genai-security-crosswalk 2.0.0

package/data/entries/ASI07.json

@@ -0,0 +1,789 @@
+{
+  "id": "ASI07",
+  "name": "Insecure Inter-Agent Communications",
+  "source_list": "Agentic-Top10-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": 8.2,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ml-engineer",
+    "ot-engineer",
+    "ciso",
+    "compliance",
+    "auditor",
+    "developer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0043",
+      "control_name": "Network Service Scanning",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0043",
+      "notes": "Identifying and mapping inter-agent communication endpoints for targeting"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0022",
+      "control_name": "Valid Accounts",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0022",
+      "notes": "Using compromised agent credentials to impersonate trusted agents in A2A channels"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0016",
+      "control_name": "Exfiltration via AI Inference API",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://atlas.mitre.org/techniques/AML.T0016",
+      "notes": "Intercepting inter-agent messages to exfiltrate sensitive context passed between agents"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "A2A communication security policy — authentication, encryption, schema validation requirements"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-5.1",
+      "control_name": "Interdependencies",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "All A2A communication channels mapped — authentication method, encryption status, schema validation, logging"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "A2A security testing — spoofing, replay, man-in-the-middle scenarios on all inter-agent channels"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Hardening",
+      "scope": "Build",
+      "notes": "Incident response for A2A compromise — channel isolation, agent suspension, forensic capture"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "A2A communication risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inter-agent channels in Art. 9 risk assessment — authentication, encryption, schema validation status"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures protecting all system components",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Authenticated, encrypted A2A communication is an Art. 15 requirement for high-risk agentic systems"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Documentation of A2A security controls",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A authentication and encryption documented in quality management system"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.20",
+      "control_name": "Networks security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A communication channels network-isolated — dedicated VLAN, traffic volume caps, protocol filtering"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A messages encrypted and integrity-verified — mutual TLS, nonce-based replay protection"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.14",
+      "control_name": "Transfer of information",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Information transfer policies and agreements for A2A communication — authentication requirements, acceptable content"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.3",
+      "control_name": "AI system security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A authentication, encryption, and schema validation as AIMS security design requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.6.2.6",
+      "control_name": "Testing of AI systems",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A security scenarios in AIMS testing — spoofing, replay, schema violations before deployment"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "A.10.1",
+      "control_name": "Third-party AI system acquisition",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A communication infrastructure providers assessed — security obligations in arrangements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Cl.8",
+      "control_name": "Operation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A communication documented as AIMS operational control — authentication requirements, encryption standards"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "12.4 Establish and maintain architecture diagram",
+      "control_name": "CIS 12 — Network Infrastructure Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A communication channels mapped in network architecture — authentication method, encryption status"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "3.10 Encrypt sensitive data in transit",
+      "control_name": "CIS 3 — Data Protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All A2A messages encrypted in transit — no cleartext inter-agent communication"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "8.5 Collect detailed audit logs",
+      "control_name": "CIS 8 — Audit Log Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All A2A messages logged — sender identity, content hash, timestamp, schema validation results"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "16.1 Establish secure development standards",
+      "control_name": "CIS 16 — Application Software Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A authentication and schema validation as secure development requirements"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V9.1.1",
+      "control_name": "Verify TLS used for all client connectivity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V3.3.1",
+      "control_name": "Verify anti-replay tokens in state-changing operations",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4.1.3",
+      "control_name": "Verify access control enforces identity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A channels enforce sender identity — unauthenticated messages rejected"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7.2.1",
+      "control_name": "Verify all security controls logged",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All A2A messages logged — sender identity, content hash, schema validation results"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.3",
+      "control_name": "Use of authenticators",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All inter-agent messages authenticated — no ambient trust between agents in OT context"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality in transit",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All A2A communication encrypted — no cleartext agent messages on OT network segments"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.4",
+      "control_name": "Communication integrity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Message integrity enforced — replay protection, nonces, sequence numbers on A2A channels"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.1",
