Skip to content

Commit 3c13d68

Browse files
robmoffatrobmoffat
committed
First attempt at building out practices
1 parent 5e0d7a7 commit 3c13d68

24 files changed

Lines changed: 1299 additions & 46 deletions

‎.dev/mitigations-research/chatgpt-deep-research-mitigations-16-feb.md‎

Lines changed: 439 additions & 0 deletions
Large diffs are not rendered by default.

‎.dev/mitigations-research/chatgpt-deep-research-tools-16-feb.md‎

Lines changed: 484 additions & 0 deletions
Large diffs are not rendered by default.

‎docs/Start.md‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
---
2-
slug: /
32
sidebar_position: 1
43
title: Introduction
54
---
@@ -16,30 +15,9 @@ This shifts risk from *"bad AI decision"* to *"unsafe evolving codebase"* — a
1615

1716
---
1817

19-
## Capabilities
18+
## Sections of this Catalog
2019

21-
Agent capabilities that create attack surface:
22-
23-
<TagList tag="Capability"/>
24-
25-
---
26-
27-
## Risks
28-
29-
Threats unique to or amplified by agentic software development:
30-
31-
<TagList tag="Threat" />
32-
33-
---
34-
35-
## Practices
36-
37-
Controls and safeguards for agentic SDLC:
38-
39-
<TagList tag="Control" />
40-
41-
42-
---
20+
<TagList tag="Category"/>
4321

4422
## Related Standards
4523

‎docs/capabilities/Start.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ title: Agentic Software Development Capabilities
33
description: The foundational capabilities that enable AI agents to participate in software development
44
sidebar_position: 1
55
slug: /capabilities
6+
list_image: /img/icons/capability.svg
7+
tags:
8+
- Category
69
---
710

811
# Agentic Capabilities

‎docs/practices/Containment/Hard-Budgets.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
title: Enforce Hard Token, Time, and Cost Budgets on Every Agent Task
3+
sidebar_label: Hard Budgets
4+
sidebar_position: 1
5+
list_image: /img/icons/control.svg
6+
tags:
7+
- Control
8+
gemara:
9+
id: hard-budgets
10+
title: Hard Budgets
11+
objective: Preventing runaway agent execution, denial-of-wallet attacks, and resource exhaustion by enforcing strict limits on tokens, time, API calls, and cost per task.
12+
threat-mappings:
13+
- reference-id: economic-pressure-risks
14+
entries:
15+
- remarks: Prevents unbounded spend and denial-of-wallet scenarios
16+
- reference-id: multi-agent-risks
17+
entries:
18+
- remarks: Limits resource contention between concurrent agents
19+
- reference-id: containment-isolation-risks
20+
entries:
21+
- remarks: Bounds blast radius of runaway loops or infinite recursion
22+
---
23+
24+
<ControlIntro fm={frontMatter} />

‎docs/practices/Containment/No-Production-Access.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
title: Block Direct Agent Write Access to Production Environments
3+
sidebar_label: No Production Access
4+
sidebar_position: 2
5+
list_image: /img/icons/control.svg
6+
tags:
7+
- Control
8+
gemara:
9+
id: no-production-access
10+
title: No Production Access
11+
objective: Preventing agents from directly modifying production systems, databases, or live infrastructure without going through controlled deployment pipelines.
12+
threat-mappings:
13+
- reference-id: autonomy-control-risks
14+
entries:
15+
- remarks: Prevents unauthorized commits and deploys to production
16+
- reference-id: deployment-rollback-risks
17+
entries:
18+
- remarks: Forces changes through controlled pipelines with rollback capability
19+
- reference-id: containment-isolation-risks
20+
entries:
21+
- remarks: Isolates agent actions from production blast radius
22+
---
23+
24+
<ControlIntro fm={frontMatter} />

‎docs/practices/Containment/Sandbox-Execution.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Sandbox Agent Code Execution with Syscall and Network Restrictions
3+
sidebar_label: Sandbox Execution
4+
sidebar_position: 3
5+
list_image: /img/icons/control.svg
6+
tags:
7+
- Control
8+
gemara:
9+
id: sandbox-execution
10+
title: Sandbox Execution
11+
objective: Running all agent-generated or agent-executed code within isolated sandboxes that restrict syscalls, filesystem access, and network egress.
12+
threat-mappings:
13+
- reference-id: containment-isolation-risks
14+
entries:
15+
- remarks: Prevents container escape, privilege escalation, and host compromise
16+
- reference-id: code-security-risks
17+
entries:
18+
- remarks: Limits damage from insecure or malicious generated code
19+
---
20+
21+
<ControlIntro fm={frontMatter} />

‎docs/practices/Containment/Tool-Call-Validation.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
title: Validate Agent Tool Calls Against Typed Schemas and Allowlists
3+
sidebar_label: Tool Call Validation
4+
sidebar_position: 4
5+
list_image: /img/icons/control.svg
6+
tags:
7+
- Control
8+
gemara:
9+
id: tool-call-validation
10+
title: Tool Call Validation
11+
objective: Enforcing strict validation of all agent tool calls against typed schemas and allowlists before execution, preventing parameter injection and unauthorized tool use.
12+
threat-mappings:
13+
- reference-id: prompt-injection-risks
14+
entries:
15+
- remarks: Blocks injection payloads in tool call parameters
16+
- reference-id: code-security-risks
17+
entries:
18+
- remarks: Prevents malformed or dangerous parameters reaching tools
19+
- reference-id: containment-isolation-risks
20+
entries:
21+
- remarks: Restricts tool chain exploitation via allowlisted actions
22+
---
23+
24+
<ControlIntro fm={frontMatter} />

‎docs/practices/Containment/Untrusted-Content.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Treat All Agent-Retrieved Content as Untrusted Input
3+
sidebar_label: Untrusted Content
4+
sidebar_position: 5
5+
list_image: /img/icons/control.svg
6+
tags:
7+
- Control
8+
gemara:
9+
id: untrusted-content
10+
title: Untrusted Content
11+
objective: Treating all content retrieved by agents—from files, APIs, documentation, or user input—as potentially malicious and applying appropriate input validation.
12+
threat-mappings:
13+
- reference-id: prompt-injection-risks
14+
entries:
15+
- remarks: Defends against indirect injection via retrieved content
16+
- reference-id: world-model-risks
17+
entries:
18+
- remarks: Prevents poisoned data sources from corrupting agent understanding
19+
---
20+
21+
<ControlIntro fm={frontMatter} />

‎docs/practices/Oversight/Agent-Identities.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Assign Unique Machine Identities to Each Agent
3+
sidebar_label: Agent Identities
4+
sidebar_position: 1
5+
list_image: /img/icons/control.svg
6+
tags:
7+
- Control
8+
gemara:
9+
id: agent-identities
10+
title: Agent Identities
11+
objective: Assigning distinct, non-shared machine identities to each agent instance, enabling clear attribution of actions and proper access control.
12+
threat-mappings:
13+
- reference-id: identity-accountability-risks
14+
entries:
15+
- remarks: Enables attribution of actions to specific agent instances
16+
- reference-id: multi-agent-risks
17+
entries:
18+
- remarks: Allows enforcement of per-agent access policies and prevents identity confusion
19+
---
20+
21+
<ControlIntro fm={frontMatter} />

0 commit comments

Comments
 (0)