genai-security-crosswalk 2.0.0

package/data/entries/ASI09.json

@@ -0,0 +1,754 @@
+{
+  "id": "ASI09",
+  "name": "Human-Agent Trust Exploitation",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": 7.3,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0045",
+      "control_name": "Disinformation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0045",
+      "notes": "Agent generates persuasive false information to manipulate human approvals"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0047",
+      "control_name": "Influence via Automated Content",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0047",
+      "notes": "Agent produces high-volume, fluent content that overwhelms human critical assessment"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0049",
+      "control_name": "Spearphishing via AI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0049",
+      "notes": "Compromised agent crafts highly personalised, convincing manipulation targeted at specific users"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy on agent transparency — agents must identify as AI, advisory outputs clearly distinguished from authoritative"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Evaluation of transparency controls — verify advisory labels persist in all interface contexts"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-4.1",
+      "control_name": "Feedback mechanisms",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Feedback channels detecting operator over-trust patterns — aggregate analysis of agent-influenced decisions"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Response for detected trust exploitation patterns — operator retraining, interface redesign, aggregate audit"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Users informed of capabilities, limitations, and AI nature",
+      "control_name": "Art. 13 — Transparency",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agents must clearly communicate their AI nature and advisory limitations"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Effective human oversight over high-risk AI",
+      "control_name": "Art. 14 — Human oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Humans must be able to override agent recommendations — trust exploitation undermines Art. 14 effectiveness"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Chatbots and AI-generated content must disclose AI nature",
+      "control_name": "Art. 50 — Transparency for certain AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent-user interactions require AI disclosure — universal obligation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.6.3",
+      "control_name": "Information security awareness, education and training",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All users of agentic decision-support tools trained on AI limitations — verification requirements, how to identify manipulation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.36",
+      "control_name": "Compliance with policies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy on agentic AI advisory use — domains requiring verification, approval flow independence from agent interface"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.16",
+      "control_name": "Monitoring activities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Aggregate over-trust patterns monitored — systematic operator acceptance without verification detected"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent advisory output classified — users cannot mistake model recommendations for authoritative system content"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.5.2",
+      "control_name": "Impact assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Trust exploitation impact assessed — which persons are affected by AI decisions influenced by manipulated trust"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.8.1",
+      "control_name": "Information for interested parties",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI system transparency obligations — users informed of AI nature, advisory status, limitations, EU AI Act Art. 50 alignment"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.9.1",
+      "control_name": "Use of AI systems",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Guidance on appropriate use — domains requiring human verification, how to distinguish AI advisory from authoritative content"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.5",
+      "control_name": "Policy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Leadership commitment to AI transparency — AI disclosure and advisory labelling requirements in AI policy"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "14.1 Establish security awareness programme",
+      "control_name": "CIS 14 — Security Awareness and Skills Training",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All users of agentic tools trained on AI limitations — verification requirements, how to identify manipulation"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "17.1 Designate personnel for incident response",
+      "control_name": "CIS 17 — Incident Response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "5.4 Restrict administrator privileges",
+      "control_name": "CIS 5 — Account Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.5 Collect detailed audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent-influenced operator decisions logged — aggregate over-trust patterns detectable"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.1",
+      "control_name": "Verify business logic assumptions documented",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5.2.1",
+      "control_name": "Verify outputs encoded before rendering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.4.1",
+      "control_name": "Verify all security controls logged",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V13.1.3",
+      "control_name": "Verify API rejects large unexpected payloads",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.3",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM advisory outputs clearly distinguished from authoritative documentation — source always visible"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.2",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Procedures for detecting operator over-trust patterns — aggregate analysis of agent-influenced decisions"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.1",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent recommendations for safety-relevant decisions cross-validated against independent reference"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inadequate human oversight cited as OT vulnerability category"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Quantify consequences of unsupervised agent OT actions"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "OT security programme",
+      "control_name": "§8.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Governance policy for autonomous OT systems"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy requires AI disclosure and advisory labelling — agent transparency as a governance requirement"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AT-01",
+      "control_name": "Awareness and Training",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Users trained on AI limitations — operators understand agent advisory status and verification requirements"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring for aggregate over-trust patterns — systematic operator acceptance without verification detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.CO-03",
+      "control_name": "Communication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Information shared following incidents — trust exploitation incidents reported to affected users"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "AI disclosure policy — users informed when interacting with AI agents; deceptive design patterns prohibited",
+      "control_name": "CC5.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI disclosure policy, UI evidence"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Trust exploitation risk in risk assessment — social engineering, impersonation, false urgency scenarios documented",
+      "control_name": "CC3.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk register with trust exploitation entries"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Agent outputs are accurate and complete — outputs not designed to mislead; factual accuracy controls for high-stakes outputs",
+      "control_name": "PI1.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output quality controls, factual accuracy testing"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Accuracy of personal data in AI outputs — privacy criteria require that AI-generated information about individuals is accurate",
+      "control_name": "P7.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Accuracy review procedures"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Security awareness covers AI deception — staff trained to recognise AI impersonation and social engineering",
+      "control_name": "Req 12.6",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training curriculum, completion records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Honest design requirements for agent interactions — AI disclosure requirements in secure development policy",
+      "control_name": "Req 6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure development policy, design review records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent-human interaction events logged — session records for agent interactions involving CHD decisions",
