AID-R-003: Trusted Identity, Context & Capability Re-establishment

Version 1.20261015 · Family — navigation only

After checking applicable eviction prerequisites against their signatures, digests, and authoritative readbacks, re-establish trusted interactive identities, clean conversational or agent context, and bounded runtime capabilities. These are separate recovery functions with different authoritative populations and enforcement points.

Scope boundary

Owns creation of new post-incident identity sessions, restoration of selected clean conversational or agent state, and progressive re-enablement of capabilities. It consumes authoritative eviction results and does not duplicate revocation, durable-state teardown, transport hardening, user communications, or heightened monitoring.

AID-E-001: AID-R-003 creates new trusted identity and capability state after incident prerequisites pass; AID-E-001 revokes compromised credentials, sessions, principals, and grants. A new recovery session or restored privilege cannot substitute for authoritative eviction of the prior authentication and authorization objects.

AID-E-005: AID-R-003 restores selected clean application or agent state; AID-E-005 removes compromised durable sessions, memory, registrations, queues, and schedules. Restoration must consume teardown evidence when applicable and must not reintroduce the state that AID-E-005 removed.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0012 Valid Accounts
AML.T0053 AI Agent Tool Invocation
AML.T0080 AI Agent Context Poisoning
AML.T0080.000 AI Agent Context Poisoning: Memory
AML.T0080.001 AI Agent Context Poisoning: Thread
AML.T0091 Use Alternate Authentication Material
AML.T0091.000 Use Alternate Authentication Material: Application Access Token
AML.T0091.001 Use Alternate Authentication Material: Web Session Cookie
AML.T0092 Manipulate User LLM Chat History
AML.T0121 AI Agent Environment Reconstruction
AML.T0130 AI Agent Response Biasing

MAESTRO

Lateral Movement (L4)
Agent Impersonation (L7)
Agent Identity Attack (L7)
Agent Tool Misuse (L7)
Agent Goal Manipulation (L7)
Privilege Escalation (Cross-Layer)

OWASP LLM Top 10 2026

LLM01:2026 Prompt Injection
LLM03:2026 Excessive Agency
LLM05:2026 Data and Model Poisoning

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

ASI02:2026 Tool Misuse and Exploitation
ASI03:2026 Identity and Privilege Abuse
ASI06:2026 Memory & Context Poisoning

NIST Adversarial Machine Learning 2025

NISTAML.015 Indirect Prompt Injection
NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

AITech-2.1 Excessive Agency
AITech-4.2 Context Boundary Attacks
AITech-5.1 Memory System Persistence
AITech-7.2 Memory System Corruption
AITech-12.1 Tool Exploitation
AITech-14.2 Abuse of Delegated Authority
AISubtech-2.1.2 Capability and Permission Overreach
AISubtech-4.2.2 Session Boundary Violation
AISubtech-5.1.1 Long-term / Short-term Memory Injection
AISubtech-14.1.2 Insufficient Access Controls
AISubtech-14.2.1 Permission Escalation via Delegation

Google Secure AI Framework 2.0 - Risks

RA: Rogue Actions

Databricks AI Security Framework 3.0

Platform 12.4: Unauthorized privileged access
Agents - Core 13.1: Memory Poisoning
Agents - Core 13.2: Tool Misuse
Agents - Core 13.3: Privilege Compromise
Agents - Core 13.6: Intent Breaking & Goal Manipulation
Agents - Core 13.9: Identity Spoofing & Impersonation
Agents - Tools MCP Client 13.34: Session and State Management Failures