genai-security-crosswalk 2.0.0

package/data/entries/LLM06.json

@@ -0,0 +1,848 @@
+{
+  "id": "LLM06",
+  "name": "Excessive Agency",
+  "source_list": "LLM-Top10-2025",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "developer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0015",
+      "control_name": "LLM Capability Escalation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://atlas.mitre.org/techniques/AML.T0015",
+      "notes": "Exploiting overly permissive LLM tool access to perform actions beyond intended scope"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0068",
+      "control_name": "Automated Collection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://atlas.mitre.org/techniques/AML.T0068",
+      "notes": "LLM autonomously collecting data beyond its intended access scope"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Organisational policy defines and enforces limits on AI system autonomy and decision authority"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Excessive agency risks mapped to specific tool and API integrations in the risk register"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Autonomy boundary testing included in adversarial evaluation programme"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Defined response for unauthorised autonomous actions including rollback and notification"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Autonomy-related risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Excessive agency scenarios required in risk management system"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI systems designed to allow effective human oversight — ability to pause, stop, and override",
+      "control_name": "Art. 14 — Human oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Human-in-the-loop requirements are a binding Art. 14 compliance obligation"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Deployers must ensure human oversight as instructed by provider",
+      "control_name": "Art. 29 — Deployer obligations",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deployers cannot waive Art. 14 human oversight requirements"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.2",
+      "control_name": "Privileged access rights",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "LLM tool access managed as privileged access — minimum scope, reviewed regularly"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.10",
+      "control_name": "Acceptable use of assets",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Policy defining acceptable LLM autonomous actions — approved tool use cases documented"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "All LLM tool invocations logged with full context — every tool call auditable"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.15",
+      "control_name": "Identity management",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "LLM tool access governed through identity management — tool permissions scoped per deployment"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.1.2",
+      "control_name": "Responsible AI system management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM tool access managed responsibly — minimum permissions, human oversight requirements documented as AIMS responsibilities"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool permission enforcement as AIMS security control — scope enforced at orchestration layer"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.5.2",
+      "control_name": "Impact assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Impact assessment covers excessive agency risk — what actions can the LLM take autonomously, what is the worst-case impact"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.5",
+      "control_name": "Policy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Leadership commitment to human oversight — autonomous action scope defined in AI policy, signed off at executive level"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "5.4 Restrict administrator privileges",
+      "control_name": "CIS 5 — Account Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM tool access managed as privileged access — minimum scope, regular review"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "6.1 Establish access granting process",
+      "control_name": "CIS 6 — Access Control Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Formal process for granting LLM tool access — documented justification required"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.5 Collect detailed audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM tool invocations logged — every tool call auditable with parameters"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control enforces least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM tool access enforced at minimum required scope — read-only by default"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.1",
+      "control_name": "Verify all sensitive functions have access control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.2",
+      "control_name": "Verify all business logic decisions logged",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM tool invocations logged with full context — every tool call auditable"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11.1.2",
+      "control_name": "Verify business logic abuse scenarios identified",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Business logic controls preventing tool misuse through prompt manipulation"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLMs granted minimum necessary permissions to OT systems — read-only by default, no autonomous write"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.1",
+      "control_name": "Use control enforcement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM actions in OT context subject to explicit use controls — no autonomous action without human confirmation"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "User authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM actions in OT context authenticated as a distinct identity — traceable in OT audit log"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.9",
+      "control_name": "Session lock",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM sessions with OT access can be locked and terminated immediately by operators"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Unauthorised command execution via IT/OT interfaces",
+      "control_name": "Section 5.3 — Threats",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM autonomous actions as a new path for unauthorised command execution"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Assess impact of unauthorised access and control",
+      "control_name": "Section 6.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM excessive agency assessed as an unauthorised access risk for each OT interface"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Minimal necessary connectivity at IT/OT boundary",
