AID-I-003.001: Detection-Driven Quarantine & Safe-Mode Downgrade

Version 1.20261015 · Actionable sub-technique

Convert high-confidence detector findings, health signals, trust-state demotions, or analyst-approved SOAR decisions into bounded quarantine, safe-mode, or hard-containment actions. This sub-technique owns signed finding intake, target resolution, containment playbook execution, degraded-mode state, escalation from soft throttling to hard containment, and post-action verification.

A2A containment: Disable or quarantine the contained agent's peer registrations, discovery advertisements, message routes, delegated leases, and pending cross-agent work so isolation covers inter-agent execution paths as well as user-facing endpoints.

Pillars: infra, app

Lifecycle: response

Scope boundary

Owns reversible detection-driven quarantine, safe-mode downgrade, hard-containment playbook execution, target resolution, and post-action verification. It consumes signed findings or decisions and does not compute anomaly scores or perform long-term eviction.

AID-E-002: AID-I-003.001 applies reversible detection-driven quarantine or safe mode; AID-E-002 terminates confirmed-compromised active execution and revokes execution leases. Escalate to E-002 when continued runtime existence is no longer acceptable; do not report a quarantine state as process or pod eviction.

AID-I-005: AID-I-003.001 contains a resolved target through quarantine or degraded mode; AID-I-005 issues and enforces a last-resort system-wide or tenant-wide halt. A target-scoped safe mode can be an input to escalation, but it does not satisfy global halt coverage or restart-gate evidence.

Implementation guidance

AID-I-003.001-G001

Apply reversible quarantine or safe-mode downgrade from an authenticated high-risk finding; credential, session, principal, or grant revocation remains an AID-E-001 action with separate evidence.
Required alert and trust inputs

Use this method when a signed detection receipt nominates one concrete principal, session, workload, source address, or tenant for containment. The responder does not trust queue-body confidence, target IDs, or requested actions. A signature-verifying adapter checks the detector issuer/audience, schema, target binding, source evidence digest, policy version, freshness, and replay nonce. A separately signed containment policy maps the verified finding class and asset type to one bounded action. Network/session quarantine is owned here; credential revocation and decoy routing remain separate dependency actions with independently verified receipts.

Idempotent containment transaction
# File: response/verified_quarantine.py
from __future__ import annotations

from dataclasses import dataclass
from typing import Callable


@dataclass(frozen=True)
class VerifiedAlert:
    alert_id: str
    incident_id: str
    target_type: str
    target_id: str
    finding_class: str
    evidence_sha256: str
    receipt_sha256: str


@dataclass(frozen=True)
class VerifiedContainmentPolicy:
    policy_sha256: str
    scope_id: str
    action_by_finding_and_target: dict[tuple[str, str], str]


@dataclass(frozen=True)
class ContainmentAuthority:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    claim_once: Callable[[VerifiedAlert, str, VerifiedContainmentPolicy], dict[str, object]]
    apply: Callable[[dict[str, object]], dict[str, object]]
    read_effective_state: Callable[[dict[str, object]], dict[str, object]]
    finalize: Callable[[dict[str, object], str], None]


@dataclass(frozen=True)
class EvidenceWriter:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    append_and_verify: Callable[[dict[str, object]], dict[str, str]]


def quarantine(
    *,
    alert: VerifiedAlert,
    policy: VerifiedContainmentPolicy,
    authority: ContainmentAuthority,
    evidence: EvidenceWriter,
) -> dict[str, object]:
    key = (alert.finding_class, alert.target_type)
    if key not in policy.action_by_finding_and_target:
        event = {
            "schema_version": "aidefend.quarantine.v1",
            "control": "AID-I-003.001",
            "alert_id": alert.alert_id,
            "incident_id": alert.incident_id,
            "target_type": alert.target_type,
            "target_id": alert.target_id,
            "policy_sha256": policy.policy_sha256,
            "outcome": "NOT_APPLICABLE",
        }
        return {"outcome": "NOT_APPLICABLE", "evidence": evidence.append_and_verify(event)}

