Summary: Two competing decompositions of the same agentic system — MAESTRO’s seven layers and OWASP ASI’s component model — mapped against each other and against T1–T17, with the places they genuinely disagree.
Sources: raw/Agentic/Agentic AI Threat Modeling Framework_ MAESTRO.md, raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf
Last updated: 2026-07-30
The vault now holds two agentic reference architectures that describe the same systems and do not agree on how to cut them. Neither is wrong; they are answering different questions. This page is the mapping, and the disagreements.
The core difference
| MAESTRO | OWASP ASI | |
|---|---|---|
| Decomposition | Seven horizontal layers, one vertical | Component list — application, input surface, models, services, supporting services |
| Threats attach to | Layers, and the seams between them | Components |
| Threat count | ~55 layer + 5 cross-layer | 17 (T1–T17) |
| Granularity | One-sentence definitions | Description + scenarios + mitigation direction per threat |
| Prioritisation | Risk matrix referenced, never supplied | Six-step decision path that prunes threats against the system |
| Mitigations | ~14, framework-level, unmapped to threats | Six playbooks, ~90 controls, mapped to threat groups |
| Infrastructure | Layers 3 and 4, first-class | Absent |
| Security tooling as target | Layer 6, explicit | Absent |
| Agent marketplace | Layer 7, explicit | Absent |
OWASP declined MAESTRO deliberately. The ASI document “declines to use STRIDE or MAESTRO and instead maps threats onto components” (see agentic-reference-architecture) while separately recommending practitioners evaluate MAESTRO. It does not explain the choice. The component model’s advantage is visible in the outcome: OWASP’s threats each carry scenarios and controls, and its decision path makes 17 threats scopeable, where MAESTRO’s ~60 arrive flat.
They are not independent sources. Ken Huang authored MAESTRO and is a core contributor to the OWASP Top 10 for LLM Applications. Agreement between them is not corroboration — a point that matters because the vault’s root index counts independent confirmations of the agentic gap. MAESTRO is not a sixth.
Layers to ASI threats
| MAESTRO layer | ASI threats landing here | Coverage verdict |
|---|---|---|
| L7 Agent Ecosystem | T2, T6, T9, T8, T13, T17 | MAESTRO wider — registry, discovery, marketplace, pricing have no ASI counterpart |
| L6 Security & Compliance | — | MAESTRO only — no ASI threat targets the defence |
| L5 Evaluation & Observability | T8 partially | MAESTRO wider — ASI has no threat against monitoring itself |
| L4 Deployment & Infrastructure | — | MAESTRO only — ASI has no infrastructure layer |
| L3 Agent Frameworks | T17, T11 | Comparable; MAESTRO adds framework evasion |
| L2 Data Operations | T1, T5, T12 | ASI deeper — T1 memory poisoning has no MAESTRO equivalent |
| L1 Foundation Models | T6 partially | ASI shallower here by design; MAESTRO carries adversarial ML |
| Cross-layer | T5, T12, T14 | Comparable; MAESTRO’s goal-misalignment cascade is the sharper framing |
ASI threats to layers
The reverse direction is where the ASI model shows its strength — its threats are behavioural, so several span the whole stack rather than sitting in one layer:
| ASI threat | MAESTRO layer(s) | Note |
|---|---|---|
| T1 Memory Poisoning | L2 | MAESTRO has data poisoning and compromised RAG, but nothing on memory as a distinct surface |
| T2 Tool Misuse | L7 (“agent tool misuse”) | Same threat, one sentence versus a full ASI treatment |
| T3 Privilege Compromise | Cross-layer (privilege escalation) | MAESTRO frames it as movement between layers, not role inheritance |
| T4 Resource Overload | L1, L4 (DoS entries) | MAESTRO’s L1 sponge-attack detail exceeds T4’s |
| T5 Cascading Hallucination | Cross-layer (goal misalignment cascades) | Different framing: goals versus content |
| T6 Intent Breaking | L7 (“agent goal manipulation”) | ASI far deeper — planning, reasoning and reflection loops |
| T7 Misaligned & Deceptive | §2.7 gaps (goal misalignment) | MAESTRO names it as a gap in other frameworks and then does not model it |
T8 Repudiation | L7 (“repudiation”), L5 | Both weak. See agent-observability-and-logging |
| T9 Identity Spoofing | L7 (impersonation, identity attack) | Comparable; MAESTRO adds Sybil via the distributed pattern |
| T10 Overwhelming HITL | HITL pattern only | ASI only — MAESTRO’s HITL threat is input manipulation, not reviewer overload |
| T11 Unexpected RCE | L3 (input validation attacks) | ASI more specific about AI-generated execution environments |
| T12 Agent Communication Poisoning | Multi-agent pattern | Comparable |
| T13 Rogue Agents | L7 (compromised agents) | Comparable |
| T14 Human Attacks on MAS | Hierarchical pattern | Comparable |
| T15 Human Manipulation | — | ASI only — MAESTRO has no threat where the agent steers the human |
| T16 Protocol Abuse | L3 partially | ASI only — MAESTRO predates the MCP/A2A threat framing entirely |
| T17 Supply Chain | L3, cross-layer | Comparable |
The four real disagreements
1. Is infrastructure in scope? MAESTRO says yes — two of seven layers are frameworks and deployment, with Kubernetes and IaC threats named. ASI says no by omission; its component model stops at “supporting services.” MAESTRO is right that a compromised container reaches the agent, and its cross-layer chain (L4 → L2 → L1) is the argument. ASI’s counter is implicit: those threats are not agentic, and a threat model that includes all of cloud security stops being scopeable.
