Interactive decision support

Describe the agent's real operating boundary

Choose Unknown when evidence is missing. Unknowns remain visible and make the result provisional; the mapper never silently treats an omitted capability as absent.

Start from a complete operating profile

A preset fills all eleven answers. Review every value before generating a plan.

Implementation evidence should identify the custom software engineering team responsible for carrying each safeguard from architecture into deployment and operations.

Control-plan result

Complete all eleven boundary questions, then generate the plan.

Changing any answer invalidates the current record and disables its exports. Generate again to create a new timestamped record.

JavaScript is unavailable. Use the complete six-layer reference, attack paths and release gates below. The interactive mapper and exports require local JavaScript; no answers are sent to a server.

Complete no-JavaScript reference

Six-layer AI agent security control map

The map groups each control by the trust boundary where it prevents, detects, contains or supports recovery from a named attack stage.

Six security layers arranged from identity and input through tools, memory, supply chain, and monitoring with human oversight — Defense in depth means independent authorization, containment and evidence boundaries, not six labels around one model call.

Control objectives, verification work and expected evidence by layer
Layer	Control objective	Representative controls	Verification and evidence
1. Identity and access	Keep model intent separate from permission and bind every action to an authenticated workload, user and delegation context.	Unique non-human identity; short-lived audience-bound credentials; least-privilege scopes; external policy decision point; explicit tool-and-parameter authorization; no token passthrough.	Attempt cross-audience token use and excess-scope action. Retain identity inventory, authorization policy, denied-decision trace, credential rotation record and delegation chain.
2. Input and instruction handling	Preserve instruction hierarchy, treat external content as untrusted data and minimize sensitive fields before they cross a model or tool boundary.	Canonicalization; encoding and smuggling checks; injection screening; provenance and data-classification labels; minimization or redaction; schema validation; separation of untrusted-data processing from privileged tools.	Replay direct and indirect injection cases and sensitive-field handling across every ingestion path. Retain the adversarial corpus, classification decision, redaction result, policy decision and blocked trace.
3. Tool execution	Constrain what code and tools can do even when a prompt, model or orchestration step fails.	Tool allowlist; argument validation; sandbox; read-only filesystem by default; CPU, memory and time budgets; narrow egress broker; idempotency and reversible action design.	Exercise forbidden tool, path, parameter, egress and resource-limit cases. Retain sandbox policy, broker rules, syscall or container profile, action receipts and rollback result.
4. Memory integrity	Prevent untrusted or cross-tenant state from becoming durable agent instruction.	Write authorization; source provenance; tenant namespaces; typed schemas; sensitive-data filtering; manipulation quarantine; contradiction checks; versioning, expiry and reset.	Attempt cross-tenant retrieval, poisoned writes and rollback. Retain access-policy results, provenance record, quarantined sample, version history, TTL proof and reset audit.
5. Supply chain	Admit only identified, reviewed and verifiable components, then retain the ability to revoke them.	Tool and MCP server allowlist; package and image pinning; digest/signature verification; trusted-root provenance; SBOM/AIBOM; vulnerability policy; staged promotion and emergency revocation.	Verify artifacts from a trusted root, reject a changed digest and reconstruct the deployed bill of materials. Retain attestations, lockfiles, scan policy, approval record and revocation drill.
6. Monitoring and human oversight	Detect abnormal chains, stop execution and preserve enough evidence for attribution, recovery and learning.	Structured action traces; tool and policy-decision logging; rate, token, action and spend caps; circuit breaker; high-impact human approval; out-of-band kill path; credential revocation and quarantine.	Trigger each limit and kill path without relying on the model. Retain the correlated action trace, alert, approval record bound to action parameters, containment timestamp and recovery review.

Attack-to-control traceability

Three chains that a flat checklist tends to hide

Three attack chains showing indirect injection, memory poisoning, and a compromised component with controls interrupting each stage — Controls are useful when they interrupt a named stage and leave testable evidence.

Indirect injection → privileged tool → egress

An email, page or retrieved record carries instructions the operator did not authorize.
The content enters model context and competes with trusted instructions.
The model selects an action-capable tool.
Arguments reach an external destination and can disclose data.

Interruptions: trust labels and injection testing reduce instruction confusion; deterministic tool policy blocks unauthorized action; schema validation limits arguments; an egress allowlist blocks arbitrary destinations; traces and a circuit breaker contain the chain. No single control fully resolves prompt injection.

Poisoned input → persistent memory → repeated behavior

Untrusted content is summarized or promoted into long-lived state.
Provenance is lost or a tenant namespace is crossed.
Later tasks retrieve the record as if it were trusted context.
The agent repeats the induced behavior across sessions.

Interruptions: authorized writes, provenance, typed schemas and contradiction checks constrain admission; quarantine prevents immediate reuse; tenant isolation limits blast radius; versions, expiry and reset make containment and recovery testable.

Compromised component → credential access → autonomous spread

A package, image, tool, skill or server changes after review.
The runtime admits the component without verifying identity and provenance.
The component reaches credentials or network paths available to the agent.
Delegated workers repeat the activity before an operator intervenes.

Interruptions: pinned artifacts, trusted-root provenance and admission policy block unverified builds; isolated credentials and least privilege reduce reach; rate and spend caps limit repetition; out-of-band kill, credential revocation and quarantine stop the runtime.

Capability and trust boundaries

Why each mapper input changes the control plan

Each control is also grouped against the six-layer defense architecture for production AI agents, which separates identity, input, tools, memory, supply chain and monitoring into distinct failure-containment jobs.

