genai-security-crosswalk 2.0.0

package/data/entries/ASI03.json

@@ -0,0 +1,854 @@
+{
+  "id": "ASI03",
+  "name": "Identity and Privilege Abuse",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": 9.3,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0022",
+      "control_name": "Valid Accounts",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0022",
+      "notes": "Exploiting legitimate agent credentials to access AI systems or data pipelines"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0016",
+      "control_name": "Exfiltration via AI Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0016",
+      "notes": "Using compromised agent credentials to exfiltrate data through inference API"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0024",
+      "control_name": "Model Inversion",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0024",
+      "notes": "Reconstructing sensitive data accessible to the agent through credential abuse"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent identity and credential governance policy — NHI inventory, short-lived credentials, scope controls"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credential exposure risks mapped per deployment — credential types, scope, and lateral movement potential"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarial testing covering credential leakage and abuse — memory stores, logs, tool payload captures"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident response for credential exposure — rotation, containment, lateral movement assessment, downstream notification"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Credential exposure risk identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credential lifecycle in Art. 9 risk management — NHI inventory, scope controls, rotation documented"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures protecting against credential theft",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Short-lived credentials, JIT access, PKI-backed identities are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Documented procedures for credential incident response",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credential incident response in quality management system — rotation, containment, lateral movement assessment"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.2",
+      "control_name": "Privileged access rights",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials managed as privileged access — JIT issuance, minimum scope, regular review, automatic expiry"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.16",
+      "control_name": "Identity management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NHI lifecycle management — all agent identities inventoried, provisioned, reviewed, and deprovisioned through formal process"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials encrypted at rest and in transit — secret manager, no cleartext storage"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All credential operations logged — issuance, use, expiry, anomalous patterns detectable"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential security as AIMS design requirement — short-lived JIT credentials, no cleartext storage, least privilege"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.7.3",
+      "control_name": "Data provenance and characteristics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials tracked as AI system data — issuance, scope, expiry, rotation documented"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.7",
+      "control_name": "Support",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Resources for AI systems include NHIs — agent identities inventoried and managed as AIMS resources"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.1",
+      "control_name": "Third-party AI system acquisition",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party services accessed via agent credentials assessed — security obligations in access arrangements"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "5.4 Restrict administrator privileges",
+      "control_name": "CIS 5 — Account Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "6.2 Establish an access revoking process",
+      "control_name": "CIS 6 — Access Control Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credential revocation process — immediate revocation on detection, decommission procedure"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.5 Collect detailed audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All credential operations logged — issuance, use, anomalous patterns detectable"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "3.11 Encrypt sensitive data at rest",
+      "control_name": "CIS 3 — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials encrypted at rest — secret manager, no cleartext storage"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V2.1.1",
+      "control_name": "Verify credentials not in source code",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials not hardcoded — secret manager required"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control enforces least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credential scope minimum required — no over-privileged NHIs"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V6.1.1",
+      "control_name": "Verify sensitive data encrypted at rest",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.1",
+      "control_name": "Verify access control decisions logged",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All credential usage logged — issuance, access, expiry detectable"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V14.2.3",
+      "control_name": "Verify secrets not in source code",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials not committed to source control"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Identification and authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent access to OT systems using distinct, traceable identity — not shared service accounts"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.6",
+      "control_name": "Authenticator management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials managed with defined lifecycle — issuance, rotation, revocation procedures"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials scoped to minimum OT data access required for defined task"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality in transit",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials never transmitted or stored in cleartext within OT network"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.9",