2. Is the security tooling a target? MAESTRO’s Layer 6 says yes. ASI never asks. MAESTRO wins this outright — it is the vault’s only coverage, and it inverts a recommendation that appears throughout the control catalogue, where AI-based detection is proposed as a control without noting that the control inherits the threat model of the thing it protects.
3. Is memory a distinct surface? ASI says yes, emphatically — memory and tools are named as the two key agentic attack vectors, and T1 gets a full treatment. MAESTRO folds memory into Layer 2 data operations and never separates it. ASI wins: memory is written by the agent’s own reasoning, which is what makes it different from a database, and it is the mechanism behind T1, T5 and context poisoning alike.
4. Where is human oversight? ASI treats the human as a component of the system with its own failure modes — reviewer fatigue (T10) and manipulation of the human by the agent (T15). MAESTRO’s human-in-the-loop pattern models only the reverse: an attacker manipulating human input to skew the agent. ASI wins, and the asymmetry is telling — MAESTRO’s model has no place to put a threat whose target is a person.
The patterns, side by side
Both frameworks enumerate agentic architecture patterns. MAESTRO’s eight against ASI’s nine (source: Agentic AI Threat Modeling Framework_ MAESTRO.md, §4; Agentic-AI-Threats-and-Mitigations-1.1.pdf, pp. 10–11):
| Pattern | MAESTRO’s canonical threat | ASI equivalent |
|---|---|---|
| Single-Agent | Goal manipulation | — (implicit baseline) |
| Multi-Agent | Communication channel attack; identity attack | Coordinating Agent |
| Unconstrained Conversational Autonomy | Prompt injection / jailbreaking | — MAESTRO only |
| Task-Oriented Agent | DoS through overload | Task-Oriented Agent |
| Hierarchical Agent | Compromise of a higher-level agent to control subordinates | Hierarchical Agent |
| Distributed Agent Ecosystem | Sybil attack via agent impersonation | Distributed Agent Ecosystem |
| Human-in-the-Loop Collaboration | Manipulation of human input/feedback | Human-in-the-Loop Collaboration |
| Self-Learning and Adaptive | Data poisoning via backdoor trigger injection | Self-Learning and Adaptive |
| — | — | Reflective Agent, RAG-Based Agent, Planning Agent, Context-Aware Agent |
Six of eight patterns match, with the same names. The differences are the informative part:
- MAESTRO’s Sybil attack framing has no ASI counterpart. T13 covers rogue agents; Sybil is specifically manufacturing many identities to gain disproportionate influence over consensus or market dynamics. That is a distinct attack and MAESTRO is the vault’s only source on it in an agentic context.
- ASI’s four extra patterns are all about the agent’s internal reasoning — reflection, planning, retrieval, context-awareness. MAESTRO has no patterns at that level, consistent with disagreement 3 above.
- MAESTRO’s “unconstrained conversational autonomy” is not a pattern, it is an absence of a control, and its threat (prompt injection) applies to every pattern in both lists. Treat it as a note rather than an architecture.
Each MAESTRO pattern carries exactly one threat and one or two mitigations, which is a useful format and an unrealistic model — a hierarchical agent is exposed to considerably more than higher-level compromise.
How to use both
- Scoping a specific agent deployment → ASI’s decision path (agentic-threat-taxonomy). It prunes; MAESTRO does not.
- Reviewing whether the platform is secure, not just the agent → MAESTRO’s layers 3 and 4.
- Deploying agents as security tooling → MAESTRO Layer 6, the only source.
- Building or buying from an agent marketplace → MAESTRO Layer 7, the only source.
- Writing controls → ASI playbooks, then the control catalogue. MAESTRO’s controls are too coarse to implement from.
- Threat-modelling MCP or A2A → ASI only (inter-agent-protocol-abuse). MAESTRO is a February 2025 document and does not address the protocols.
Related pages
- maestro-seven-layers — the layers in detail
- maestro-framework — the MAESTRO source page
- agentic-reference-architecture — the ASI component model
- agentic-threat-taxonomy — T1–T17 and the decision path
- owasp-mapping — ASI against the LLM Top 10
- ATLAS and PITAX — the same exercise for two other taxonomies