    action = policy.action_by_finding_and_target[key]
    lease = authority.claim_once(alert, action, policy)
    try:
        action_receipt = authority.apply(lease)
        state = authority.read_effective_state(lease)
        expected = {
            "target_type": alert.target_type,
            "target_id": alert.target_id,
            "action": action,
            "policy_sha256": policy.policy_sha256,
            "lease_id": lease["lease_id"],
        }
        for field, value in expected.items():
            if state.get(field) != value:
                raise PermissionError("effective containment mismatch: " + field)
        if state.get("contained") is not True:
            raise PermissionError("target is not effectively contained")
        final = evidence.append_and_verify({
            "schema_version": "aidefend.quarantine.v1",
            "control": "AID-I-003.001",
            "alert_id": alert.alert_id,
            "incident_id": alert.incident_id,
            **expected,
            "alert_receipt_sha256": alert.receipt_sha256,
            "source_evidence_sha256": alert.evidence_sha256,
            "action_receipt_sha256": action_receipt["receipt_sha256"],
            "readback_receipt_sha256": state["receipt_sha256"],
            "outcome": "PASS",
        })
        authority.finalize(lease, "PASS")
        return {"outcome": "PASS", "evidence": final}
    except Exception:
        authority.finalize(lease, "ERROR")
        raise
Apply quarantine and verify

The authority uses a durable uniqueness key over alert, target, action, and policy; applies the provider change with optimistic concurrency; and records before/after state. For a WAF IP set it retries lock-token conflicts and preserves unrelated entries. For a session or workload it changes the exact server-side authorization/network state. Requests to disable credentials, route to a honeypot, or open tickets carry their own action-bound receipts and are evaluated by their owners; their receipts remain separate and do not change the quarantine result.

AID-I-003.001-G002

Design AI systems with a 'safe mode' or degraded functionality state.
Safe-mode authority

Implement safe mode as a versioned server-side authority, not a process-global Boolean or a default-false feature flag. A signature-verified mode policy enumerates the tenant/agent scope, monotonic version, allowed model route, tools, network destinations, write capabilities, maximum cost/resource profile, expiry, and recovery rule for each mode. The authority is the only writer; every gateway and dispatcher reads the effective version at request time and fails closed if it is missing, stale, rollbacked, or unverifiable.

The authentication adapter must fetch the immutable receipt identified by its digest, verify its signature, issuer, audience, schema, request/principal/scope binding, freshness, and revocation state, and return only the verified fields. Adapter failure is an authorization error, never an anonymous or caller-asserted fallback.

Request-time capability gate
# File: containment/safe_mode_gate.py
from __future__ import annotations

from dataclasses import dataclass
import re
from typing import Callable


MODES = {"NORMAL", "SAFE_TOOLS_ONLY", "READ_ONLY", "QUARANTINE"}
SHA256 = re.compile(r"^[a-f0-9]{64}$")


@dataclass(frozen=True)
class VerifiedModeState:
    scope_id: str
    mode: str
    version: int
    policy_sha256: str
    state_receipt_sha256: str
    allowed_capabilities: frozenset[str]
    model_route: str


@dataclass(frozen=True)
class ProposedOperation:
    request_id: str
    scope_id: str
    capability: str
    operation_sha256: str


@dataclass(frozen=True)
class RequestContextClaim:
    principal_id: str
    request_id: str
    scope_id: str
    authentication_receipt_sha256: str


@dataclass(frozen=True)
class VerifiedRequestContext:
    principal_id: str
    request_id: str
    scope_id: str
    authentication_receipt_sha256: str


@dataclass(frozen=True)
class AuthenticationAuthority:
    """Required signature-verifying authentication adapter; no fallback implementation."""
    read_verified: Callable[[str], VerifiedRequestContext]


@dataclass(frozen=True)
class ModeAuthority:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    read_verified: Callable[[str], VerifiedModeState]


@dataclass(frozen=True)
class Dispatcher:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    execute: Callable[[ProposedOperation, VerifiedRequestContext, str, int], dict[str, object]]


@dataclass(frozen=True)
class EvidenceWriter:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    append_and_verify: Callable[[dict[str, object]], dict[str, str]]