+      "control_name": "Session lock",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent sessions terminated and credentials revoked immediately on compromise detection"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Memory corruption and state manipulation"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Assess agent memory stores as OT data integrity risk"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-01",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Identities and credentials managed — NHI inventory, lifecycle management, unique identity per agent"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access permissions managed — agent credential scope enforced, least privilege per agent role"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive data protected at rest — agent credentials encrypted, not stored in cleartext"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential usage monitored — anomalous access patterns detected"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Agent credentials managed as logical access assets — provisioning, scope, rotation, revocation per access management policy",
+      "control_name": "CC6.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential lifecycle records, provisioning logs"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Credentials revoked at session end — no persistent credential caching in agent memory after session terminates",
+      "control_name": "CC6.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Session termination logs, credential TTL configuration"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Credential usage monitored — anomalous scope expansion or after-session access detected",
+      "control_name": "CC7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential audit log, anomaly alert records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Agent credentials treated as confidential information — stored in secrets manager, access-controlled",
+      "control_name": "C1.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secrets management configuration, access control evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent accounts are system/application accounts — unique agent identity per deployment, no shared credentials",
+      "control_name": "Req 8.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Account inventory, unique account evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent credential management — unique credentials, strong authentication where interactive, credential rotation schedule",
+      "control_name": "Req 8.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credential management policy, rotation records"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent access to CHD follows need-to-know — access to cardholder data restricted to what agent function requires",
+      "control_name": "Req 7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access control matrix, need-to-know justification"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Agent credential usage logged — all authentication events for agent accounts in CHD scope logged",
+      "control_name": "Req 10.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Authentication audit log"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials treated as sensitive AI data assets — stored in secrets manager, never in agent memory or model context"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credential lifecycle policy documented in AI governance framework — scope, lifetime, rotation, revocation"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All agent credential operations logged — anomaly detection for scope expansion or after-session access"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Short-lived tokens for all agent interactions — credential TTL enforced at the IAM layer"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Include memory store read/write paths in threat model"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Validate and sanitise all content written to persistent memory"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Test persistent memory integrity across session boundaries"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-EM",
+      "control_name": "Operations / Environment Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Apply access controls, encryption at rest, and integrity verification to all memory stores"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Confirm memory stores have appropriate access controls"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Execution with Unnecessary Privileges",
+      "control_name": "CWE-250",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent runs with broader credentials than its task requires; NHI-5 over-privilege"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Insufficiently Protected Credentials",
+      "control_name": "CWE-522",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials stored in cleartext memory, logs, config, or tool payloads"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Cleartext Storage of Sensitive Information",
+      "control_name": "CWE-312",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Credentials and tokens not encrypted at rest in agent memory or configuration"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Use of Hard-coded Credentials",
+      "control_name": "CWE-798",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials hardcoded in prompts or source code"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Insufficient Session Expiration",
+      "control_name": "CWE-613",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Long-lived agent credentials without expiry or rotation — NHI-7"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Credential scope enforcement",
+      "control_name": "ACT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify agent cannot access systems beyond its credential scope; test scope boundaries"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Credential usage audit trail",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify all credential operations are logged with sufficient detail for forensic investigation"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Credential leakage paths",
+      "control_name": "DPT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Test whether credentials appear in agent outputs, logs, memory stores, or tool payloads"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B007",
+      "control_name": "Enforce user access privileges to AI systems",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B008",
+      "control_name": "Protect model deployment environment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability (full domain)",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Agent credentials not revoked on decommission — dormant tokens exploitable",
+      "control_name": "NHI-1 Improper Offboarding",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Formal agent offboarding — all credentials revoked, tokens invalidated, access removed"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Agent credentials exposed in memory, logs, tool payloads",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "No credentials in agent context, logs, or tool payloads — secret manager only"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Third-party tool credentials with excessive permissions inherited by agent",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validate all third-party NHIs — revoke over-privileged third-party tokens"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Weak agent-to-system authentication — credential reuse or weak secrets",
