AID-H-004: Identity, Access & Trusted Communication for AI Systems
Establish trusted human and machine identities, authenticate and authorize access to AI resources, verify agent discovery information, and protect security-relevant messages across communication trust boundaries. This family covers users, workloads, services, APIs, agents, data stores, tools, and administrative interfaces; its sub-techniques define the independently implementable controls.
Scope boundary
Owns preventive identity, authentication, discovery provenance, communication integrity, and access controls for human users, workloads, services, APIs, agents, data stores, tools, and administrative AI surfaces.
Sub-techniques
- AID-H-004.001: User & Privileged Access Management
- AID-H-004.002: Service & API Authentication
- AID-H-004.003: Secure Agent-to-Agent Communication
- AID-H-004.004: Verified Agent Discovery, Agent Cards & Registry Provenance
- AID-H-004.005: End-to-End Message Integrity, Freshness & Replay Protection
- AID-H-004.006: Hosted Agent Publication & Exposure Controls
- AID-H-004.007: External Event-to-Agent Admission & Authority Binding
Threat mappings
MITRE ATLAS
- AML.T0006 Active Scanning
- AML.T0006.000 Active Scanning: Enumerate Hosted AI Resources
- AML.T0006.003 Active Scanning: Probe AI Agent Trigger Channels
- AML.T0012 Valid Accounts
- AML.T0021 Establish Accounts
- AML.T0036 Data from Information Repositories
- AML.T0037 Data from Local System
- AML.T0040 AI Model Inference API Access
- AML.T0044 Full AI Model Access
- AML.T0055 Unsecured Credentials
- AML.T0073 Impersonation
- AML.T0074 Masquerading
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.001 AI Agent Context Poisoning: Thread
- AML.T0091 Use Alternate Authentication Material
- AML.T0118 Autonomous AI Agent Communication
- AML.T0118.001 Autonomous AI Agent Communication: Direct Agent Communication
- AML.T0122 Exploitation of Remote Services
- AML.T0124 Autonomous Attack Orchestration
- AML.T0125 Create Account
- AML.T0132 Misconfigured or Publicly Exposed AI Services
MAESTRO
- Agent Impersonation (L7)
- Agent Identity Attack (L7)
- Integration Risks (L7)
- Compromised Agent Registry (L7)
- Malicious Agent Discovery (L7)
- Lateral Movement (Cross-Layer)
- Privilege Escalation (Cross-Layer)
OWASP LLM Top 10 2026
- LLM03:2026 Excessive Agency
OWASP ML Top 10 2023
- ML05:2023 Model Theft
OWASP Top 10 for Agentic Applications 2026
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI07:2026 Insecure Inter-Agent Communication
NIST Adversarial Machine Learning 2025
- N/A
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AITech-3.1 Masquerading / Obfuscation / Impersonation
- AITech-4.1 Agent Injection
- AITech-4.3 Protocol Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-14.1 Unauthorized Access
- AITech-14.2 Abuse of Delegated Authority
- AITech-16.1 Eavesdropping
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-3.1.1 Identity Obfuscation
- AISubtech-3.1.2 Trusted Agent Spoofing
- AISubtech-4.1.1 Rogue Agent Introduction
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-4.3.2 Namespace Collision
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-4.3.5 Capability Inflation
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
Google Secure AI Framework 2.0 - Risks
- MXF: Model Exfiltration
- IIC: Insecure Integrated Component
Databricks AI Security Framework 3.0
- Raw Data 1.1: Insufficient access controls
- Model Management 8.2: Model theft
- Model Serving - Inference requests 9.11: Model Inference API Access
- Platform 12.4: Unauthorized privileged access
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.9: Identity Spoofing & Impersonation
- Agents - Core 13.12: Agent Communication Poisoning
- Agents - Core 13.14: Human Attacks on Multi-Agent Systems
- Agents - Tools MCP Server 13.17: Confused Deputy
- Agents - Tools MCP Server 13.25: Insecure Communication