def dispatch(
    *,
    operation: ProposedOperation,
    request_context: RequestContextClaim,
    authentication: AuthenticationAuthority,
    authority: ModeAuthority,
    dispatcher: Dispatcher,
    evidence: EvidenceWriter,
) -> dict[str, object]:
    if SHA256.fullmatch(request_context.authentication_receipt_sha256) is None:
        raise PermissionError("authentication receipt digest is invalid")
    verified_context = authentication.read_verified(
        request_context.authentication_receipt_sha256
    )
    claimed = (
        request_context.principal_id, request_context.request_id,
        request_context.scope_id, request_context.authentication_receipt_sha256,
    )
    verified = (
        verified_context.principal_id, verified_context.request_id,
        verified_context.scope_id, verified_context.authentication_receipt_sha256,
    )
    if (
        not isinstance(verified_context, VerifiedRequestContext)
        or claimed != verified
        or operation.request_id != verified_context.request_id
        or operation.scope_id != verified_context.scope_id
        or not verified_context.principal_id
    ):
        raise PermissionError("operation is not bound to a verified authentication receipt")
    state = authority.read_verified(verified_context.scope_id)
    if state.scope_id != verified_context.scope_id:
        raise PermissionError("mode state scope mismatch")
    if state.mode not in MODES or state.version < 1:
        raise PermissionError("invalid effective mode state")

    if operation.capability not in state.allowed_capabilities:
        receipt = evidence.append_and_verify({
            "schema_version": "aidefend.safe-mode-decision.v1",
            "control": "AID-I-003.001",
            "request_id": operation.request_id,
            "principal_id": verified_context.principal_id,
            "authentication_receipt_sha256": verified_context.authentication_receipt_sha256,
            "scope_id": verified_context.scope_id,
            "operation_sha256": operation.operation_sha256,
            "capability": operation.capability,
            "mode": state.mode,
            "mode_version": state.version,
            "policy_sha256": state.policy_sha256,
            "state_receipt_sha256": state.state_receipt_sha256,
            "outcome": "FAIL",
        })
        return {"allowed": False, "outcome": "FAIL", "evidence": receipt}

    result = dispatcher.execute(
        operation,
        verified_context,
        state.model_route,
        state.version,
    )
    if (
        result.get("operation_sha256") != operation.operation_sha256
        or result.get("mode_version") != state.version
        or result.get("capability") != operation.capability
    ):
        raise PermissionError("dispatcher receipt is not bound to the mode decision")
    receipt = evidence.append_and_verify({
        "schema_version": "aidefend.safe-mode-decision.v1",
        "control": "AID-I-003.001",
        "request_id": operation.request_id,
        "principal_id": verified_context.principal_id,
        "authentication_receipt_sha256": verified_context.authentication_receipt_sha256,
        "scope_id": verified_context.scope_id,
        "operation_sha256": operation.operation_sha256,
        "capability": operation.capability,
        "mode": state.mode,
        "mode_version": state.version,
        "model_route": state.model_route,
        "policy_sha256": state.policy_sha256,
        "state_receipt_sha256": state.state_receipt_sha256,
        "dispatch_receipt_sha256": result["receipt_sha256"],
        "outcome": "PASS",
    })
    return {"allowed": True, "result_ref": result["result_ref"], "evidence": receipt}
Verify the safe-mode change

Entering or clearing a mode uses a compare-and-swap transaction on the durable authority, records actor/automation identity, incident, reason, previous/new version, and policy digest, then requires readback from every gateway/dispatcher replica before acknowledging convergence. Exit requires a separately authorized recovery decision; expiry never silently restores NORMAL. Enforce capabilities at the side-effect dispatcher, outbound gateway, filesystem/data service, model router, and quota authority—not only in response headers or UI.

AID-I-003.001-G003

Utilize SOAR platforms to automate quarantine/throttling actions.
Playbook contract

Treat SOAR as an orchestrator, not a trust oracle. A signature-verified playbook binds finding class, target type, required enrichment receipts, ordered actions, per-action owner/control, idempotency key, approval rule, rollback/compensation rule, and evidence schema. Alert, enrichment, and human approval inputs must be signed and bound to the same incident, target, action manifest, policy digest, and freshness window. The SOAR connector receives only the least privilege needed for its one action.

Receipt-driven executor
# File: soar/verified_playbook.py
from __future__ import annotations

from dataclasses import dataclass
from typing import Callable


@dataclass(frozen=True)
class PlaybookAction:
    action_id: str
    owner_control: str
    adapter: str
    target_type: str
    operation: str
    requires_approval: bool


@dataclass(frozen=True)
class VerifiedPlaybook:
    playbook_id: str
    policy_sha256: str
    action_manifest_sha256: str
    actions: tuple[PlaybookAction, ...]


