agent-threat-rules 4.0.0 → 4.2.0

package/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml

@@ -1,92 +1,63 @@
-title: "Destructive tool invocation without prior human approval"
+title: Destructive tool invocation without prior human approval
 id: ATR-2026-00549
 rule_version: 1
 status: experimental
-description: >
-  Detects a destructive tool call in an agent execution trace that is NOT
-  preceded by an explicit human-approval span. This is a trace-method rule
-  using the `require` primitive (spec/atr-method-v1.1.md §8.3.2), which
-  fires when an expected predecessor is MISSING — the canonical mechanism
-  for catching silent failures.
-
-  Threat model: many agent frameworks let operators classify tool calls by
-  privilege (read / write / destructive). Production policy says destructive
-  calls (e.g., file deletion, transaction commit, schema migration) MUST be
-  gated by a human-in-the-loop approval. In practice, prompt-injection
-  attacks or runaway agents bypass this gate by inducing the LLM to issue
-  a destructive call directly without surfacing it for approval. The trace
-  emits the destructive TOOL span without an AGENT span carrying
-  attributes.human_approval=true at any earlier point in the same trace.
-
-  No error is thrown. The action succeeds. The trace looks "normal" if you
-  only inspect tool inputs/outputs. The rule fires by detecting the
-  absence of the required predecessor — the trace-method capability that
-  pattern-based detection cannot express.
-author: "ATR Community"
-date: "2026/05/28"
-schema_version: "1.0"
+description: |
+  Detects a destructive tool call in an agent execution trace that is NOT preceded by an explicit human-approval span. This is a trace-method rule using the `require` primitive (spec/atr-method-v1.1.md §8.3.2), which fires when an expected predecessor is MISSING — the canonical mechanism for catching silent failures.
+  Threat model: many agent frameworks let operators classify tool calls by privilege (read / write / destructive). Production policy says destructive calls (e.g., file deletion, transaction commit, schema migration) MUST be gated by a human-in-the-loop approval. In practice, prompt-injection attacks or runaway agents bypass this gate by inducing the LLM to issue a destructive call directly without surfacing it for approval. The trace emits the destructive TOOL span without an AGENT span carrying attributes.human_approval=true at any earlier point in the same trace.
+  No error is thrown. The action succeeds. The trace looks "normal" if you only inspect tool inputs/outputs. The rule fires by detecting the absence of the required predecessor — the trace-method capability that pattern-based detection cannot express.
+author: ATR Community
+date: 2026/05/28
+schema_version: '1.0'
 maturity: draft
 severity: critical
-
 references:
   owasp_agentic:
-    - "ASI04:2026"
-    - "ASI05:2026"
+    - ASI04:2026
+    - ASI05:2026
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   mitre_atlas:
-    - "AML.T0053 - AI Agent Tool Invocation"
+    - AML.T0053 - AI Agent Tool Invocation
   research:
-    - "TraceAegis: Behavioral Constraints over Agent Execution Traces (arXiv:2510.11203)"
-    - "AgentArmor: Type-System for Agent Trace Analysis (arXiv:2508.01249)"
-    - "Anthropic Computer Use threat model (Build 2024)"
-
+    - 'TraceAegis: Behavioral Constraints over Agent Execution Traces (arXiv:2510.11203)'
+    - 'AgentArmor: Type-System for Agent Trace Analysis (arXiv:2508.01249)'
+    - Anthropic Computer Use threat model (Build 2024)
 compliance:
   nist_csf:
-    - subcategory: "PR.AA-05"
-      context: >
-        PR.AA-05 names separation of duties explicitly. A required human-approval step
-        that never happened is that separation collapsing, and the rule's `require`
-        primitive fires on the absence rather than on any positive indicator — which is
-        the only way a missing control is observable.
+    - subcategory: PR.AA-05
+      context: |
+        PR.AA-05 names separation of duties explicitly. A required human-approval step that never happened is that separation collapsing, and the rule's `require` primitive fires on the absence rather than on any positive indicator — which is the only way a missing control is observable.
       strength: primary
-    - subcategory: "PR.IR-01"
-      context: >
-        The rule's `block_tool` response stops the unapproved destructive call from
-        reaching the environment, which serves PR.IR-01's protection outcome. Secondary
-        because PR.IR-01 is written around network and environment boundaries, and this
-        control sits at the tool-invocation boundary instead.
