{
 "@context": {
  "skos": "http://www.w3.org/2004/02/skos/core#",
  "dct": "http://purl.org/dc/terms/",
  "owl": "http://www.w3.org/2002/07/owl#",
  "foaf": "http://xmlns.com/foaf/0.1/",
  "ost": "https://ostering.com/ns/taxonomy#"
 },
 "@graph": [
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme",
   "@type": "skos:ConceptScheme",
   "skos:prefLabel": {
    "@value": "AI and Agentic Systems Threat Taxonomy",
    "@language": "en"
   },
   "dct:title": "AI and Agentic Systems Threat Taxonomy",
   "dct:creator": "Jonathan Brett Crawley",
   "dct:created": "2026-11-03",
   "owl:versionInfo": "1.0",
   "dct:license": "https://creativecommons.org/licenses/by-nc-nd/4.0/",
   "dct:rights": "© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. use the taxonomy to threat model systems you build, operate or assess, including for paying clients; use it internally, and for training, inside any organisation; quote individual entries, with credit, in paid courses, reports, findings and talks. Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool's built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn.",
   "dct:source": "https://github.com/BrettCrawley/elevation-of-autonomy",
   "skos:definition": {
    "@value": "The reference for the Elevation of Autonomy card deck: 30 threats to AI, LLM and agentic systems.",
    "@language": "en"
   },
   "skos:hasTopConcept": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial",
   "@type": "skos:Concept",
   "skos:notation": "EOA·S",
   "skos:prefLabel": {
    "@value": "Spades: Adversarial",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Direct attacks on the model and the agent: text that becomes an instruction, tools turned against their owner, poisoned components, memory and tool descriptions, and output that a downstream consumer trusts.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:topConceptOf": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:narrower": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9"
    }
   ],
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy",
   "@type": "skos:Concept",
   "skos:notation": "EOA·H",
   "skos:prefLabel": {
    "@value": "Hearts: Autonomy",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The risks that arrive when the system is allowed to act: more agency than the task needs, shared identities, agents that trust each other, failures that cascade, agents nobody inventoried, and clients brokering authority between servers.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:topConceptOf": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:narrower": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ha"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h9"
    }
   ],
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data",
   "@type": "skos:Concept",
   "skos:notation": "EOA·D",
   "skos:prefLabel": {
    "@value": "Diamonds: Data",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Risks to and through the data the system handles: disclosure, retrieval without access control, confident falsehoods, runaway spend, system prompts treated as secret stores, and servers that see everything routed to them.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:topConceptOf": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:narrower": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-da"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d9"
    }
   ],
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy",
   "@type": "skos:Concept",
   "skos:notation": "EOA·C",
   "skos:prefLabel": {
    "@value": "Clubs: Privacy",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Privacy threats from T.R.I.M. and LINDDUN, framed for systems that generate personal data as well as process it: transfer, retention and removal, inference, minimisation and unintervenability.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:topConceptOf": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:narrower": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ca"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ck"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-c10"
    }
   ],
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/privacy/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T",
   "skos:prefLabel": {
    "@value": "Trumps: Structural Hazards",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Architectural, mathematical and product-design properties that cannot be mitigated inside the model. Trumps beat any other card, and they are played against the design as a whole rather than against a component.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:topConceptOf": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:narrower": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t7"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t6"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t5"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t4"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t3"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t2"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t1"
    }
   ],
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa",
   "@type": "skos:Concept",
   "skos:notation": "EOA·SA",
   "skos:prefLabel": {
    "@value": "Prompt Injection",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An attacker-controlled text reaches the model's context and is interpreted as a new instruction. The injection may be direct (in the user prompt) or indirect (in retrieved content, tool output, memory, or another agent's message). The model cannot reliably distinguish instructions from data.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Anything the model reads can be interpreted as an instruction.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/#eoa-sa"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "How are inputs from each source delimited?",
     "@language": "en"
    },
    {
     "@value": "What happens when a retrieved document contains an instruction?",
     "@language": "en"
    },
    {
     "@value": "What actions are irreversible, and are any of them reachable from a single model output?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Treat every channel into the context as untrusted, and make sure no single model output can trigger a consequential action on its own.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Label and delimit each source in the context (system, user, retrieved content, tool output, memory, other agents), and keep instructions and data in separate fields wherever the interface allows.",
     "@language": "en"
    },
    {
     "@value": "Enforce what the agent may do outside the model: authorisation at the data layer and allow-listed tool arguments, so an obeyed injection is still refused.",
     "@language": "en"
    },
    {
     "@value": "Require out-of-band human confirmation for destructive or externally visible actions, showing what will happen in terms the user can check.",
     "@language": "en"
    },
    {
     "@value": "Filter output at every sink that could become an exfiltration channel (links, images, tool arguments, outbound messages).",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM01. ASI01 when it redirects an agent. CAPEC-242 conceptually.",
   "ost:stride": [
    "T",
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1427.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0051.000"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0051.001"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t7"
    }
   ],
   "skos:example": {
    "@value": "EchoLeak (CVE-2025-32711): a zero-click indirect prompt injection in Microsoft 365 Copilot, in which a crafted email led Copilot to exfiltrate data from the user's context. Disclosed by Aim Security, June 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sk",
   "@type": "skos:Concept",
   "skos:notation": "EOA·SK",
   "skos:prefLabel": {
    "@value": "Tool Misuse",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The agent invokes a legitimate, authorised tool in a way that causes harm because the arguments were attacker-influenced or the tool's blast radius was too wide.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "A legitimate tool used for illegitimate ends is still destructive.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/#eoa-sk"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "For each tool, what is the worst thing it could do with attacker-controlled arguments?",