@dataclass(frozen=True)
class VerifiedIncident:
    incident_id: str
    alert_receipt_sha256: str
    target_type: str
    target_id: str


@dataclass(frozen=True)
class ApprovalVerifier:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    consume_once: Callable[[VerifiedIncident, PlaybookAction, str], dict[str, object]]


@dataclass(frozen=True)
class ActionAdapter:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    execute_once: Callable[[VerifiedIncident, PlaybookAction, str], dict[str, object]]
    independently_read: Callable[[VerifiedIncident, PlaybookAction], dict[str, object]]


@dataclass(frozen=True)
class AdapterRegistry:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    resolve: Callable[[str], ActionAdapter]


@dataclass(frozen=True)
class EvidenceWriter:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    append_and_verify: Callable[[dict[str, object]], dict[str, str]]


def execute_playbook(
    *,
    playbook: VerifiedPlaybook,
    incident: VerifiedIncident,
    approvals: ApprovalVerifier,
    adapters: AdapterRegistry,
    evidence: EvidenceWriter,
) -> dict[str, object]:
    receipts: list[dict[str, object]] = []
    for action in playbook.actions:
        if action.target_type != incident.target_type:
            raise PermissionError("action target type mismatch")
        approval = None
        if action.requires_approval:
            approval = approvals.consume_once(
                incident,
                action,
                playbook.action_manifest_sha256,
            )
        adapter = adapters.resolve(action.adapter)
        idempotency_key = ":".join(
            (incident.incident_id, action.action_id, playbook.policy_sha256)
        )
        applied = adapter.execute_once(
            incident,
            action,
            idempotency_key,
        )
        readback = adapter.independently_read(incident, action)
        if (
            applied.get("target_id") != incident.target_id
            or readback.get("target_id") != incident.target_id
            or applied.get("operation") != action.operation
            or readback.get("operation") != action.operation
            or readback.get("effective") is not True
        ):
            raise PermissionError("SOAR action did not reach the exact target state")
        receipts.append({
            "action_id": action.action_id,
            "owner_control": action.owner_control,
            "action_receipt_sha256": applied["receipt_sha256"],
            "readback_receipt_sha256": readback["receipt_sha256"],
            "approval_receipt_sha256": (
                approval["receipt_sha256"] if approval is not None else None
            ),
        })

    final = evidence.append_and_verify({
        "schema_version": "aidefend.soar-playbook.v1",
        "control": "AID-I-003.001",
        "playbook_id": playbook.playbook_id,
        "policy_sha256": playbook.policy_sha256,
        "action_manifest_sha256": playbook.action_manifest_sha256,
        "incident_id": incident.incident_id,
        "target_type": incident.target_type,
        "target_id": incident.target_id,
        "alert_receipt_sha256": incident.alert_receipt_sha256,
        "actions": receipts,
        "outcome": "PASS",
    })
    return {"outcome": "PASS", "evidence": final}
Failure semantics and verification

Connectors must use durable idempotency, optimistic concurrency, scoped service identities, provider request IDs, bounded retries, and compensating actions defined by the signed playbook. Never continue past an unverified action unless policy explicitly defines independent branches. Ticket creation and notification are evidence/coordination actions, not proof that quarantine succeeded. Approval binds the canonical action and is consumed once; a generic chat approval is invalid.

AID-I-003.001-G004

Trip a hallucination or safety circuit breaker into a degraded operating mode when upstream health signals cross containment thresholds.
Required signed inputs

This method applies when one or more upstream controls produce signature-verified health or safety receipts for an exact tenant, agent, model/deployment version, evaluation window, and input population. It does not recompute consensus, evidence coverage, contradiction, schema, or tool-policy signals. A missing, stale, unverified, differently scoped, or incomplete upstream receipt is INSUFFICIENT_DATA and cannot retain NORMAL mode. Thresholds, correlation windows, mode mappings, hysteresis, expiry, and recovery conditions come only from a signed, monotonic breaker policy.