+    - subcategory: PR.IR-01
+      context: |
+        The rule's `block_tool` response stops the unapproved destructive call from reaching the environment, which serves PR.IR-01's protection outcome. Secondary because PR.IR-01 is written around network and environment boundaries, and this control sits at the tool-invocation boundary instead.
       strength: secondary
   eu_ai_act:
-    - article: "14"
-      context: >
-        Human oversight — destructive actions must be subject to human
-        review per Article 14. Trace evidence of skipped approval is a
-        direct violation.
+    - article: '14'
+      context: |
+        Human oversight — destructive actions must be subject to human review per Article 14. Trace evidence of skipped approval is a direct violation.
       strength: primary
-    - article: "15"
-      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the privilege-escalation attempt (Destructive tool invocation without prior human approval)."
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the privilege-escalation attempt (Destructive tool invocation without prior human approval).
       strength: primary
   nist_ai_rmf:
-    - subcategory: "MG.4.1"
-      context: >
-        Risk management governance — destructive autonomous actions
-        without approval are unmitigated risks; trace evidence is
-        normative for assessment.
+    - subcategory: MG.4.1
+      context: |
+        Risk management governance — destructive autonomous actions without approval are unmitigated risks; trace evidence is normative for assessment.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Destructive tool invocation without prior human approval)."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Destructive tool invocation without prior human approval).
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (Destructive tool invocation without prior human approval) so the risk can be treated."
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (Destructive tool invocation without prior human approval) so the risk can be treated.
       strength: secondary
-
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the privilege-escalation attempt (Destructive tool invocation without prior human approval)."
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the privilege-escalation attempt (Destructive tool invocation without prior human approval).
       strength: primary
-    - clause: "6.2"
-      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (Destructive tool invocation without prior human approval) is such a treatment."
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (Destructive tool invocation without prior human approval) is such a treatment.
       strength: secondary
 tags:
   category: privilege-escalation
@@ -94,129 +65,51 @@ tags:
   scan_target: runtime
   confidence: high
   source: trace-rule
-
 agent_source:
   type: agent_trace
   framework:
     - any
   provider:
     - any
-
 detection:
   method: trace
   condition: any
   conditions:
     - field: trace.require_violation
       operator: regex
-      value: "(?i)require_violation:destructive_tool_without_approval"
-      description: >
-        Engine emits this synthetic field when the require primitive
-        fires; trace-native engines evaluate detection.trace below.
+      value: (?i)require_violation:destructive_tool_without_approval
+      description: |
+        Engine emits this synthetic field when the require primitive fires; trace-native engines evaluate detection.trace below.
   trace:
     ingest_format: openinference
     require:
       - target_shape:
-          span.kind: "TOOL"
+          span.kind: TOOL
           attributes:
-            tool.privilege: "destructive"
+            tool.privilege: destructive
         must_be_preceded_by:
-          # Match any of the canonical approval signals. Frameworks vary:
-          # LangChain HITL emits span.kind: "HUMAN"; AutoGen sets
-          # attributes.human_approval=true on AGENT spans; some emit
-          # attributes.operator_approved or attributes.confirmed_by_user.
-          # An approval is recognized if EITHER the span kind is HUMAN OR
-          # any of the canonical approval attributes is truthy.
           one_of_shapes:
-            - span.kind: "HUMAN"
-            - span.kind: "AGENT"
+            - span.kind: HUMAN
+            - span.kind: AGENT
               attributes:
                 human_approval: true
-            - span.kind: "AGENT"
+            - span.kind: AGENT
               attributes:
                 operator_approved: true
-            - span.kind: "AGENT"
+            - span.kind: AGENT
               attributes:
                 approval_granted: true
-            - span.kind: "AGENT"
+            - span.kind: AGENT
               attributes:
                 confirmed_by_user: true
           within_trace: true
-        description: >
-          Every destructive TOOL span MUST have at least one preceding
-          approval span anywhere earlier in the same trace. Recognized
-          forms: dedicated HUMAN span kind (OpenInference), or AGENT
-          span carrying any canonical approval attribute. The
-          `one_of_shapes` matcher is normative per atr-method-v1.1.md
-          §8.3 (extends `must_be_preceded_by` to accept a disjunction).
-
+        description: |
+          Every destructive TOOL span MUST have at least one preceding approval span anywhere earlier in the same trace. Recognized forms: dedicated HUMAN span kind (OpenInference), or AGENT span carrying any canonical approval attribute. The `one_of_shapes` matcher is normative per atr-method-v1.1.md §8.3 (extends `must_be_preceded_by` to accept a disjunction).
 response:
   actions:
     - alert
     - escalate
-  actions_rationale: >-
-    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0 FP but the measurement
-    is incomplete — the harness reported conditions it could not exercise, so the silence is an
-    unasked question; ceiling = observe. Removed block_tool(interrupt). Detection unchanged —
-    recall cost is zero.