+      "control_name": "Req 10.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Interaction audit log"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Trust exploitation risk analysis — targeted risk analysis documents scenarios and treatment",
+      "control_name": "Req 12.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Risk analysis documentation"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Users informed when interacting with AI agents — disclosure requirements, impersonation prohibitions, accountability for agent outputs"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI system integrity testing includes deceptive output scenarios — social engineering, false urgency, impersonation tested before deployment"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent outputs monitored for deceptive content patterns — AI-specific detection for impersonation and social engineering indicators"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Acceptable use policy covers agent interaction design — deceptive design patterns prohibited"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define maximum autonomy scope per agent class; mandate oversight gates"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Design confirmation gate pattern for all high-impact actions"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Alert when agent executes high-impact actions without confirmation"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Immutable audit log of all autonomous actions for post-hoc review"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-EG",
+      "control_name": "Governance / Education & Guidance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Operators understand when to intervene and how to trigger override"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Permissive List of Allowed Inputs",
+      "control_name": "CWE-183",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System accepts human-like agent output without disclosure requirements"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "User Interface Misrepresentation of Critical Information",
+      "control_name": "CWE-451",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent advisory output not clearly distinguished from authoritative system information in UI"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Origin Validation Error",
+      "control_name": "CWE-346",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "User cannot determine whether advice originates from AI or human — no origin verification"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Verification of Source of a Communication Channel",
+      "control_name": "CWE-940",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "User cannot verify the agent is operating under its stated configuration"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Exposure of Sensitive Information to an Unauthorised Actor",
+      "control_name": "CWE-200",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "AI disclosure enforcement",
+      "control_name": "MBT — Model Behaviour",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify agent identifies as AI in all interface contexts; test for identity concealment"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Advisory label persistence",
+      "control_name": "OHT — Output Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify advisory labels persist through all rendering environments"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Over-trust pattern detection",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify monitoring can detect aggregate patterns of uncritical operator acceptance"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "C",
+      "control_name": "Safety (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "F",
+      "control_name": "Society (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B009",
+      "control_name": "Limit output over-exposure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Humans using agent credentials — or agents using human credentials — destroys attribution",
+      "control_name": "NHI-10 Human Use of NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Strict separation: agent credentials machine-only, human credentials human-only"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Over-privileged agent identity makes its recommendations appear more authoritative to users",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Least privilege makes agent capabilities visible and bounded — users understand what the agent can actually do"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Review agent behaviour for emergent capabilities — verify that self-modification, dynamic tool discovery, and autonomous agent spawning do not create unintended security exposures",
+      "control_name": "PW.7.2-PS – Review the software for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Catches emergent pattern risks before production"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Conduct adversarial testing targeting emerging agentic patterns — self-evolution, prompt self-modification, autonomous tool acquisition, and dynamic agent creation",
+      "control_name": "PW.8.2-PS – Test for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validates controls against novel attack surfaces"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Establish monitoring for emergent agent behaviours — detect agents acquiring new capabilities, modifying their own definitions, or spawning sub-agents outside approved patterns",
+      "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enables detection of emerging risks in production"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "When incidents involve novel agentic patterns, conduct root cause analysis focused on understanding the emergent capability and its security implications",
+      "control_name": "RV.3.1-PS – Analyse root causes",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Builds organisational knowledge of emerging agentic risks"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CA-7",
+      "control_name": "Continuous Monitoring — novel pattern detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include monitoring for novel agentic behaviour patterns in FedRAMP continuous monitoring; track for unexpected capabilities, emergent behaviours, and architectural drift"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "RA-5",
+      "control_name": "Vulnerability Scanning — emerging attack surfaces",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include emerging agentic attack surfaces in vulnerability scanning; assess novel architectures for security implications before production deployment"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — unexpected behaviour detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor agent systems for unexpected behaviour — novel tool use patterns, unanticipated goal decomposition, and emergent inter-agent coordination"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-6",
+      "control_name": "Audit Review — agent decision review",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct regular audit review of agent decision logs; identify patterns indicative of unexpected capabilities or emergent behaviours requiring security assessment"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — novel agentic risk governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include emerging agentic pattern risks in ICT risk management framework; assess novel architectures for operational resilience implications before deployment"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — unexpected behaviour monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor agent systems for unexpected behaviour — novel tool use patterns, unanticipated goal decomposition, and emergent inter-agent coordination"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — emerging pattern assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply lessons learned from emerging agentic pattern incidents; update governance and controls as new attack techniques and defence approaches emerge"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — novel architecture testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include emerging agentic architecture security in resilience testing; assess novel patterns for resilience implications before production deployment"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "Nozomi Networks",
+      "type": "commercial",
+      "url": "https://www.nozominetworks.com"
+    },
+    {
+      "name": "Azure AI Content Safety",
+      "type": "commercial",
+      "url": "https://azure.microsoft.com/en-us/products/ai-services/ai-content-safety"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "LangSmith",
+      "type": "commercial",
+      "url": "https://smith.langchain.com"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "MITRE ATLAS",
+      "type": "open-source",
+      "url": "https://atlas.mitre.org"
+    },
+    {
+      "name": "PyRIT",
+      "type": "open-source",
+      "url": "https://github.com/Azure/PyRIT"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Multi-agent financial trading system flash crash — cascading autonomous failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-041"
+    },
+    {
+      "name": "Apollo Research: frontier models demonstrate strategic deception to avoid shutdown",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-047"
+    },
+    {
+      "name": "AI companion apps: manipulation and exploitation of human-agent trust",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-048"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM09",
+      "LLM06"
+    ],
+    "dsgai_2026": [
+      "DSGAI21",
+      "DSGAI04",
+      "DSGAI06",
+      "DSGAI18"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}