Durable circuit-breaker transition
# File: containment/verified_breaker.py
from __future__ import annotations

from dataclasses import dataclass
from typing import Callable


MODES = {"NORMAL", "SAFE_TOOLS_ONLY", "READ_ONLY", "QUARANTINE"}


@dataclass(frozen=True)
class VerifiedSignalBundle:
    scope_id: str
    deployment_sha256: str
    population_sha256: str
    observed_from_epoch: int
    observed_to_epoch: int
    signal_receipt_sha256s: tuple[str, ...]
    values: dict[str, float | int | bool]


@dataclass(frozen=True)
class VerifiedBreakerPolicy:
    policy_sha256: str
    scope_id: str
    version: int


@dataclass(frozen=True)
class BreakerDecision:
    mode: str
    reason_code: str
    decision_sha256: str


@dataclass(frozen=True)
class PolicyEvaluator:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    evaluate: Callable[[VerifiedSignalBundle, VerifiedBreakerPolicy], BreakerDecision]


@dataclass(frozen=True)
class ModeAuthority:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    compare_and_set: Callable[[str, int, str, str, str], dict[str, object]]
    read_all_replicas: Callable[[str], dict[str, object]]


@dataclass(frozen=True)
class EvidenceWriter:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    append_and_verify: Callable[[dict[str, object]], dict[str, str]]


def trip(
    *,
    signals: VerifiedSignalBundle,
    policy: VerifiedBreakerPolicy,
    evaluator: PolicyEvaluator,
    authority: ModeAuthority,
    expected_state_version: int,
    evidence: EvidenceWriter,
) -> dict[str, object]:
    if signals.scope_id != policy.scope_id:
        raise PermissionError("signal and policy scopes differ")
    if not signals.signal_receipt_sha256s:
        raise PermissionError("no verified upstream signal receipts")
    decision = evaluator.evaluate(signals, policy)
    if decision.mode not in MODES:
        raise PermissionError("policy evaluator returned an invalid mode")
    write = authority.compare_and_set(
        policy.scope_id,
        expected_state_version,
        decision.mode,
        decision.decision_sha256,
        policy.policy_sha256,
    )
    readback = authority.read_all_replicas(policy.scope_id)
    if (
        readback.get("mode") != decision.mode
        or readback.get("version") != write.get("version")
        or readback.get("policy_sha256") != policy.policy_sha256
        or readback.get("complete") is not True
    ):
        raise PermissionError("breaker mode did not converge across the population")
    final = evidence.append_and_verify({
        "schema_version": "aidefend.safety-breaker.v1",
        "control": "AID-I-003.001",
        "scope_id": policy.scope_id,
        "deployment_sha256": signals.deployment_sha256,
        "population_sha256": signals.population_sha256,
        "signal_receipt_sha256s": list(signals.signal_receipt_sha256s),
        "policy_sha256": policy.policy_sha256,
        "policy_version": policy.version,
        "decision_sha256": decision.decision_sha256,
        "mode": decision.mode,
        "mode_version": write["version"],
        "replica_receipt_sha256": readback["receipt_sha256"],
        "outcome": "PASS",
    })
    return {"outcome": "PASS", "mode": decision.mode, "evidence": final}
Apply and verify the transition

The separately verified policy evaluator rejects unknown/extra signals, NaN/infinity, unit or window mismatch, missing required producers, policy rollback, and stale receipts. The mode authority uses compare-and-swap and a monotonic version, records incident/reason, and never lets expiry silently restore NORMAL. Gateway, dispatcher, model router, write path, tool path, and egress boundary consume the new version through the safe-mode control in this sub-technique; this breaker PASS proves only the transition and complete propagation, not each boundary's independent enforcement.

AID-I-003.001-G005

Escalate from soft throttling to hard containment when budget exhaustion is paired with suspicious signals such as recursive tool loops, repeated retries, anomalous latency growth, or high-confidence abuse detections.
Required correlated signals

Consume independently signed receipts from the budget ledger and the policy-required suspicious-signal producers. Each receipt must bind the same tenant/principal/session/agent scope, deployment and policy versions, observation window, source population, units, event IDs, and freshness. Never infer a missing Boolean as false or a missing score as zero. A signed escalation matrix owns required producer combinations, thresholds, correlation windows, hysteresis, and the exact bounded action for each level.

Verified escalation transaction
# File: containment/verified_escalation.py
from __future__ import annotations

from dataclasses import dataclass
from typing import Callable


ACTIONS = {"ALLOW", "SOFT_THROTTLE", "HARD_THROTTLE", "QUARANTINE", "BLOCK"}


@dataclass(frozen=True)
class VerifiedSignalReceipt:
    producer: str
    scope_id: str
    deployment_sha256: str
    observed_from_epoch: int
    observed_to_epoch: int
    evidence_sha256: str
    receipt_sha256: str
    values: dict[str, int | float | bool]


@dataclass(frozen=True)
class VerifiedEscalationPolicy:
    policy_sha256: str
    policy_version: int
    scope_id: str
    required_producers: frozenset[str]


@dataclass(frozen=True)
class EscalationDecision:
    action: str
    level: int
    decision_sha256: str
    reason_codes: tuple[str, ...]


