genai-security-crosswalk 2.0.0

package/data/entries/ASI02.json

@@ -0,0 +1,850 @@
+{
+  "id": "ASI02",
+  "name": "Tool Misuse and Exploitation",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": 9.6,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0037",
+      "control_name": "Output Manipulation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0037",
+      "notes": "Crafting inputs that produce tool calls with destructive parameters"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0015",
+      "control_name": "LLM Capability Escalation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0015",
+      "notes": "Exploiting overly permissive tool access to exceed intended agent scope"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0068",
+      "control_name": "Automated Collection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0068",
+      "notes": "Agent autonomously harvesting data through tool chains beyond authorised scope"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy defines permissible tool invocations per agent role — human confirmation required for irreversible tools"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-5.1",
+      "control_name": "Interdependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent tool integrations mapped — data received, permission scope, reversibility, and risk rating per tool"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial testing of tool misuse scenarios — destructive parameter injection, tool chaining, MCP descriptor poisoning"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident response for tool misuse — tool disable, parameter audit, downstream impact assessment"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Tool misuse risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent tool integrations assessed in Art. 9 risk management — reversibility classification documented"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Human oversight over high-risk AI actions",
+      "control_name": "Art. 14 — Human oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Irreversible tool invocations require human confirmation — Art. 14 binding requirement"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures preventing tool misuse",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Per-tool permission manifests and parameter validation are Art. 15 technical requirements"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.2",
+      "control_name": "Privileged access rights",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool access managed as privileged access — per-tool permission manifests, minimum scope, regular review"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.15",
+      "control_name": "Identity management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool access governed through identity management — tool permissions scoped per agent identity"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool invocations logged with full context — tool identity, parameters, agent identity, timestamp"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool parameter validation as secure coding requirement — LLM-generated parameters treated as untrusted"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.1.2",
+      "control_name": "Responsible AI system management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool access managed responsibly throughout agent lifecycle — permission review, irreversibility classification, human oversight requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Per-tool permission manifests and parameter validation as AIMS security controls"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.5.2",
+      "control_name": "Impact assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool misuse impact assessed — what harm is possible if each tool is misused autonomously"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.1",
+      "control_name": "Third-party AI system acquisition",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool and MCP server providers assessed as third-party AI components — security obligations in contracts"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "5.4 Restrict administrator privileges",
+      "control_name": "CIS 5 — Account Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool access managed as privileged access — minimum scope, regular review"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "6.1 Establish access granting process",
+      "control_name": "CIS 6 — Access Control Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Formal process for granting agent tool access — documented justification per tool"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.5 Collect detailed audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool invocations logged — tool identity, parameters, agent identity, timestamp"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.1 Establish secure development standards",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool parameter validation as secure development requirement"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control enforces least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.1",
+      "control_name": "Verify all sensitive functions have access control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.2",
+      "control_name": "Verify all business logic decisions logged",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.2",
+      "control_name": "Verify business logic abuse scenarios identified",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V13.1.1",
+      "control_name": "Verify API rate limiting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Per-tool minimum permission — setpoint adjustment tool restricted to specific tags and safe ranges"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.1",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Allowlisted tool operations for each agent role — agent cannot invoke tools outside its defined function"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Anomalous tool invocation patterns detected and responded to — alert, suspend, investigate"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool descriptor integrity verified — poisoned MCP tool descriptors rejected at loading"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Common ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Excessive privilege is specifically listed as OT vulnerability class"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Assess agent permission scope as part of OT risk register"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Secure architecture",