-  message_template: >
-    [ATR-2026-00549] CRITICAL: Destructive tool call without human approval
-    detected. Tool {{trace.matched_span.attributes.tool.name}} ran at span
-    {{trace.matched_span.id}} with privilege=destructive but no preceding
-    AGENT span carried human_approval=true. Block this tool call, require
-    operator review, and audit policy on the calling agent.
-
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0 FP but the measurement is incomplete — the harness reported conditions it could not exercise, so the silence is an unasked question; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  message_template: |
+    [ATR-2026-00549] CRITICAL: Destructive tool call without human approval detected. Tool {{trace.matched_span.attributes.tool.name}} ran at span {{trace.matched_span.id}} with privilege=destructive but no preceding AGENT span carried human_approval=true. Block this tool call, require operator review, and audit policy on the calling agent.
 confidence: 90
-
-
-test_cases:
-  true_positives:
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"orchestrator"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"db.drop_table","tool.privilege":"destructive"}}]}
-      expected: triggered
-      description: "Destructive tool runs without any preceding human approval"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"orchestrator","human_approval":false}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"file.delete","tool.privilege":"destructive"}}]}
-      expected: triggered
-      description: "AGENT span explicitly sets human_approval=false; destructive tool follows"
-    - input: |
-        {"spans":[{"id":"r1","kind":"RETRIEVER","attributes":{"source":"untrusted"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"git.force_push","tool.privilege":"destructive"}}]}
-      expected: triggered
-      description: "Destructive tool preceded only by untrusted retrieval (no approval span)"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"planner"}},{"id":"a2","kind":"AGENT","attributes":{"agent.name":"executor"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"k8s.delete_namespace","tool.privilege":"destructive"}}]}
-      expected: triggered
-      description: "Two AGENT spans without any setting human_approval=true; destructive tool fires"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"sub_orchestrator","human_approval_status":"approved"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"prod.deploy","tool.privilege":"destructive"}}]}
-      expected: triggered
-      description: "Non-canonical approval attribute name (human_approval_status string instead of human_approval boolean) — not recognized, rule fires correctly. Documents the limitation that approval-signal vocabulary is not standardized across frameworks."
-
-  true_negatives:
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"approver","human_approval":true}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"file.read","tool.privilege":"read"}},{"id":"t2","kind":"TOOL","attributes":{"tool.name":"db.truncate","tool.privilege":"destructive"}}]}
-      expected: not_triggered
-      description: "Approval span IS present before destructive tool — no violation"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"executor","human_approval":true}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"db.drop_table","tool.privilege":"destructive"}}]}
-      expected: not_triggered
-      description: "human_approval=true on preceding AGENT span — invariant satisfied"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"reader"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"file.read","tool.privilege":"read"}}]}
-      expected: not_triggered
-      description: "Tool privilege is read, not destructive — rule does not apply"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"plan"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"file.write","tool.privilege":"write"}}]}
-      expected: not_triggered
-      description: "write privilege (not destructive) — rule does not apply"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"agent.name":"thinker"}}]}
-      expected: not_triggered
-      description: "No TOOL span at all — nothing to check"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"human_approval":true}},{"id":"a2","kind":"AGENT","attributes":{"agent.name":"executor"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"db.drop_index","tool.privilege":"destructive"}},{"id":"t2","kind":"TOOL","attributes":{"tool.name":"db.drop_index","tool.privilege":"destructive"}}]}
-      expected: not_triggered
-      description: "Approval covers all subsequent destructive spans within the trace"
-    - input: |
-        {"spans":[{"id":"h1","kind":"HUMAN","attributes":{"action":"approved"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"db.drop_table","tool.privilege":"destructive"}}]}
-      expected: not_triggered
-      description: "Dedicated HUMAN span kind (LangChain HITL convention) — one_of_shapes branch matches, rule does not fire"

package/rules/privilege-escalation/ATR-2026-00551-cross-conversation-memory-write.yaml

@@ -1,93 +1,65 @@
-title: "Cross-conversation memory write (scope-escape via memory store)"
+title: Cross-conversation memory write (scope-escape via memory store)
 id: ATR-2026-00551
 rule_version: 1
 status: experimental
-description: >
-  Detects an agent writing data into a memory store / vector store scoped
-  to a DIFFERENT conversation than the active trace's conversation.id.
