{ "catalog": "AI Security Infrastructure Controls", "version": "1.0.0", "as_at": "2026-08-03", "authority": "airuntimesecurity.io", "license": "MIT", "description": "Machine-readable catalog of the 80 infrastructure controls that make behavioural AI security enforceable. Mirrored across aisecuredbydesign.io (pre-runtime) and airuntimesecurity.io (runtime). airuntimesecurity.io is authoritative.", "risk_tier_model": { "named": [ "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "simplified": { "1": { "named": [ "LOW", "MEDIUM" ], "meaning": "Internal, no regulated decisions, recoverable errors" }, "2": { "named": [ "HIGH" ], "meaning": "Customer-facing, sensitive data, human review before delivery" }, "3": { "named": [ "CRITICAL" ], "meaning": "Regulated decisions, autonomous write access, financial/medical/legal" } }, "note": "min_tier uses the simplified 1/2/3 system. min_tier 1 == applies to all tiers." }, "runtime_layers": { "L1": "Layer 01 - Guardrails (deterministic prevention)", "L2": "Layer 02 - Model-as-Judge / reviewing (detection)", "L3": "Layer 03 - Human Oversight (decision)", "CB": "Circuit Breaker (containment, maps to PACE Emergency)" }, "total_controls": 80, "domains": [ { "slug": "identity-and-access", "name": "Identity & Access Management", "control_count": 8, "controls": [ { "id": "IAM-01", "title": "Authenticate all entities", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-02", "title": "Enforce least privilege", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-03", "title": "Separate control and data planes", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-04", "title": "Constrain agent tool invocation", "tier_applicability": "Tier 2+ (agentic)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-05", "title": "Human approval for high-impact actions", "tier_applicability": "Tier 3+ (agentic)", "min_tier": 3, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-06", "title": "Session-scoped credentials", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-07", "title": "Prevent credential exposure in context", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } }, { "id": "IAM-08", "title": "Audit all access changes", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/identity-and-access/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/identity-and-access/" } } ] }, { "slug": "logging-and-observability", "name": "Logging & Observability", "control_count": 10, "controls": [ { "id": "LOG-01", "title": "Log all model inputs and outputs", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-02", "title": "Log guardrail decisions", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-03", "title": "Log Judge evaluations", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-04", "title": "Log agent decision chains", "tier_applicability": "Tier 2+ (agentic)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-05", "title": "Detect behavioral drift", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-06", "title": "Detect prompt injection attempts", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-07", "title": "Protect log integrity", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-08", "title": "Enforce retention policies", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-09", "title": "Redact sensitive data in logs", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } }, { "id": "LOG-10", "title": "Correlate with enterprise SIEM", "tier_applicability": "Tier 3+", "min_tier": 3, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/logging-and-observability/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/logging-and-observability/" } } ] }, { "slug": "network-and-segmentation", "name": "Network & Segmentation", "control_count": 8, "controls": [ { "id": "NET-01", "title": "Define network zone architecture", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-02", "title": "Prevent guardrail bypass at network level", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-03", "title": "Isolate Judge evaluation infrastructure", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-04", "title": "Control agent egress destinations", "tier_applicability": "Tier 2+ (agentic)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-05", "title": "Separate ingestion from runtime", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-06", "title": "Protect control plane network path", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-07", "title": "Enforce API gateway as single entry", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } }, { "id": "NET-08", "title": "Monitor cross-zone traffic", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/network-and-segmentation/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/network-and-segmentation/" } } ] }, { "slug": "data-protection", "name": "Data Protection", "control_count": 8, "controls": [ { "id": "DAT-01", "title": "Classify data at AI boundaries", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-02", "title": "Enforce data minimisation", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-03", "title": "Detect and redact PII in model I/O", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-04", "title": "Enforce access-controlled RAG retrieval", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-05", "title": "Encrypt data at rest and in transit", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-06", "title": "Prevent sensitive data leakage via responses", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-07", "title": "Manage conversation history retention", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } }, { "id": "DAT-08", "title": "Protect evaluation data sent to Judge", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/data-protection/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/data-protection/" } } ] }, { "slug": "secrets-and-credentials", "name": "Secrets & Credentials", "control_count": 8, "controls": [ { "id": "SEC-01", "title": "Never inject credentials into context windows", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-02", "title": "Use short-lived, scoped tokens", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-03", "title": "Centralise secrets in a vault", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-04", "title": "Scan model I/O for credential patterns", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-05", "title": "Rotate credentials on exposure", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Circuit Breaker (containment)", "primary_runtime_layer_code": "CB", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-06", "title": "Isolate agent credentials per session", "tier_applicability": "Tier 2+ (agentic)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-07", "title": "Protect model endpoint credentials", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } }, { "id": "SEC-08", "title": "Scan code and config for embedded credentials", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/secrets-and-credentials/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/secrets-and-credentials/" } } ] }, { "slug": "supply-chain", "name": "Supply Chain", "control_count": 8, "controls": [ { "id": "SUP-01", "title": "Verify model provenance and integrity", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-02", "title": "Assess model risk before adoption", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-03", "title": "Verify RAG data source integrity", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-04", "title": "Secure fine-tuning pipeline", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-05", "title": "Audit tool and plugin supply chain", "tier_applicability": "Tier 2+ (agentic)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-06", "title": "Verify guardrail and safety model integrity", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-07", "title": "Maintain AI component inventory (AI-BOM)", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } }, { "id": "SUP-08", "title": "Monitor for model and dependency