Scope boundary

Owns provenance-aware, risk-tiered admission and promotion of AI-generated or AI-materially-modified source code, infrastructure-as-code, workflows, dependency changes, deployment definitions, build scripts, and repository automation through the organization's SDLC.

AID-H-030: AID-H-031 governs internally generated development changes through merge, build, release, and deployment; AID-H-030 admits externally sourced agentic skill artifacts for installation or execution. The artifact origin, review context, and authorized destination determine which family owns the decision.

AID-H-003: AID-H-031 governs the additional provenance and promotion risk created by AI-authored development changes; AID-H-003 governs general AI or ML supply-chain component integrity and admission. AI-generated changes still pass ordinary supply-chain controls.

Warning

Medium on CI/CD Latency and Review Friction

Proper admission control adds validation stages before merge or promotion. Expect higher pipeline latency for repositories that allow AI-authored changes, especially when dynamic validation or named approval is required.

Guidance: use tiered policies. Low-risk documentation or test-only changes can pass lighter gates, while secrets handling, identity, infrastructure, deployment, payment, and data-destruction paths should require the strictest review.

Sub-techniques

• AID-H-031.001: AI-Generated Change Provenance & Risk Labeling
• AID-H-031.002: Static Admission Gates for AI-Generated Artifacts
• AID-H-031.003: Dynamic Promotion Validation with Ephemeral Sandboxes
• AID-H-031.004: Evidence-Bound Promotion & High-Risk Human Approval

Threat mappings

MITRE ATLAS

• AML.T0010 AI Supply Chain Compromise
• AML.T0010.001 AI Supply Chain Compromise: AI Software
• AML.T0011 User Execution
• AML.T0011.000 User Execution: Unsafe AI Artifacts
• AML.T0011.001 User Execution: Malicious Package
• AML.T0060 Publish Hallucinated Entities
• AML.T0095.000 Search Open Websites/Domains: Code Repositories

MAESTRO

• Compromised Framework Components (L3)
• Compromised Container Images (L4)
• Infrastructure-as-Code (IaC) Manipulation (L4)
• Resource Hijacking (L4)
• Supply Chain Attacks (Cross-Layer)
• Privilege Escalation (Cross-Layer)

OWASP LLM Top 10 2026

• LLM04:2026 Supply Chain
• LLM10:2026 Improper Output Handling

OWASP ML Top 10 2023

• ML06:2023 AI Supply Chain Attacks

OWASP Top 10 for Agentic Applications 2026

• ASI04:2026 Agentic Supply Chain Vulnerabilities
• ASI05:2026 Unexpected Code Execution (RCE)

NIST Adversarial Machine Learning 2025

• N/A

Cisco Integrated AI Security and Safety Framework

• AITech-2.1 Excessive Agency
• AITech-2.3 Reward Hacking
• AITech-8.3 Information Disclosure
• AITech-9.3 Dependency / Plugin Compromise
• AITech-12.2 Insecure Output Handling
• AISubtech-2.1.1 Execution Approval Bypass
• AISubtech-2.3.2 Verifier Manipulation
• AISubtech-9.3.1 Malicious Package / Tool Injection
• AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
• AISubtech-12.2.1 Code Detection / Malicious Code Output

Google Secure AI Framework 2.0 - Risks

• MDT: Model Deployment Tampering
• IIC: Insecure Integrated Component
• IMO: Insecure Model Output

Databricks AI Security Framework 3.0

• Governance 4.1: Lack of traceability and transparency of model assets
• Algorithms 5.1: Lack of tracking and reproducibility of experiments
• Model 7.3: ML Supply chain vulnerabilities
• Model 7.4: Source code control attack
• Platform 12.4: Unauthorized privileged access
• Platform 12.5: Poor security in the software development lifecycle
• Agents - Core 13.11: Unexpected RCE and Code Attacks