+      "control_name": "§7.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Least privilege must be enforced at zone boundary for all automated systems"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access permissions managed — per-tool permission manifests, least privilege per tool, irreversibility classification"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy defines permissible tool invocations — which tools require human confirmation"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool invocations logged and monitored — anomalous parameters, unusual sequences, high frequency detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.AN-03",
+      "control_name": "Incident Analysis",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Root cause analysis — which tool was misused, what downstream impact occurred, what parameters were used"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Control activities define tool permission scope — which tools are permitted, which parameters are valid, which actions require confirmation",
+      "control_name": "CC5.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool permission policy, permitted action allowlist"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Logical access controls enforce tool permissions — agent cannot invoke tools outside authorised scope",
+      "control_name": "CC6.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool invocation logs, access rejection records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Monitoring for anomalous tool invocations — destructive parameters, out-of-scope tools, unexpected sequences detected",
+      "control_name": "CC7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool call audit log, anomaly alert records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Tool invocations are complete and accurate — parameter validation ensures tool calls match intended business operation",
+      "control_name": "PI1.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validation configuration, rejected call logs"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent tool permissions follow least-privilege — agent can only access CHD systems required for defined function",
+      "control_name": "Req 7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access control matrix for agent tools, privilege review records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent tool permissions reviewed periodically — unused tool permissions removed; review schedule documented",
+      "control_name": "Req 7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Periodic access review records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "All tool invocations on CHD systems logged — tool name, parameters, data accessed, user/session identity",
+      "control_name": "Req 10.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool invocation audit log"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Tool parameter validation in agent code — LLM-generated tool parameters validated before execution",
+      "control_name": "Req 6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Code review records covering parameter validation"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool permissions defined per agent role — scope enforced at the framework layer; irreversibility controls prevent unrecoverable actions"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "SCS",
+      "control_name": "Supply Chain Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool integrations assessed as supply chain components — integrity verification, vendor security review before integration"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent tool invocations logged — data volumes, destination, and parameter patterns monitored for anomalies"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent tool credentials issued with least-privilege — no unnecessary tool permissions granted"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define per-agent permission sets; review in architecture assessment"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Formalise agent identity and permission lifecycle"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Periodic review of declared vs granted permissions per agent"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Alert when agent requests permissions outside declared scope"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Document what permissions each agent class is authorised to hold"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Access Control",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent can invoke tools it should not have access to; tool parameters not range-validated"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Missing Authorisation",
+      "control_name": "CWE-862",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "No authorisation check before irreversible tool invocations; human confirmation not required"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Unrestricted Upload of File with Dangerous Type",
+      "control_name": "CWE-434",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Analogy: agent accepts and executes tool payloads without content validation"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Control of Dynamically-Managed Code Resources",
+      "control_name": "CWE-913",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Input Validation",
+      "control_name": "CWE-20",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool parameters generated by LLM not validated against safe ranges before execution"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Tool permission boundary enforcement",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Attempt to invoke tools outside the agent's defined role; test parameter ranges; verify irreversibility controls"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Per-tool authorisation",
+      "control_name": "ACT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify each tool enforces its own access controls independently of the agent framework"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "LLM-generated tool parameters",
+      "control_name": "OHT — Output Handling",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify tool call parameters generated by the LLM are validated before execution"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party testing of adversarial robustness",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B004",
+      "control_name": "Prevent AI endpoint scraping",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI agent actions",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B007",
+      "control_name": "Enforce user access privileges to AI systems",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Agent with excess privilege can call tools in destructive ways even within normal use",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Per-tool permission manifests — each tool scoped to minimum required operations"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Compromised third-party tool identity gets full scope of agent credential",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validate all third-party tool identities — reject tokens from unregistered issuers"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Single shared credential allows tool misuse to affect multiple services",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Unique credential per tool integration — tool-scoped tokens, not agent-wide tokens"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Define explicit security requirements specifying the maximum permitted tool access, API scope, data source access, and resource boundaries for each agent deployment",
