{
  "version": "1.0.0",
  "claims": [
    { "id": "C01", "statement": "Filtering or prompt-level detection alone does not establish a complete boundary against indirect instructions in untrusted content.", "sourceIds": ["S01", "S02", "S09"], "boundary": "Supports defense in depth; does not claim that any listed control is universally effective." },
    { "id": "C02", "statement": "External content, tool output, persistent memory and peer-agent messages should be treated as separate trust domains rather than as authoritative instructions.", "sourceIds": ["S01", "S03", "S04"], "boundary": "A design principle that still requires system-specific data-flow analysis." },
    { "id": "C03", "statement": "Tool authorization should be enforced deterministically outside the model for the exact operation and parameters.", "sourceIds": ["S03", "S04", "S05"], "boundary": "Does not prescribe a specific policy engine or prove policy correctness." },
    { "id": "C04", "statement": "Agent credentials should be short-lived, audience-bound and limited to the minimum required scope, without token passthrough.", "sourceIds": ["S05", "S06"], "boundary": "Applies at the authorization boundary; credential theft and downstream resource controls still require separate testing." },
    { "id": "C05", "statement": "Irreversible or high-impact actions require an explicit policy boundary and, where assigned by the organization, human approval bound to the complete action.", "sourceIds": ["S03", "S04"], "boundary": "The mapper does not decide an organization's legal or business impact threshold." },
    { "id": "C06", "statement": "Generated-code execution needs isolation and enforceable limits on time, compute, memory, storage, processes and available credentials.", "sourceIds": ["S01", "S03", "S04", "S08"], "boundary": "Sandbox configuration and escape resistance require environment-specific verification." },
    { "id": "C07", "statement": "Agent-controlled network egress should be denied by default, narrowly allowed and attributable in telemetry.", "sourceIds": ["S01", "S03", "S04"], "boundary": "Destination allowlisting is not a substitute for payload, identity and application-layer controls." },
    { "id": "C08", "statement": "Persistent memory needs authorized reads and writes, input validation, provenance, versioning and defined retention.", "sourceIds": ["S01", "S03", "S04"], "boundary": "Implementation depends on memory type, tenant model and data obligations." },
    { "id": "C09", "statement": "Memory integrity response should support anomaly detection, quarantine and rollback while retaining investigation evidence.", "sourceIds": ["S03", "S04"], "boundary": "Detection rules and rollback points must be validated against the deployed memory design." },
    { "id": "C10", "statement": "Component admission should bind identity, version and digest to reviewed provenance and a release inventory.", "sourceIds": ["S07", "S08"], "boundary": "Inventory and signatures do not establish trust unless admission policy verifies them." },
    { "id": "C11", "statement": "Artifact provenance provides useful evidence only when verified against expected build properties and a trusted root.", "sourceIds": ["S07"], "boundary": "No SLSA level or compliance status is assigned by this mapper." },
    { "id": "C12", "statement": "A material agent action should be traceable across workload and user identity, policy decision, tool request and result.", "sourceIds": ["S03", "S04", "S06"], "boundary": "Log presence does not prove completeness, integrity or sufficient retention." },
    { "id": "C13", "statement": "Request, token, iteration and action limits need a hard spend or execution stop rather than alert-only handling.", "sourceIds": ["S03", "S04"], "boundary": "Thresholds are system-specific and are not supplied as universal values." },
    { "id": "C14", "statement": "Agent containment can require a circuit breaker, credential revocation, capability blocking, quarantine and preserved audit evidence.", "sourceIds": ["S03", "S04"], "boundary": "The necessary sequence depends on the affected architecture and incident." },
    { "id": "C15", "statement": "Agent-hijacking evaluations should be task-specific, adaptive and include repeated attempts where the threat model warrants them.", "sourceIds": ["S02"], "boundary": "Evaluation results remain bounded to the tested tasks, attacks, models and environment." },
    { "id": "C16", "statement": "CVE-2025-32711 documented an AI command-injection vulnerability in Microsoft 365 Copilot that could disclose information over a network; Aim Labs' researcher report demonstrated a crafted-email and Teams-proxy zero-click proof-of-concept chain.", "sourceIds": ["S10", "S11"], "boundary": "The MSRC record grounds the vulnerability class and network-disclosure impact; the Aim Labs report grounds the demonstrated proof-of-concept mechanism. Neither establishes a confirmed customer breach." },
    { "id": "C17", "statement": "Aim Labs reports that Microsoft confirmed no customers were affected by EchoLeak, and the disclosure did not establish in-the-wild exploitation or a customer breach.", "sourceIds": ["S10", "S11"], "boundary": "The no-customer-impact statement is reported in the researcher source; it is not presented here as text directly visible in the MSRC record or as proof that comparable paths cannot exist elsewhere." },
    { "id": "C18", "statement": "Mapping controls to public guidance is decision support, not certification, compliance, penetration-test evidence or proof that a deployed system is secure.", "sourceIds": ["S01", "S03", "S04", "S05", "S07"], "boundary": "This is the governing interpretation boundary for every output of the mapper." },
    { "id": "C19", "statement": "Sensitive data should be minimized and filtered before it enters model context, persistent memory, logs or tool paths.", "sourceIds": ["S04"], "boundary": "The necessary classifications and redaction rules depend on the system, data obligations and authorized use." },
    { "id": "C20", "statement": "AISVS 1.0 requirement identifiers can provide a versioned crosswalk for control review, but a curated mapping is not an AISVS assessment or conformance result.", "sourceIds": ["S12"], "boundary": "The AISVS chapters remain the source of truth; this mapper does not claim OWASP certification, conformance or endorsement." }
  ]
}