@dataclass(frozen=True)
class PolicyEvaluator:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    evaluate: Callable[[tuple[VerifiedSignalReceipt, ...], VerifiedEscalationPolicy], EscalationDecision]


@dataclass(frozen=True)
class ContainmentAuthority:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    apply_once: Callable[[str, str, str, str], dict[str, object]]
    read_effective: Callable[[str], dict[str, object]]


@dataclass(frozen=True)
class EvidenceWriter:
    """Required authenticated runtime adapter callables; no fallback implementation."""
    append_and_verify: Callable[[dict[str, object]], dict[str, str]]


def escalate(
    *,
    receipts: tuple[VerifiedSignalReceipt, ...],
    policy: VerifiedEscalationPolicy,
    evaluator: PolicyEvaluator,
    authority: ContainmentAuthority,
    evidence: EvidenceWriter,
) -> dict[str, object]:
    producers = {item.producer for item in receipts}
    if producers != policy.required_producers:
        event = {
            "schema_version": "aidefend.correlated-escalation.v1",
            "control": "AID-I-003.001",
            "scope_id": policy.scope_id,
            "policy_sha256": policy.policy_sha256,
            "missing_producers": sorted(policy.required_producers - producers),
            "unexpected_producers": sorted(producers - policy.required_producers),
            "outcome": "INSUFFICIENT_DATA",
        }
        return {"outcome": "INSUFFICIENT_DATA", "evidence": evidence.append_and_verify(event)}
    if any(item.scope_id != policy.scope_id for item in receipts):
        raise PermissionError("signal scope mismatch")
    if len({item.deployment_sha256 for item in receipts}) != 1:
        raise PermissionError("signal deployment mismatch")

    decision = evaluator.evaluate(receipts, policy)
    if decision.action not in ACTIONS:
        raise PermissionError("invalid escalation action")
    action_receipt = authority.apply_once(
        policy.scope_id,
        decision.action,
        decision.decision_sha256,
        policy.policy_sha256,
    )
    readback = authority.read_effective(policy.scope_id)
    if (
        readback.get("action") != decision.action
        or readback.get("decision_sha256") != decision.decision_sha256
        or readback.get("effective") is not True
    ):
        raise PermissionError("escalation action is not effective")
    final = evidence.append_and_verify({
        "schema_version": "aidefend.correlated-escalation.v1",
        "control": "AID-I-003.001",
        "scope_id": policy.scope_id,
        "deployment_sha256": receipts[0].deployment_sha256,
        "policy_sha256": policy.policy_sha256,
        "policy_version": policy.policy_version,
        "signal_receipt_sha256s": [item.receipt_sha256 for item in receipts],
        "signal_evidence_sha256s": [item.evidence_sha256 for item in receipts],
        "decision_sha256": decision.decision_sha256,
        "level": decision.level,
        "action": decision.action,
        "reason_codes": list(decision.reason_codes),
        "action_receipt_sha256": action_receipt["receipt_sha256"],
        "readback_receipt_sha256": readback["receipt_sha256"],
        "outcome": "PASS",
    })
    return {"outcome": "PASS", "action": decision.action, "evidence": final}
Verify escalation

The policy evaluator verifies every receipt signature/schema/issuer/audience, exact scope and deployment, unit and window compatibility, required raw-evidence digest, freshness, replay nonce, finite numeric values, and policy rollback before evaluation. The containment authority applies the exact throttle/quarantine/block profile transactionally and independently reads gateway, session, tool, and credential state as applicable; credential revocation remains an explicit owner dependency rather than an assumed side effect.

Open-source tools

Commercial / hosted tools

Threat mappings

MITRE ATLAS

MAESTRO

OWASP LLM Top 10 2026

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

Cisco Integrated AI Security and Safety Framework

Google Secure AI Framework 2.0 - Risks

Databricks AI Security Framework 3.0

AID-I-003.001: Detection-Driven Quarantine & Safe-Mode Downgrade | AIDEFEND

Loading interactive view…

AIDEFEND™

A Practical Knowledge Base for AI Security Defenses

Version

GitHub MCP Service