+      "control_name": "Section 7.1 — Architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM access to OT systems restricted to minimum required — read-only by default"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Title",
+      "control_name": "Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Application"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Least Privilege",
+      "control_name": "AC-6",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM granted minimum necessary OT access — read-only to historian, no write access without documented justification"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Access Enforcement",
+      "control_name": "AC-3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM access to OT systems enforced by policy — scope cannot be exceeded regardless of model instruction"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Audit Record Generation",
+      "control_name": "AU-12",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM actions in OT context logged — full accountability for every OT data access and any recommended action"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access permissions managed — LLM tool access managed as privileged access with least privilege enforcement"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-01",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Identities managed — LLM service identities inventoried and managed, tool permissions scoped per identity"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Networks and assets monitored — all LLM tool invocations logged and monitored for anomalous scope"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Acceptable use of LLM autonomous actions defined — policy specifies what actions require human confirmation"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM tool access managed under least privilege — minimum scope, documented justification, regular review",
+      "control_name": "CC6.1 — Logical access restrictions",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM tool permissions removed promptly when no longer required — access review process covers LLM tool scope",
+      "control_name": "CC6.3 — Access removal",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Human oversight procedures for LLM autonomous actions — confirmation requirements documented and enforced",
+      "control_name": "CC5.2 — Control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Excessive agency risks identified — what autonomous actions can the LLM take, what is the blast radius",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access to system components",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM tool access to CDE systems restricted to minimum required — read-only by default, write access formally approved"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.3.1",
+      "control_name": "Access control system",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access control system enforces LLM tool scope — agent cannot exceed defined CDE access without explicit authorisation"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging and monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM tool invocations in CDE logged — tool identity, parameters, invoking user identity, timestamp"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.3.2",
+      "control_name": "Targeted risk analysis",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Targeted risk analysis for LLM autonomous action scope in CDE — blast radius documented and accepted"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Human oversight requirements for autonomous LLM actions — acceptable autonomy scope defined in AI governance policy"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool permission enforcement and action guardrails as ASI controls — LLM cannot exceed defined scope"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM tool invocations logged and monitored — anomalous scope detected through AI-specific monitoring"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM tool access managed as privileged access — minimum permissions, regular review"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Strategy & Metrics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI autonomy policy as security programme strategy — acceptable autonomous action scope defined and communicated"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Security Architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Least privilege architecture for LLM tool access — action scope enforced by design, not just policy"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Threat Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Excessive agency threat modelled — what happens if each tool is invoked autonomously with adversarial parameters"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM tool invocations logged and monitored — anomalous scope detected as operational control"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "E",
+      "control_name": "Privilege Escalation via Excessive Tool Access",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "T",
+      "control_name": "Unauthorised State Tampering",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "STRIDE",
+      "control_id": "D",
+      "control_name": "Resource Exhaustion via Uncontrolled Actions",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-269",
+      "control_name": "CWE-269",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/269.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-272",
+      "control_name": "CWE-272",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/272.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-284",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/284.html"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Permission scope enforcement",
+      "control_name": "ACT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify LLM cannot invoke capabilities, tools, or APIs outside its defined role; test scope boundaries under adversarial conditions"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Irreversibility gate enforcement",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify irreversible actions require human confirmation; test that confirmation gates cannot be bypassed through crafted inputs"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Action audit completeness",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify all LLM-initiated actions are logged with sufficient detail for forensic review"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B007",
+      "control_name": "Third-party permission controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "C",
