Append-only. Newest entries at the bottom.
2026-07-29 — Collection created as cross-collection synthesis
Request: “create a wiki for mitigations.”
Interpretation and the assumption made: there is no raw/Mitigations/ folder, so this could not be a source-paired collection on the usual convention. Two readings were available — scaffold an empty collection awaiting sources, or synthesise the mitigation material already ingested across the vault. The second was chosen without asking, on the grounds that the vault holds four attack taxonomies and four control sets, and nothing compared the control sets. If a dedicated defensive source (OWASP Securing Agentic Applications Guide, NIST SSDF) is later added to raw/, it should get its own paired collection and be linked from here rather than absorbed.
No new sources were read. Every claim traces to material already in raw/ and already summarised in another collection. Source pages consulted:
wiki/mitre-atlas-wiki/atlas-mitigations.mdwiki/laws-wiki/code-of-practice-security-mitigations.mdwiki/data-poisoning-wiki/poisoning-defenses.mdwiki/supply-chain-attacks-wiki/securing-llm-applications.mdwiki/supply-chain-attacks-wiki/provenance-and-assurance.mdwiki/ai-incident-response-wiki/ai-incident-response.mdwiki/agentic-wiki/agentic-mitigation-playbooks.md(created earlier this session)
Organising principle: controls are indexed by control, not by threat. Every upstream source organises defensively-by-threat, which is the wrong axis for anyone building — a control is implemented once and covers many threats. Multi-framework agreement is used as the ranking signal, on the reasoning that independently-built frameworks converging on a control is the strongest evidence the corpus offers.
Pages created (6):
| Page | Type |
|---|---|
index.md | Collection index |
log.md | This log |
control-catalogue.md | Controls by control, tiered by cross-framework agreement |
defense-in-depth.md | Six defensive layers, with per-layer failure modes |
mitigation-frameworks.md | ATLAS / CoP App. 4 / ASI / Top 10 compared |
where-defenses-fail.md | Nine structural limits, each sourced to a concession |
telemetry-and-logging.md | The one universally-required control |
Root index: collection entry added to wiki/index.md, plus a “Four taxonomies, four control sets” section pairing each attack taxonomy with its control counterpart.
New syntheses produced here that no single source states:
- Telemetry is required by all five frameworks independently (ATLAS, CoSAI, Microsoft, ASI, AI Act Art 12) — stronger agreement than anything the four attack taxonomies share.
- Provenance-beats-detection is reached independently in three domains — CMU for training data, Google for weights, ASI for agent memory. Previously noted pairwise in
provenance-and-assurance.md; the third instance is new. - Agent defensive posture is set by the least-guarded invocation route (MCP/A2A, stolen agent identity), because nearly every approval control sits on the conversational path.
- Roughly a third of ASI playbook controls name capabilities with no reliable implementation; sorted explicitly in
control-catalogue.md. - Secure design is uncovered by all four control sets — all are runtime or organisational.
Stale claim found and corrected: wiki/supply-chain-attacks-wiki/securing-llm-applications.md line 87 read “The OWASP Agentic Security Initiative is the nearest thing the vault knows about,” written when ASI was not ingested. ASI was ingested earlier today. Updated to link agentic-wiki directly.
Deliberately not done:
- No duplication of upstream pages. Where a control is fully treated elsewhere (chain of custody, Appendix 4 families, the six playbooks), this collection links rather than restates.
- No per-control pages. The catalogue is one page; splitting ~50 controls into individual pages would add navigation cost without adding content.
Open gaps recorded on the index: secure design uncovered (MAESTRO named but no primary source held); NIST SSDF and the CoSAI framework PDF still absent; no cost or effort data for any control; model-theft-wiki/model-theft-defenses.md overlaps Tier 1 rate limiting and CoP 4.3 but predates the cross-referencing and has not been reconciled.
2026-07-30 — Reconciled against three new agentic sources
Trigger: not a request for this collection. Three sources were ingested into agentic-wiki and this collection claims to hold every control in the vault, so that claim went stale the moment they landed. Reconciled in the same session rather than left to drift.
Sources reconciled (all read in full during the agentic-wiki ingest; nothing new read here): raw/Agentic/Agentic AI Threat Modeling Framework_ MAESTRO.md, raw/Agentic/Security Monitoring for AI Agents and MCP.md, raw/Agentic/Mastering Multi-Agent Systems eBook.pdf (ch. 4).
Three new framework keys in control-catalogue.md: MAE (MAESTRO), OBS (Realm agent observability), ENG (Galileo reliability engineering).
MAE is explicitly excluded from the tiering signal. Ken Huang authored MAESTRO and contributes to the OWASP Top 10, so MAE agreeing with ASI or T10 is not independent corroboration and must not raise a control’s tier. Recorded as a blockquote at the top of the catalogue, because the tier numbers are the page’s whole ranking mechanism and a reader adding a fourth key to a Tier-2 row would silently corrupt it. Same caveat added to the root index and agentic-wiki/index.md finding 1.
Changes:
control-catalogue.md— three keys added; Tier 1 telemetry row extended withOBSMAE; seven new Tier 3 controls (correlation IDs, principal identity per tool call, cap tool count, per-agent context isolation, cap context length, approved-registry enforcement, treat AI-based controls as in-scope); three new “named but not solved” rows (formal verification of goal alignment; immutable audit trails, now demoted because the corpus’s one implementation only asserts immutability; and correction-by-instruction, which is not prescribed anywhere but widely assumed and measured to fail). Model-checks-model section extended with MAESTRO Layer 6.telemetry-and-logging.md— sixth and seventh converging sources; a new “A concrete schema” section with the four security-bearing fields, and what the schema omits; the provenance-not-falsity argument added to the closing gap section.index.md— findings 7 and 8 added; the secure-design gap rewritten (see below); a threat-modelling row added to “where to start”.
The secure-design gap moved rather than closed. It was recorded on 2026-07-29 as “MAESTRO is the named candidate and no primary source is held.” The primary is now held, and it does supply the missing design-time activity — a decomposition and a method to run before code exists. It does not supply prioritisation (its own step 4 references a risk matrix that appears nowhere in the document) or per-threat controls (~14 framework-level controls for ~60 threats). The vault can now enumerate design-time threats and still cannot rank them. Noted on the index that PASTA and OCTAVE, which MAESTRO critiques, are strongest at exactly the prioritisation it omits.
Two findings added, both of which discount material already on these pages:
- An AI-based control inherits the threat model of what it protects (MAESTRO Layer 6). Every control in this collection resting on a model checking a model — guardrails, anomaly detection, alignment critics, trust scoring — is weaker than its tier suggests. Google’s “isolate the critic from the poisoned context” answers one of MAESTRO’s four routes; evasion, model extraction and takeover are unanswered.
- Detection must key on provenance, not falsity. Context poisoning is now measured occurring with no attacker at all, continuously. A detector evaluating content on its merits fires constantly and means nothing. This is a second, independent route to finding 2 (provenance beats detection) — arrived at from reliability engineering rather than from security, which makes it the stronger version.
Deliberately not done: no new pages. The three sources add controls and caveats to existing pages; none warrants its own, and the collection’s no-per-control-pages rule stands. The Realm log schema lives on agentic-wiki/agent-observability-and-logging.md as its source page and is summarised here rather than duplicated.
New gaps recorded: no SIEM rule set anywhere in the corpus to consume the log schema (the alert logic on the observability page is this wiki’s inference, not sourced); MAESTRO’s absent risk matrix; the primaries behind the ENG measurements are all untraced.