+      "control_name": "Software and information integrity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A message schema validation — reject malformed or unexpected message structures"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risks",
+      "control_name": "§5.5",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Expanded to include agentic AI components"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risk management",
+      "control_name": "§6.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "SBOM and vendor assessment for agentic stack"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Third-party management",
+      "control_name": "§8.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Formal vendor programme for OT agent components"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-01",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent identities managed — each agent has a unique, verifiable identity for A2A authentication"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-02",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data in transit protected — all A2A communication encrypted, integrity verified"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "A2A channels monitored — replay attacks, spoofed senders, anomalous message patterns detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inter-agent communication infrastructure treated as internal supply chain — authentication requirements documented"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Inter-agent authentication required — all agent-to-agent messages authenticated before acting",
+      "control_name": "CC6.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "mTLS configuration, certificate management records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Inter-agent communication policy — which agents may communicate with which, under what conditions, with what data",
+      "control_name": "CC5.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inter-agent communication policy document"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Inter-agent traffic monitored — unexpected communication patterns, unauthorised agent requests detected",
+      "control_name": "CC7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inter-agent traffic logs, anomaly alert records"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Third-party agents treated as vendor risk — agents from external providers assessed before integration",
+      "control_name": "CC9.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Vendor assessment records for third-party agents"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "CHD encrypted in transit between agents — all inter-agent communication carrying CHD uses TLS 1.2+",
+      "control_name": "Req 4.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "TLS configuration, protocol verification"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Inter-agent authentication — agents authenticate to each other before exchanging CHD",
+      "control_name": "Req 8.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Certificate configuration, authentication evidence"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Inter-agent CHD exchanges logged — source, destination, data classification, timestamp",
+      "control_name": "Req 10.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inter-agent communication audit log"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Secure development requirements for inter-agent APIs — authentication and encryption requirements in design specifications",
+      "control_name": "Req 6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Design documentation, code review records"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All inter-agent messages authenticated and integrity-verified — mutual authentication as AI system integrity requirement"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Agent-to-agent communication policy documented — which agents may communicate with which, under what conditions, with what data"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All agent-to-agent messages logged — anomaly detection for unexpected communication patterns"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Network",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inter-agent communication restricted to approved channels — network segmentation enforces the agent communication policy"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approved vendor list for all agentic stack components"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "SBOM for all agentic system components including LLM APIs and tool servers"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Architecture review validates all third-party components against policy"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model compromise scenarios for each third-party component"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Track security advisories for all integrated components"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Authentication",
+      "control_name": "CWE-287",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "A2A channels without mutual authentication — agents accept messages from any sender"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Authentication Bypass by Capture-replay",
+      "control_name": "CWE-294",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Replay attacks on A2A channels without nonce-based replay protection"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Cleartext Transmission of Sensitive Information",
+      "control_name": "CWE-319",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "A2A messages containing sensitive context transmitted without encryption"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Origin Validation Error",
+      "control_name": "CWE-346",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Agent does not verify that A2A messages originate from the claimed sender"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "Improper Enforcement of Message Integrity During Transmission",
+      "control_name": "CWE-924",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "A2A message integrity not cryptographically verified"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "A2A authentication enforcement",
+      "control_name": "ACT — Access Control",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Attempt unauthenticated and weakly authenticated A2A message delivery"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "Replay attack prevention",
+      "control_name": "AST — Agent-Specific",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Capture and replay a valid A2A message; verify replay is rejected"
+    },
+    {
+      "framework": "OWASP AI Testing Guide",
+      "control_id": "A2A audit completeness",