+      "control_name": "Safety domain (human oversight)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability domain (audit trails)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Tool/API credentials with more scope than task requires",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Minimum credential scope per tool integration"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived tool credentials enable extended unauthorised access",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Short-lived JIT credentials per task (see RECIPES.md)"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Same credential used for multiple tools — compromise of one exposes all",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Separate credentials per tool integration"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — AI capability constraints",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Define explicit security requirements limiting the capabilities, tool access, and autonomous action scope permitted for each AI deployment"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software — autonomy boundary threat modelling",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Threat model all tool integrations and autonomous action paths; design least-privilege tool manifests and human approval gates for irreversible actions"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review for security vulnerabilities — autonomy boundary validation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Review model behaviour for scope violations — verify that the model cannot invoke tools or take actions outside its defined permission manifest"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.8.2-PS",
+      "control_name": "Test for security vulnerabilities — adversarial autonomy testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Conduct adversarial testing targeting excessive agency through indirect injection and permission escalation scenarios"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-6",
+      "control_name": "Least Privilege — AI agent permissions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce least privilege for all AI agent tool access, API permissions, and autonomous action scope; restrict to minimum capabilities needed per deployment"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — AI capability restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Restrict AI systems to minimum necessary capabilities; disable unused tools, APIs, and action types; enforce capability restrictions in configuration"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — tool invocation control",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce access control on all AI tool invocations; require authorisation for each tool call based on agent identity, context, and action type"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — AI autonomy risk",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include AI autonomy and excessive agency in the organisational risk management strategy; define acceptable autonomy thresholds and escalation procedures"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — AI autonomy governance",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include AI autonomy and excessive agency in the ICT risk management framework; define acceptable autonomy thresholds and escalation procedures for financial AI systems"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — agent action boundaries",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Implement security controls enforcing least privilege on AI agent tool access, API permissions, and autonomous action scope within financial systems"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — autonomy boundary testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include excessive agency scenarios in resilience testing; test that AI agents cannot exceed defined permission boundaries under adversarial conditions"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — unauthorised action detection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Monitor AI agent actions for unauthorised tool invocations, scope violations, and anomalous behaviour patterns; alert on detection"
+    }
+  ],
+  "tools": [
+    {
+      "name": "LangChain (with guardrails)",
+      "type": "open-source",
+      "url": "https://github.com/langchain-ai/langchain"
+    },
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "NeMo Guardrails",
+      "type": "open-source",
+      "url": "https://github.com/NVIDIA/NeMo-Guardrails"
+    },
+    {
+      "name": "LangSmith",
+      "type": "commercial",
+      "url": "https://smith.langchain.com"
+    },
+    {
+      "name": "Claroty",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Bing Chat 'Sydney' jailbreak — persona escape and threatening behaviour",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-002"
+    },
+    {
+      "name": "Air Canada chatbot invents bereavement discount policy — tribunal ruling",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-004"
+    },
+    {
+      "name": "Chevrolet dealership chatbot agrees to sell car for $1",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-005"
+    },
+    {
+      "name": "WormGPT — uncensored LLM sold for cybercrime on dark web forums",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-011"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    },
+    {
+      "name": "AI voice deepfake CEO fraud — Hong Kong $25M loss",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-026"
+    },
+    {
+      "name": "MathPrompt: symbolic mathematics jailbreak attack",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-027"
+    },
+    {
+      "name": "Many-shot jailbreaking (Anthropic research)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-028"
+    },
+    {
+      "name": "Crescendo: multi-turn escalation attack (Microsoft)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-029"
+    },
+    {
+      "name": "Skeleton Key: direct system prompt override (Microsoft)",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-030"
+    },
+    {
+      "name": "Meta Galactica model withdrawn after misinformation at launch",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2022,
+      "incident_id": "INC-031"
+    },
+    {
+      "name": "OpenAI o1/o3 reasoning chain jailbreak via chain-of-thought manipulation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-033"
+    },
+    {
+      "name": "Apollo Research: frontier models demonstrate strategic deception to avoid shutdown",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-047"
+    },
+    {
+      "name": "AI companion apps: manipulation and exploitation of human-agent trust",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-048"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI01",
+      "ASI02",
+      "ASI10",
+      "ASI09",
+      "ASI03",
+      "ASI07"
+    ],
+    "dsgai_2026": [
+      "DSGAI06",
+      "DSGAI16",
+      "DSGAI12",
+      "DSGAI02",
+      "DSGAI07"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}