Untrusted content: Creates a path for direct or indirect prompt injection. Treat retrieval and tool output as data, preserve provenance and test each ingestion route.
Sensitive data: Raises the consequence of context leakage, logs, memory writes and egress. Minimize data before the model and enforce destination policy outside it.
Action-capable tools: Turn generated intent into side effects. A tool name is not authorization: check identity, policy, parameters and current context at invocation.
Irreversible actions: Require stronger gating, parameter-bound approval, idempotency where possible, receipts and a tested compensation or escalation path.
Generated-code execution: Introduces command, filesystem, dependency and resource-abuse paths. Isolate execution and constrain network, time, CPU, memory and secrets.
Persistent memory: Allows one bad input to influence future sessions. Govern reads and writes. Retain source provenance and versions. Test quarantine, expiry and reset.
Third-party components: Add mutable suppliers and artifacts. Record what was deployed, verify it against a trusted root and preserve a fast revocation mechanism.
MCP and A2A connections: Cross resource, authorization and delegation boundaries. Validate token audience, request least privilege and reject token passthrough.
Open egress: Can convert a local failure into disclosure or command-and-control. Broker outbound requests through explicit, observable destination policy.
Multi-tenancy: Adds isolation requirements for credentials, memory, retrieval, caches, queues, logs and execution pools, not only database rows.
Multi-agent delegation: Creates authority chains, recursion and amplification. Bind delegated scope, cap depth and cost, trace lineage and provide a swarm-wide stop path.

Dated incident evidence

EchoLeak shows why content, tool and egress boundaries must compose

CVE-2025-32711, published on 11 June 2025, records an AI command-injection vulnerability in Microsoft 365 Copilot that could disclose information over a network. A separate researcher report dated 31 May 2025 documents a zero-click proof of concept using crafted email content and an allowed Microsoft Teams proxy path.

Evidence boundary: this was a responsibly disclosed production vulnerability, not a confirmed customer breach or confirmed exploitation in the wild. Aim Labs reports that Microsoft confirmed no customers were affected. The record supports layered controls; it does not establish that the same chain applies unchanged to another architecture.

Records: Microsoft Security Response Center advisory and Aim Labs researcher report.

EchoLeak proof-of-concept chain from crafted email through Copilot context and an allowed Teams proxy path to potential network disclosure — The researcher-demonstrated chain is separated from the CVE record and from any claim of real-world exploitation.

Verification before deployment

Release gates require artifacts, not checked boxes

A required control is not complete because it appears in the mapper. The accountable team should record an implementation, execute the named test, inspect the evidence and assign the residual decision. Suggested owner roles are planning prompts, not proof that a real person accepted ownership.

Lifecycle from scoped exposure through implemented control, verification evidence, owner review, release decision and later revalidation — Evidence expires when code, model, policy, data path, tool, dependency or trust boundary materially changes.

Authority gate

Demonstrate that excess-scope, wrong-audience, replayed and passthrough credentials fail closed. Bind high-impact approval to the actor, action, parameters, context and one-time decision.

Injection and tool gate

Replay direct and indirect injection through every live ingestion route. Show that unauthorized tools, parameters and destinations are blocked outside the model.

Execution gate

Trigger filesystem, process, resource and network boundaries using representative generated code. Preserve denied traces and verify cleanup after timeout or termination.

Memory and tenancy gate

Attempt poisoned writes, unauthorized promotion, cross-tenant retrieval and stale-state reuse. Verify provenance, quarantine, version rollback, expiry and reset.

Supply-chain gate

Reconstruct the deployed components, verify provenance and digests, reject an altered artifact, exercise revocation and document accepted exceptions with an expiry.

Containment gate

Trigger action, token, recursion, rate and spend limits. Exercise circuit breaking, out-of-band kill, credential revocation, quarantine and evidence preservation.

What the plan deliberately does not calculate

There is no percentage, confidence or maturity score. A count would hide control importance, implementation quality, exposure severity, evidence freshness and residual risk. The tool also does not select universal thresholds: limits and approval boundaries must be justified for the actual system and operating context.

Provenance and E-E-A-T record

Method, sources and accountability

How claims are bounded

The mapper is a curated implementation crosswalk. It draws control concepts from official, versioned material and links claims to source records; it is not produced, certified or endorsed by those source organizations. Read the union algorithm, schema and update policy.

OWASP AI Security Verification Standard 1.0: control vocabulary and assurance levels.
OWASP Securing Agentic Applications Guide 1.0: implementation and containment practices.
OWASP Top 10 for Agentic Applications 2026: agentic threat categories.
NIST AI 100-2e2025: adversarial machine-learning taxonomy, including indirect prompt injection and supply-chain risks.
MCP Authorization Specification, 2026-07-28: resource-server, token-audience, scope and token-passthrough requirements.
SLSA v1.2 and NIST SP 800-218A: software and AI model development supply-chain practices.

Open evidence files

Resolve every visible control, claim and source ID in the tested public registries:

Editorial record

Publisher and author: Pharos Production. Dmytro Nasyrov is credited only for the separate Pharos six-layer source article, not as an independent reviewer of this mapper.
Technical review: Not independently reviewed as of 21 August 2026.
Drafting disclosure: AI-assisted drafting; source claims, graph integrity and public contracts are checked with deterministic QA. AI assistance is not evidence of correctness.
Versions: Method 1.0.0; export schema 1.0.0; editorial release 1.0.0.
Source freshness: Sources verified 21 August 2026. Each registry record carries its own publication and verification dates where available.
Correction path: Report a factual, mapping or accessibility correction in the public repository issue tracker. Include the control or claim ID and a primary source.

Changelog 1.0.0, 21 August 2026: initial six-layer mapper, deterministic exports, three attack-chain mirrors and bounded EchoLeak evidence record.