+      "control_name": "LMT — Logging & Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Verify all A2A messages are logged with sender identity and content hash"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B007",
+      "control_name": "Enforce user access privileges to AI systems",
+      "tier": "Hardening",
+      "scope": "Build"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B008",
+      "control_name": "Protect model deployment environment",
+      "tier": "Hardening",
+      "scope": "Build"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability (full domain)",
+      "tier": "Hardening",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Weak or missing authentication on A2A channels — agent spoofing enabled",
+      "control_name": "NHI-4 Insecure Authentication",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Strong mutual authentication on all A2A channels — mTLS, certificate-based, short-lived"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived A2A tokens enable persistent replay attacks",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Short-lived A2A tokens with nonce-based replay protection"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Shared A2A credentials allow one compromised agent to impersonate others",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Unique identity per agent — A2A authentication bound to specific agent identity"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Define explicit security requirements constraining permitted tool invocation sequences and cross-tool data flows for each agent deployment",
+      "control_name": "PW.1.1-PS – Define security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Establishes chaining constraints as mandatory requirements"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Threat model tool interaction graphs — identify composite action sequences that could achieve unauthorised outcomes; design controls for chain-level authorisation",
+      "control_name": "PW.2.1-PS – Design software to meet security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Ensures chaining risks are addressed at design time"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Review agent behaviour for chain-based scope violations — verify that multi-step tool sequences cannot achieve outcomes exceeding individual tool permissions",
+      "control_name": "PW.7.2-PS – Review the software for security vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Catches chaining vulnerabilities before production"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "Establish monitoring for anomalous tool invocation sequences; define triage procedures for suspected lateral chaining incidents",
+      "control_name": "RV.1.1-PS – Identify and confirm vulnerabilities",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enables detection of chaining attacks in production"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-6",
+      "control_name": "Least Privilege — tool chain restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce least privilege across tool chains; prevent agents from combining tool invocations that individually are safe but together achieve harmful outcomes"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — tool combination restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Restrict permitted tool combinations; define allowed tool chains in configuration and deny undefined sequences"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — per-tool boundary enforcement",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Enforce access control at each tool invocation independently; re-evaluate authorisation at every step in a tool chain regardless of prior approvals"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — tool chain audit trail",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Log complete tool chain sequences with full context; enable detection and forensic analysis of harmful tool combination patterns"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — tool chain controls",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Implement security controls restricting tool chain composition; enforce per-tool access control and define permitted tool sequences for financial agent systems"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — tool composition governance",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include tool chaining risk in ICT risk management framework; define policies for permitted tool combinations and escalation requirements for novel tool chains"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — tool chain testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include lateral tool chaining in resilience testing; test whether agents can combine permitted tools to achieve unauthorised outcomes"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — tool chain anomaly detection",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Monitor agent tool invocation sequences for anomalous patterns; alert on novel tool combinations or sequences that cross security boundaries"
+    }
+  ],
+  "tools": [
+    {
+      "name": "SPIFFE / SPIRE",
+      "type": "open-source",
+      "url": "https://spiffe.io"
+    },
+    {
+      "name": "Linkerd",
+      "type": "open-source",
+      "url": "https://linkerd.io"
+    },
+    {
+      "name": "cert-manager",
+      "type": "open-source",
+      "url": "https://cert-manager.io"
+    },
+    {
+      "name": "SPIFFE/SPIRE",
+      "type": "open-source",
+      "url": "https://github.com/spiffe/spire"
+    },
+    {
+      "name": "mTLS (cert-manager)",
+      "type": "open-source",
+      "url": "https://cert-manager.io"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "LangSmith",
+      "type": "commercial",
+      "url": "https://smith.langchain.com"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "NeMo Guardrails",
+      "type": "open-source",
+      "url": "https://github.com/NVIDIA/NeMo-Guardrails"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "AgentOps",
+      "url": "https://github.com/AgentOps-AI/agentops",
+      "type": "open-source"
+    },
+    {
+      "name": "Agentic Security",
+      "url": "https://github.com/msoedov/agentic_security",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Multi-agent prompt injection cascade — demonstrated cross-agent goal propagation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-020"
+    },
+    {
+      "name": "Nassi et al. \"ComPromptMized\" Morris II multi-agent worm",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-023"
+    },
+    {
+      "name": "Multi-agent financial trading system flash crash — cascading autonomous failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-041"
+    }
+  ],
+  "crossrefs": {
+    "dsgai_2026": [
+      "DSGAI02",
+      "DSGAI16",
+      "DSGAI17",
+      "DSGAI06"
+    ],
+    "llm_top10": [
+      "LLM03",
+      "LLM06",
+      "LLM01"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}