vulnerabilities", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/supply-chain/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/supply-chain/" } } ] }, { "slug": "incident-response", "name": "Incident Response", "control_count": 8, "controls": [ { "id": "IR-01", "title": "Define AI-specific incident categories", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-02", "title": "Establish detection triggers from logging", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-03", "title": "Define containment procedures", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Circuit Breaker (containment)", "primary_runtime_layer_code": "CB", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-04", "title": "Implement model rollback and guardrail hot-reload", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Circuit Breaker (containment)", "primary_runtime_layer_code": "CB", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-05", "title": "Define investigation for non-deterministic systems", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-06", "title": "Establish communication protocols", "tier_applicability": "Tier 2+", "min_tier": 2, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-07", "title": "Conduct AI-specific post-incident review", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } }, { "id": "IR-08", "title": "Integrate with enterprise IR processes", "tier_applicability": "All", "min_tier": 1, "agentic": false, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/incident-response/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/incident-response/" } } ] }, { "slug": "tool-access", "name": "Agentic - Tool Access", "control_count": 6, "controls": [ { "id": "TOOL-01", "title": "Declare tool permissions explicitly before deployment", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/tool-access-controls/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/tool-access-controls/" } }, { "id": "TOOL-02", "title": "Enforce permissions at the gateway, not at the agent", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/tool-access-controls/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/tool-access-controls/" } }, { "id": "TOOL-03", "title": "Constrain tool parameters to declared bounds", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/tool-access-controls/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/tool-access-controls/" } }, { "id": "TOOL-04", "title": "Classify tool actions by reversibility and impact", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 03 - Human Oversight", "primary_runtime_layer_code": "L3", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/tool-access-controls/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/tool-access-controls/" } }, { "id": "TOOL-05", "title": "Rate-limit tool invocations per agent and per tool", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/tool-access-controls/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/tool-access-controls/" } }, { "id": "TOOL-06", "title": "Log every tool invocation with full context", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/tool-access-controls/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/tool-access-controls/" } } ] }, { "slug": "session-and-scope", "name": "Agentic - Session & Scope", "control_count": 5, "controls": [ { "id": "SESS-01", "title": "Define and enforce session boundaries with automatic expiry", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/session-and-scope/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/session-and-scope/" } }, { "id": "SESS-02", "title": "Isolate sessions from each other", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/session-and-scope/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/session-and-scope/" } }, { "id": "SESS-03", "title": "Limit session scope to a declared task", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/session-and-scope/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/session-and-scope/" } }, { "id": "SESS-04", "title": "Implement progressive trust within sessions", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/session-and-scope/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/session-and-scope/" } }, { "id": "SESS-05", "title": "Clean up session state on termination", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Circuit Breaker (containment)", "primary_runtime_layer_code": "CB", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/controls/session-and-scope/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/controls/session-and-scope/" } } ] }, { "slug": "delegation-chains", "name": "Agentic - Delegation Chains", "control_count": 5, "controls": [ { "id": "DEL-01", "title": "Enforce least delegation (no privilege escalation)", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/delegation-chains/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/delegation-chains/" } }, { "id": "DEL-02", "title": "Maintain complete audit trail across chains", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 02 - Model-as-Judge / reviewing", "primary_runtime_layer_code": "L2", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/delegation-chains/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/delegation-chains/" } }, { "id": "DEL-03", "title": "Limit delegation depth", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/delegation-chains/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/delegation-chains/" } }, { "id": "DEL-04", "title": "Require explicit delegation authorisation", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/delegation-chains/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/delegation-chains/" } }, { "id": "DEL-05", "title": "Propagate user identity through chains", "tier_applicability": "Agentic (Tier 2+)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/delegation-chains/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/delegation-chains/" } } ] }, { "slug": "sandbox-patterns", "name": "Agentic - Sandbox Patterns", "control_count": 6, "controls": [ { "id": "SAND-01", "title": "Execute generated code in isolated sandboxes", "tier_applicability": "Agentic (All, code-gen)", "min_tier": 1, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/sandbox-patterns/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/sandbox-patterns/" } }, { "id": "SAND-02", "title": "Restrict sandbox file system access", "tier_applicability": "Agentic (All, code-gen)", "min_tier": 1, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/sandbox-patterns/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/sandbox-patterns/" } }, { "id": "SAND-03", "title": "Restrict sandbox network access", "tier_applicability": "Agentic (All, code-gen)", "min_tier": 1, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/sandbox-patterns/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/sandbox-patterns/" } }, { "id": "SAND-04", "title": "Enforce resource limits on execution", "tier_applicability": "Agentic (All, code-gen)", "min_tier": 1, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Circuit Breaker (containment)", "primary_runtime_layer_code": "CB", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/sandbox-patterns/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/sandbox-patterns/" } }, { "id": "SAND-05", "title": "Prevent persistent state escaping sessions", "tier_applicability": "Agentic (Tier 2+, code-gen)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Circuit Breaker (containment)", "primary_runtime_layer_code": "CB", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/sandbox-patterns/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/sandbox-patterns/" } }, { "id": "SAND-06", "title": "Scan generated code before execution", "tier_applicability": "Agentic (Tier 2+, code-gen)", "min_tier": 2, "agentic": true, "behavioural_layers": [ "guardrails", "model-as-judge", "human-oversight" ], "primary_runtime_layer": "Layer 01 - Guardrails", "primary_runtime_layer_code": "L1", "reference": { "aisecuredbydesign": "https://aisecuredbydesign.io/infrastructure/agentic/sandbox-patterns/", "airuntimesecurity": "https://airuntimesecurity.io/infrastructure/agentic/sandbox-patterns/" } } ] } ] }