-  This is a trace-method rule using the `forbid` primitive with a target
-  field comparison (spec/atr-method-v1.1.md §8.3.1).
-
-  Threat model: memory APIs (long-term context, vector stores, RAG
-  ingestion) typically partition by conversation.id, user.id, or session.id
-  for tenant isolation. Two attack patterns create scope-escape: (1)
-  prompt injection convinces the agent to "remember this for user X" when
-  the active conversation is for user Y, (2) tool argument tampering
-  alters the target conversation_id before the memory write completes.
-  In either case, the trace exhibits a span where
-  attributes.tool.args.target_conversation_id differs from the active
-  span's attributes.conversation.id. No exception is raised; the memory
-  write succeeds and corrupts the target conversation's context.
-
-  This rule is the runtime-detection complement to the AgentArmor
-  (arXiv:2508.01249) type-system rule "memory writes must respect the
-  active conversation lattice."
-author: "ATR Community"
-date: "2026/05/28"
-schema_version: "1.0"
+description: |
+  Detects an agent writing data into a memory store / vector store scoped to a DIFFERENT conversation than the active trace's conversation.id. This is a trace-method rule using the `forbid` primitive with a target field comparison (spec/atr-method-v1.1.md §8.3.1).
+  Threat model: memory APIs (long-term context, vector stores, RAG ingestion) typically partition by conversation.id, user.id, or session.id for tenant isolation. Two attack patterns create scope-escape: (1) prompt injection convinces the agent to "remember this for user X" when the active conversation is for user Y, (2) tool argument tampering alters the target conversation_id before the memory write completes. In either case, the trace exhibits a span where attributes.tool.args.target_conversation_id differs from the active span's attributes.conversation.id. No exception is raised; the memory write succeeds and corrupts the target conversation's context.
+  This rule is the runtime-detection complement to the AgentArmor (arXiv:2508.01249) type-system rule "memory writes must respect the active conversation lattice."
+author: ATR Community
+date: 2026/05/28
+schema_version: '1.0'
 maturity: draft
 severity: critical
-
 references:
   owasp_agentic:
-    - "ASI04:2026"
-    - "ASI06:2026"
+    - ASI04:2026
+    - ASI06:2026
   owasp_llm:
-    - "LLM03:2025"
+    - LLM03:2025
   mitre_atlas:
-    - "AML.T0080 - AI Agent Context Poisoning"
+    - AML.T0080 - AI Agent Context Poisoning
   research:
-    - "AgentArmor: Type-System for Agent Trace Analysis (arXiv:2508.01249)"
-    - "Compositional Privacy Risks in Multi-Agent Systems (arXiv:2509.14284)"
-
+    - 'AgentArmor: Type-System for Agent Trace Analysis (arXiv:2508.01249)'
+    - Compositional Privacy Risks in Multi-Agent Systems (arXiv:2509.14284)
 compliance:
   nist_csf:
-    - subcategory: "PR.DS-01"
-      context: >
-        A memory or vector store is data-at-rest. Writing into a partition belonging to
-        a different conversation is an integrity failure of that store under PR.DS-01,
-        and it persists — unlike a transient leak, the bad record stays until something
-        removes it.
+    - subcategory: PR.DS-01
+      context: |
+        A memory or vector store is data-at-rest. Writing into a partition belonging to a different conversation is an integrity failure of that store under PR.DS-01, and it persists — unlike a transient leak, the bad record stays until something removes it.
       strength: primary
-    - subcategory: "PR.AA-05"
-      context: >
-        The conversation boundary is an authorization boundary, so a write that crosses
-        it is also a least-privilege failure. Secondary because PR.AA-05 governs how
-        permissions are defined and reviewed, while this rule only observes one being
-        exceeded at runtime.
+    - subcategory: PR.AA-05
+      context: |
+        The conversation boundary is an authorization boundary, so a write that crosses it is also a least-privilege failure. Secondary because PR.AA-05 governs how permissions are defined and reviewed, while this rule only observes one being exceeded at runtime.
       strength: secondary
   eu_ai_act:
-    - article: "10"
-      context: >
-        Data governance — cross-conversation memory writes corrupt
-        tenant-isolated state and violate Article 10 data-governance
-        requirements.
+    - article: '10'
+      context: |
+        Data governance — cross-conversation memory writes corrupt tenant-isolated state and violate Article 10 data-governance requirements.
       strength: primary
-    - article: "15"
-      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store))."
