Summary: Controls organised by control rather than by threat, each showing which frameworks in this vault call for it. Multi-framework agreement is the ranking signal.
Sources: synthesis across raw/MITRE-ATLAS/, raw/Laws/, raw/Agentic/, raw/Supply-chain-attacks/, raw/Data-poisoning/, raw/AI-incident-response/, raw/OWASP-Top-10-for-LLMs/, raw/Model-theft/
Last updated: 2026-07-30
Every source here organises defences by the threat they answer. That is the wrong axis for anyone building — you implement a control once and it covers many threats. This page inverts it.
Framework keys: ATLAS = MITRE ATLAS mitigations · CoP = EU Code of Practice Appendix 4 · ASI = OWASP Agentic Security Initiative playbooks · T10 = OWASP Top 10 for LLMs · SC = supply chain sources (Google, OpenSSF, Plexal/Oxford) · DP = data poisoning sources (CMU, health care review) · IR = incident response sources (CoSAI, Microsoft) · MAE = CSA MAESTRO · OBS = agent observability implementation (Realm) · ENG = agent reliability engineering (Galileo)
MAEis not an independent vote. Ken Huang authored MAESTRO and contributes to the OWASP Top 10, soMAEagreeing withASIorT10does not raise a control’s tier. Its controls are also stated at framework level and mapped to no individual threat — ~14 controls for ~60 threats. WhereMAEappears below it is for coverage no one else offers, not for agreement. See the crosswalk.
One finding here changes how to read the whole page. MAESTRO Layer 6 models attacks on AI systems used as security tooling — evasion, poisoning their operational data, extracting the detection model to learn how to bypass it. Every control below that is itself AI-based — guardrails, anomaly detection, alignment critics, trust scoring, the entire model-checks-model pattern — inherits the full threat model of the thing it protects. No other source in the corpus says this.
Tier 1 — Four or more frameworks agree
These are the controls to implement first. Agreement across independently-built frameworks is the strongest evidence the corpus offers.
| Control | Frameworks | Notes |
|---|---|---|
| Telemetry and audit logging | ATLAS CoP ASI IR OBS MAE + AI Act Art 12 | The precondition for everything else. OBS is the corpus’s only field-level schema; MAE is the only source that treats the log as a target. See telemetry-and-logging |
| Least privilege / access control | ATLAS CoP ASI T10 DP | Applies to model, agent, tools, and training data alike |
| Sandboxing and execution isolation | ATLAS CoP ASI SC | CoP requires it against model self-exfiltration; ASI requires destroy-after-execution |
| Provenance / cryptographic signing | SC DP ASI ATLAS | Signing extends to prompt templates and tool definitions in ASI |
| Rate limiting | ATLAS CoP ASI T10 | Token-aware, not request-count. Also the anti-extraction control |
| Red teaming | CoP ASI SC DP | CoP distinguishes infrastructure red teaming from model adversarial testing — different exercises, different teams |
Tier 2 — Two or three frameworks
| Control | Frameworks | Notes |
|---|---|---|
| Input and output validation | ATLAS T10 SC | LLM05 implemented; output treated as untrusted input |
| Guardrails / content filtering | ATLAS T10 ASI | Probabilistic control against an adversary with unlimited attempts |
| Human approval for sensitive operations | ASI SC T10 | Degrades under load — see T10 |
| MFA / strong authentication | CoP ASI | ASI extends to mutual agent-to-agent authentication |
| Data validation before training | DP CoP SC | CoP: “inspect training data for tampering or sabotage” |
| Anomaly / drift detection | DP ASI IR | Hardest part is distinguishing attack from natural drift |
| Session isolation | ASI T10 | Prevents cross-user memory contamination |
| Model alignment and refusal training | ATLAS CoP | CoP Commitment 5; ATLAS AML.M00* |
| SBOM / dependency inventory | SC ASI | ASI adds AI SBOM / AIBOM / Agent SBOM |
| Encryption at rest and in transit | CoP SC | CoP specifies 256-bit and TPM key storage |
| Staged / phased deployment | DP IR CoP | CoP allows phasing “to correspond with model capability advancement” |
| Personnel vetting and insider programmes | CoP SC | CoP scopes insider threat to include “by or through models” |
Tier 3 — Single framework, still worth having
Distinctive controls that only one source names. Several are among the most concrete in the corpus.