+      "control_name": "NHI-4 Insecure Authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Strong authentication for all agent-to-system connections — mTLS, short-lived tokens"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Agent holds more permissions than required — lateral movement amplifier",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Least privilege per agent role — scope enforced, reviewed quarterly"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Agent credentials stored in cleartext — config files, environment variables",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secret manager for all agent credentials — no cleartext storage anywhere"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Agent tokens without expiry — compromise persists indefinitely",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Short-lived credentials — task-scoped tokens with automatic expiry"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Production agent credentials accessible in dev/test environments",
+      "control_name": "NHI-8 Environment Isolation Failure",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Strict environment isolation — separate credentials per environment, no cross-environment reuse"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Shared agent credential across multiple instances or deployments",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Unique identity per agent deployment — no credential sharing"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Humans using agent service accounts — no attribution, no MFA",
+      "control_name": "NHI-10 Human Use of NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent credentials machine-only — human use detected and blocked"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Define explicit privilege boundaries for each agent identity — maximum permitted privilege level, credential scope, and escalation constraints",
+      "control_name": "PW.1.1-PS – Define security requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establishes privilege boundaries as mandatory requirements"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Implement secure credential handling — agents must not inherit user credentials, store tokens in context, or pass credentials between agents without explicit authorisation",
+      "control_name": "PW.5.1-PS – Secure coding practices",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents credential leakage through agent code paths"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Protect credential stores, identity configurations, and privilege mapping files from unauthorised access and modification",
+      "control_name": "PS.1.1-PS – Protect all code from unauthorised access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prevents tampering with privilege boundaries"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Establish monitoring and triage procedures for privilege escalation incidents — detect agents operating beyond their assigned privilege level",
+      "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enables rapid detection of privilege escalation in production"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-6",
+      "control_name": "Least Privilege — escalation prevention",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce least privilege with explicit privilege ceilings per agent; prevent accumulation of permissions through tool chaining or inter-agent delegation"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "IA-2",
+      "control_name": "Identification and Authentication — agent NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Assign unique non-human identities to each AI agent; authenticate agent identity at each tool invocation and inter-agent communication boundary"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — tool boundary enforcement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce access control at every tool invocation boundary; validate agent identity and authorisation for each requested action regardless of calling context"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "IR-4",
+      "control_name": "Incident Handling — escalation incident response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define incident handling procedures for agent privilege escalation events; include automated containment, privilege revocation, and forensic investigation"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — escalation prevention controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls preventing agent privilege escalation through tool chaining, inter-agent delegation, or permission accumulation"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 17–23",
+      "control_name": "ICT Incident Management — escalation incident reporting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Classify agent privilege escalation as an ICT-related incident; assess impact on financial systems and report per DORA incident classification criteria"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — escalation scenario testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include agent privilege escalation scenarios in threat-led penetration testing; test for escalation through tool chaining and inter-agent trust"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — escalation detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deploy detection mechanisms for agent privilege escalation; monitor for permission boundary violations and unexpected privilege accumulation"
+    }
+  ],
+  "tools": [
+    {
+      "name": "HashiCorp Vault",
+      "type": "open-source",
+      "url": "https://www.vaultproject.io"
+    },
+    {
+      "name": "SPIFFE / SPIRE",
+      "type": "open-source",
+      "url": "https://spiffe.io"
+    },
+    {
+      "name": "Teleport",
+      "type": "commercial",
+      "url": "https://goteleport.com"
+    },
+    {
+      "name": "Entro Security",
+      "type": "commercial",
+      "url": "https://entro.security"
+    },
+    {
+      "name": "Claroty (OT identity)",
+      "type": "commercial",
+      "url": "https://claroty.com"
+    },
+    {
+      "name": "AWS Secrets Manager",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/secrets-manager/"
+    },
+    {
+      "name": "LAAF (LLM Agent Assessment Framework)",
+      "type": "open-source",
+      "url": "https://github.com/OWASP/LAAF"
+    },
+    {
+      "name": "Open Policy Agent (OPA)",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "Falco",
+      "type": "open-source",
+      "url": "https://falco.org"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "SPIFFE/SPIRE",
+      "type": "open-source",
+      "url": "https://spiffe.io"
+    },
+    {
+      "name": "CyberArk",
+      "type": "commercial",
+      "url": "https://www.cyberark.com"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Agentic AI privilege escalation via tool chain manipulation — research",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-019"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM06",
+      "LLM01"
+    ],
+    "dsgai_2026": [
+      "DSGAI02",
+      "DSGAI10",
+      "DSGAI11",
+      "DSGAI06",
+      "DSGAI08"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}