+      "control_name": "PW.1.1-PS – Define security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Establishes access control as a mandatory deployment requirement"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Threat model all agent access paths to tools, data stores, and APIs; design least-privilege tool manifests and enforce tenant isolation by design",
+      "control_name": "PW.2.1-PS – Design software to meet security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Ensures access boundaries are designed before implementation"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Protect agent configuration files, tool manifests, permission policies, and orchestration definitions from unauthorised modification",
+      "control_name": "PS.1.1-PS – Protect all code from unauthorised access",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Prevents tampering with access control configuration"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Review agent access control enforcement — verify that tool permission manifests, RBAC policies, and tenant isolation boundaries are correctly implemented and cannot be bypassed",
+      "control_name": "PW.7.2-PS – Review the software for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Validates access controls before production deployment"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — agent resource access",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce role-based access control on all agent resources — tools, data stores, APIs, and inter-agent communication channels; deny by default"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-6",
+      "control_name": "Least Privilege — agent permissions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce least privilege for all agent permissions; restrict tool access, data store access, and API scope to minimum necessary per agent role"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — agent capability restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Restrict agents to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in agent configuration"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — access decision logging",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Log all agent access decisions — permitted and denied — with sufficient detail for access control review and incident investigation"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — agent access controls",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Implement security controls enforcing least privilege on agent tool access, data store access, and API permissions within financial systems"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — agent permission governance",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include agent access control policies in ICT risk management framework; define acceptable permission scopes per agent role and financial function"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — unauthorised access detection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Monitor agent access patterns for unauthorised tool invocations, data access beyond scope, and permission violations; alert on detection"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — access control testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include agent access control bypass in resilience testing; verify that agents cannot exceed defined permission boundaries under adversarial conditions"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Invariant Analyzer",
+      "type": "open-source",
+      "url": "https://github.com/invariantlabs-ai/invariant"
+    },
+    {
+      "name": "NeMo Guardrails",
+      "type": "open-source",
+      "url": "https://github.com/NVIDIA/NeMo-Guardrails"
+    },
+    {
+      "name": "MCP Inspector",
+      "type": "open-source",
+      "url": "https://github.com/modelcontextprotocol/inspector"
+    },
+    {
+      "name": "Claroty",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "OWASP Dependency-Check",
+      "type": "open-source",
+      "url": "https://github.com/jeremylong/DependencyCheck"
+    },
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://github.com/returntocorp/semgrep"
+    },
+    {
+      "name": "Koi Security",
+      "type": "commercial",
+      "url": "https://www.koi.ai"
+    },
+    {
+      "name": "SPIFFE / SPIRE",
+      "type": "open-source",
+      "url": "https://spiffe.io"
+    },
+    {
+      "name": "HashiCorp Vault",
+      "type": "open-source",
+      "url": "https://www.vaultproject.io"
+    },
+    {
+      "name": "LAAF (LLM Agent Assessment Framework)",
+      "type": "open-source",
+      "url": "https://github.com/OWASP/LAAF"
+    },
+    {
+      "name": "Open Policy Agent (OPA)",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "AWS IAM / Azure RBAC",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/iam/"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Indirect prompt injection in LLM email assistant via malicious email body",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-007"
+    },
+    {
+      "name": "Microsoft Copilot for M365 — document exfiltration via indirect injection",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-010"
+    },
+    {
+      "name": "LangChain and LlamaIndex RCE — agent code execution via prompt injection",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-012"
+    },
+    {
+      "name": "Agentic AI privilege escalation via tool chain manipulation — research",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-019"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    },
+    {
+      "name": "Greshake et al. \"Not What You've Signed Up For\" indirect prompt injection paper",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-022"
+    },
+    {
+      "name": "Slack AI indirect injection via channel content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-024"
+    },
+    {
+      "name": "GitHub Copilot Workspace prompt injection via repository content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-025"
+    },
+    {
+      "name": "Cursor AI code agent leaking repository secrets via context window",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-034"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM05",
+      "LLM06",
+      "LLM07"
+    ],
+    "dsgai_2026": [
+      "DSGAI06",
+      "DSGAI12",
+      "DSGAI07",
+      "DSGAI08"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}