| Control | Source | Why it matters |
|---|---|---|
| Attested TEEs for parameters in use | CoP 4.2 | Closes the memory-dump path. Materially higher bar than most production ML infra meets |
| Secure registry of every device holding weights | CoP 4.2 | You cannot protect copies you have not enumerated |
| Output rate limiting on interfaces | CoP 4.3 | Anti-exfiltration; also constrains gradient-based and best-of-N attacks |
| Chain of custody signing the data–label pairing | DP | Answers the attacker who “modif[ies] some labels, leaving the images themselves unaltered” |
| MEDLEY ensemble disagreement monitoring | DP | Preserve disagreement rather than collapsing to consensus; monitor patterns, not cases |
| Spotlighting / context isolation | SC | Structurally mark untrusted context. Its own mechanism is an attack surface |
| User Alignment Critic isolated from poisoned context | SC (Google) | Isolation is the load-bearing property |
| Pin container images by immutable digest | SC (OpenSSF) | Verify with cosign/notation, enforce via admission controller |
| Limit the agent’s ability to print links | ASI T15 | Narrow, cheap, directly defeats link-rendering exfiltration |
| Destroy or reset the sandbox after each tool execution | ASI PB3 | Blocks persistence and lateral movement between invocations |
| Just-in-time tool access with immediate revocation | ASI PB3 | Grant on demand only |
| Topology segmentation of multi-agent systems | ASI PB6 | Shrinks the graph an attacker traverses |
| Decision approval discrepancy tracking | ASI PB6 | Catches orchestration hijacking, which looks clean to every individual agent |
| Knowledge lineage tracking | ASI PB2 | Does not prevent cascades; the only control that lets you find the origin and roll back |
| AI gateway as security control plane | SC | One chokepoint to instrument — precondition for telemetry |
| Responder wellbeing / rotation protocols | IR | Explicitly costs capacity; “a deliberate investment, not a free addition” |
| Procurement security requirements | SC | Already functioning as a control: 28% of orgs had changed vendors over trust issues |
| Correlation IDs spanning agent and tool actions | OBS | Makes the task the investigable unit, not the log line. The cheapest item on this page and a precondition for attributing any tool call to the principal that caused it |
| Principal identity on every tool invocation | OBS | principal_user_id. Without it the confused deputy is not merely exploitable but unauditable |
| Cap the agent’s tool count | ENG | Quantified: 46 tools failed where 19 succeeded, independent of context-window space. Least privilege on toolsets now has a reliability argument attached — the version an engineering team will actually act on |
| Per-agent context isolation | ENG SC | Sub-agents with independent windows and a coordinator seeing only summaries. Blast-radius containment for context poisoning, and the strongest empirical case in the corpus: +90% performance at 15× the tokens. Does not work where subtasks interact (e.g. coding) |
| Cap context length for guardrail-critical agents | ENG | Instruction adherence degrades past ~100k tokens; at threshold models “ignore instructions entirely”. No source frames this as a control — it follows from the measurement |
| Approved-registry enforcement for MCP servers and agents | MAE OBS | MAE Layer 7 names registry compromise and malicious agent discovery; OBS supplies source_mcp_server as the field that detects drift from the approved list |
| Treat AI-based controls as in-scope for the threat model | MAE | Layer 6. Not a control so much as a scoping rule, and the corpus’s only statement of it |
Controls named but not solved
Prescribed somewhere in the corpus while the underlying capability does not reliably exist. Treat as research directions, not roadmap items.
| ”Control” | Source | Status |
|---|---|---|
| Cryptographic attestation of agent/model integrity | ASI T13 | Source states plainly these mechanisms “do not yet exist” for LLMs |
| Probabilistic truth-checking of new knowledge | ASI PB2 | No method given for establishing truth |
| Agent trust scoring | ASI PB6 | No scoring function specified |
| Deception detection / truthfulness verification models | ASI T7 | Threat itself conceded to be “at an early stage” |
| Behavioural consistency analysis | ASI T7, T9 | Requires a model of honest behaviour that nobody has |
| Assured service verification | SC | ”Lack of metrics and standards for assured service provision” |
| Formal verification of agent behaviour and goal alignment | MAE | Stated in a single clause with no method, no tooling and no tractability caveat. The most ambitious “control” in the corpus |
| Immutable audit trails | ASI OBS | Universally prescribed; the corpus’s one implementation asserts immutability without implementing it — nothing signs, chains or write-protects the log. See telemetry-and-logging |
| Correction of a poisoned context by instruction | — | Not prescribed anywhere, but widely assumed. Measured to fail: corrections and the original error coexist with comparable weight, and “the agent trusts its own context more than external corrections” |
The model-checks-model pattern
Appearing in ASI (T6, T7, T9, T15), SC (Google’s alignment critic), and DP (MEDLEY ensembles). It is the default answer wherever rules cannot catch the threat, and it has one genuine design rule attached, from Google via StackHawk:
the critic must be isolated from the potentially poisoned context.
A checker sharing the context inherits the compromise. In a multi-agent setting the checker also becomes part of the T13 surface it was deployed to police. MEDLEY’s version is the most defensible because its diversity is architectural — “models with different architectures, training algorithms, and data origins are unlikely to share identical vulnerabilities.”
MAESTRO makes the objection structural rather than contextual. Its Layer 6 is the whole pattern’s threat model written out: a security agent can be evaded adversarially, have its operational data poisoned so it misidentifies threats, have its model extracted so an attacker learns the bypass, or be taken over and used to disable other controls. Isolation from the poisoned context — Google’s rule — answers only the second of those four.
Two consequences for this page. First, every ASI control resting on a model checking a model is weaker than its tier suggests. Second, context isolation earns its place above on both readings: it is the one intervention that limits what a compromised checker can see and what a poisoned context can reach.
Related pages
- defense-in-depth — the same controls arranged by layer
- mitigation-frameworks — what each framework is for
- where-defenses-fail — the limits
- telemetry-and-logging — the Tier 1 control everything depends on
- ATLAS mitigations · ASI playbooks · CoP Appendix 4