already covered by CCM/ISO 27017 territory) with no direct agentic-AI-specific
+ * finding to contribute; omitting them keeps this adapter's findings load-bearing
+ * rather than diluted by generic cloud controls with an AI label attached.
+ *
+ * AIVSS metric mapping rationale:
+ * - AIS (agent/app boundary, sandboxing, cache, prompt differentiation) → AA, CS, MR
+ * - DSP (poisoning, PETs, data integrity/relevance) → MR, DS, LL
+ * - GRC (acceptable use, impact/bias/ethics assessment, explainability, oversight) → EI, GV, DC
+ * - HRS (competency + acceptable-use training) → GV
+ * - IAM (output-modification authorization) → GV, CS
+ * - LOG (input/output monitoring) → AA, GV
+ * - MDS (model documentation, adversarial analysis/hardening, integrity, failure, open-model risk) → MR, AA, LL, DC
+ * - STA (service BOM) → LL, CS
+ * - TVM (threat modelling, guardrails) → AA, GV
+ */
+import { type FrameworkRisk, type FrameworkCitation, type FrameworkAdapter } from "./registry.js";
+declare const AICM_RISKS: FrameworkRisk[];
+export declare const AICM_CITATION: FrameworkCitation;
+export declare const AICM_ADAPTER: FrameworkAdapter;
+export { AICM_RISKS };
+//# sourceMappingURL=aicm.d.ts.map

package/dist/references/aicm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aicm.d.ts","sourceRoot":"","sources":["../../src/references/aicm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAEtB,MAAM,eAAe,CAAC;AAkbvB,QAAA,MAAM,UAAU,EAAE,aAAa,EAU9B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,iBAO3B,CAAC;AAIF,eAAO,MAAM,YAAY,EAAE,gBAI1B,CAAC;AAEF,OAAO,EAAE,UAAU,EAAE,CAAC"}