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)).
       strength: primary
-    - article: "14"
-      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)) would bypass or undermine that oversight."
+    - article: '14'
+      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)) would bypass or undermine that oversight.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MS.2.6"
-      context: >
-        Information security — cross-tenant memory writes are integrity
-        failures under MS-2.6.
+    - subcategory: MS.2.6
+      context: |
+        Information security — cross-tenant memory writes are integrity failures under MS-2.6.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)).
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)) so the risk can be treated."
+    - subcategory: MG.2.3
+      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)) so the risk can be treated.
       strength: secondary
-
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store))."
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)).
       strength: primary
-    - clause: "6.2"
-      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)) is such a treatment."
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (Cross-conversation memory write (scope-escape via memory store)) is such a treatment.
       strength: secondary
 tags:
   category: privilege-escalation
@@ -95,135 +67,52 @@ tags:
   scan_target: runtime
   confidence: high
   source: trace-rule
-
 agent_source:
   type: agent_trace
   framework:
     - any
   provider:
     - any
-
 detection:
   method: trace
   condition: any
   false_positives:
-    - >
-      Admin / knowledge-propagation agents legitimately write across
-      conversations (e.g., support escalation summaries, cross-tenant
-      compliance reports). The rule has no exemption mechanism for these.
-      Mitigation: operators tag authorized cross-conv agents with
-      attributes.agent.role="cross_conv_admin" and add a pre-filter at
-      the policy layer. The rule itself does not encode this exception
-      to keep the trace shape simple.
-    - >
-      Closed tool name list (memory.write, memory.upsert,
-      vector_store.write, vector_store.upsert, longterm.append,
-      rag.ingest): framework-specific names like mem0.add, zep.memory.add,
-      langmem.put, chromadb.add, pgvector.insert all bypass the rule.
-      Until a regex/suffix matcher lands in the spec, operators MUST
-      extend the in[] list for their stack. This is a known FN scenario
-      that complements the FP risk.
-    - >
-      `exists: true` and `not_equals` are co-located on
-      tool.args.target_conversation_id. Spec §8.3 requires engines to
-      evaluate `exists` before `not_equals` to avoid placeholder-
-      resolution errors on absent attributes. Non-conformant engines
-      may emit a graceful_error here.
+    - |
+      Admin / knowledge-propagation agents legitimately write across conversations (e.g., support escalation summaries, cross-tenant compliance reports). The rule has no exemption mechanism for these. Mitigation: operators tag authorized cross-conv agents with attributes.agent.role="cross_conv_admin" and add a pre-filter at the policy layer. The rule itself does not encode this exception to keep the trace shape simple.
+    - |
+      Closed tool name list (memory.write, memory.upsert, vector_store.write, vector_store.upsert, longterm.append, rag.ingest): framework-specific names like mem0.add, zep.memory.add, langmem.put, chromadb.add, pgvector.insert all bypass the rule. Until a regex/suffix matcher lands in the spec, operators MUST extend the in[] list for their stack. This is a known FN scenario that complements the FP risk.
+    - |
+      `exists: true` and `not_equals` are co-located on tool.args.target_conversation_id. Spec §8.3 requires engines to evaluate `exists` before `not_equals` to avoid placeholder- resolution errors on absent attributes. Non-conformant engines may emit a graceful_error here.
   conditions:
     - field: trace.forbid_violation
       operator: regex
-      value: "(?i)forbid_violation:cross_conversation_memory_write"
-      description: >
-        Synthetic field emitted by the trace engine when the forbid
-        primitive fires; trace-native engines evaluate detection.trace.
+      value: (?i)forbid_violation:cross_conversation_memory_write
+      description: |
+        Synthetic field emitted by the trace engine when the forbid primitive fires; trace-native engines evaluate detection.trace.
   trace:
     ingest_format: openinference
     forbid:
       - shape:
-          span.kind: "TOOL"
+          span.kind: TOOL
           attributes:
             tool.name:
               in:
-                - "memory.write"
-                - "memory.upsert"
-                - "vector_store.write"
-                - "vector_store.upsert"
-                - "longterm.append"
-                - "rag.ingest"
+                - memory.write
+                - memory.upsert
+                - vector_store.write
+                - vector_store.upsert
+                - longterm.append
+                - rag.ingest
             tool.args.target_conversation_id:
               exists: true
-              not_equals: "${span.attributes.conversation.id}"
-        description: >
-          Memory-write tool whose args.target_conversation_id is set
-          AND differs from the active span's conversation.id indicates
-          scope-escape. Uses the cross-attribute reference syntax per
-          atr-method-v1.1.md §8.3 (the ${span.attributes.X} placeholder
-          is resolved against the candidate span before predicate
-          evaluation).
-
+              not_equals: ${span.attributes.conversation.id}
+        description: |
+          Memory-write tool whose args.target_conversation_id is set AND differs from the active span's conversation.id indicates scope-escape. Uses the cross-attribute reference syntax per atr-method-v1.1.md §8.3 (the ${span.attributes.X} placeholder is resolved against the candidate span before predicate evaluation).
 response:
   actions:
     - alert
     - snapshot
-  actions_rationale: >-
-    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0 FP but the measurement
-    is incomplete — the harness reported conditions it could not exercise, so the silence is an
-    unasked question; ceiling = observe. Removed block_tool(interrupt). Detection unchanged —
-    recall cost is zero.
-  message_template: >
-    [ATR-2026-00551] HIGH: Cross-conversation memory write detected. Tool
-    {{trace.matched_span.attributes.tool.name}} (span
-    {{trace.matched_span.id}}) attempted to write into conversation
-    {{trace.matched_span.attributes.tool.args.target_conversation_id}}
-    while the active trace conversation is
-    {{trace.matched_span.attributes.conversation.id}}. Block the write;
-    audit whether the active agent has authority over the target
-    conversation.
-
+  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0 FP but the measurement is incomplete — the harness reported conditions it could not exercise, so the silence is an unasked question; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
+  message_template: |
+    [ATR-2026-00551] HIGH: Cross-conversation memory write detected. Tool {{trace.matched_span.attributes.tool.name}} (span {{trace.matched_span.id}}) attempted to write into conversation {{trace.matched_span.attributes.tool.args.target_conversation_id}} while the active trace conversation is {{trace.matched_span.attributes.conversation.id}}. Block the write; audit whether the active agent has authority over the target conversation.
 confidence: 85
-
-
-test_cases:
-  true_positives:
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"memory.write","conversation.id":"conv_A","tool.args":{"target_conversation_id":"conv_B","payload":"remember this"}}}]}
-      expected: triggered
-      description: "memory.write into conv_B while active conversation is conv_A"
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"vector_store.upsert","conversation.id":"alpha","tool.args":{"target_conversation_id":"beta","vector":"<...>"}}}]}
-      expected: triggered
-      description: "vector_store.upsert with target_conversation_id mismatch"
-    - input: |
-        {"spans":[{"id":"a1","kind":"AGENT","attributes":{"conversation.id":"primary"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"rag.ingest","conversation.id":"primary","tool.args":{"target_conversation_id":"victim_conv","content":"fake context"}}}]}
-      expected: triggered
-      description: "rag.ingest into victim_conv while operating in primary"
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"longterm.append","conversation.id":"c123","tool.args":{"target_conversation_id":"c456"}}}]}
-      expected: triggered
-      description: "longterm.append targets a different conversation than the trace's"
-    - input: |
-        {"spans":[{"id":"r1","kind":"RETRIEVER","attributes":{"source.trust":"untrusted","conversation.id":"x"}},{"id":"t1","kind":"TOOL","attributes":{"tool.name":"memory.upsert","conversation.id":"x","tool.args":{"target_conversation_id":"y"}}}]}
-      expected: triggered
-      description: "Combined indirect-injection + cross-conv memory write"
-
-  true_negatives:
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"memory.write","conversation.id":"same","tool.args":{"target_conversation_id":"same","payload":"note"}}}]}
-      expected: not_triggered
-      description: "target_conversation_id == active conversation.id — legitimate self-write"
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"memory.read","conversation.id":"a","tool.args":{"target_conversation_id":"b"}}}]}
-      expected: not_triggered
-      description: "memory.read is not a write — rule does not apply"
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"calculator","conversation.id":"c","tool.args":{"a":1,"b":2}}}]}
-      expected: not_triggered
-      description: "Tool is calculator, not memory-write — rule does not apply"
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"memory.write","conversation.id":"only","tool.args":{"payload":"note without target_conversation_id"}}}]}
-      expected: not_triggered
-      description: "No explicit target_conversation_id; defaults to active conversation — legitimate"
-    - input: |
-        {"spans":[{"id":"t1","kind":"TOOL","attributes":{"tool.name":"vector_store.upsert","conversation.id":"shared","tool.args":{"target_conversation_id":"shared","namespace":"global"}}}]}
-      expected: not_triggered
-      description: "Shared conversation namespace — target equals active, legitimate cross-agent shared memory"