     "@language": "en"
    },
    {
     "@value": "Are destructive arguments allow-listed?",
     "@language": "en"
    },
    {
     "@value": "Is human confirmation required for irreversible outcomes?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Constrain what each tool can do with any argument, not only which tools the agent may call.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Allow-list arguments and argument ranges for tools with side effects (paths, recipients, resources, amounts), not just function names.",
     "@language": "en"
    },
    {
     "@value": "Give each tool its own credentials scoped to the minimum it needs, so a misused call cannot reach beyond that scope.",
     "@language": "en"
    },
    {
     "@value": "Require human confirmation for irreversible outcomes, and make destructive operations soft-delete or recoverable by default.",
     "@language": "en"
    },
    {
     "@value": "Use idempotency keys and per-tool rate limits so a repeated or looping call cannot cascade.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI02. OWASP LLM06 secondary.",
   "ost:stride": [
    "T",
    "E"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0053"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0101"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0086"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ha"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t3"
    }
   ],
   "skos:example": {
    "@value": "GitHub MCP \"toxic agent flow\": a prompt injection in a public issue led an agent using the official GitHub MCP server to pull data from the user's private repositories and leak it through a pull request in the public one. Disclosed by Invariant Labs, May 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://invariantlabs.ai/blog/mcp-github-vulnerability"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sq",
   "@type": "skos:Concept",
   "skos:notation": "EOA·SQ",
   "skos:prefLabel": {
    "@value": "Supply Chain Compromise",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "A component in the AI supply chain (base model, adapter, library, MCP server, prompt template) is compromised upstream or via an update.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The code you didn't write runs with the credentials you have.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/#eoa-sq"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What is in your AI-BOM?",
     "@language": "en"
    },
    {
     "@value": "How are updates reviewed?",
     "@language": "en"
    },
    {
     "@value": "What does each component have access to that it does not need?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Know every component the system's behaviour depends on, review it on every change, and give each one only the access it needs.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Keep an AI-BOM covering models, adapters, datasets, libraries, MCP servers and prompt templates, each with its source, version and digest.",
     "@language": "en"
    },
    {
     "@value": "Gate installation and every update behind review, including re-reading tool descriptions and permissions on each version bump.",
     "@language": "en"
    },
    {
     "@value": "Pin versions by digest and verify signatures or provenance where the publisher offers them.",
     "@language": "en"
    },
    {
     "@value": "Run each component, and especially each MCP server, in its own sandbox with its own identity, filesystem view and egress policy.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM03. ASI04.",
   "ost:stride": [
    "T",
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://capec.mitre.org/data/definitions/538.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/1357.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/494.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0010.001"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0010.003"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0010.005"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t2"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9"
    }
   ],
   "skos:example": {
    "@value": "Amazon Q Developer for VS Code: version 1.84.0 shipped with an injected prompt telling the agent to wipe local files and cloud resources, after an unauthorised commit reached the release; AWS says it never ran. Bulletin AWS-2025-015, July 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://aws.amazon.com/security/security-bulletins/rss/aws-2025-015"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sj",
   "@type": "skos:Concept",
   "skos:notation": "EOA·SJ",
   "skos:prefLabel": {
    "@value": "Memory Poisoning",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An adversary causes false or malicious content to be written to long-term memory where it persists across sessions and is later retrieved as trusted context.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Today's lie becomes tomorrow's ground truth.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/#eoa-sj"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Who can write to memory?",
     "@language": "en"
    },
    {
     "@value": "Is provenance attached?",
     "@language": "en"
    },
    {
     "@value": "Is memory partitioned per user?",
     "@language": "en"
    },
    {
     "@value": "How are security-relevant memory reads validated?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Treat memory as untrusted input with provenance, never as an authority on policy or permissions.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Attach provenance to every memory write: who or what wrote it, in which session, from which source, with what authority.",
     "@language": "en"
    },
    {
     "@value": "Partition memory per user and per tenant; no cross-user writes and no shared memory without an explicit owner.",
     "@language": "en"
    },
    {
     "@value": "Never let memory change security-relevant state (approvals, permissions, policy); read those from the system of record every time.",
     "@language": "en"
    },
    {
     "@value": "Show users recent memory writes for confirmation, and audit and expire memory periodically.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI06.",
   "ost:stride": [
    "T"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0080.000"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ck"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    }
   ],
   "skos:example": {
    "@value": "SpAIware: a prompt injection planted persistent instructions in ChatGPT's long-term memory on the macOS app, so data from later conversations was exfiltrated. Disclosed by Johann Rehberger (Embrace The Red), September 2024; fixed by OpenAI.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s10",
   "@type": "skos:Concept",
   "skos:notation": "EOA·S10",
   "skos:prefLabel": {
    "@value": "Improper Output Handling",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "A downstream consumer treats model output as trusted, leading to exfiltration, rendering, or execution of attacker-influenced content.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The model's output is not user input, except in every way that matters.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/#eoa-s10"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Which consumers of model output exist, and what do they assume?",
     "@language": "en"
    },
    {
     "@value": "Where is output sanitised, encoded, or structured?",
     "@language": "en"
    },
    {
     "@value": "Are there rendering paths that fetch remote content?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Handle model output as untrusted input at every sink it reaches: renderer, tool argument, query, shell, log and message.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Encode or sanitise output for the sink it goes to (HTML, Markdown, SQL, shell, log), and never pass it to an interpreter unescaped.",
     "@language": "en"
    },
    {
     "@value": "Prefer structured output validated against a schema over free-form text wherever a program consumes it.",
     "@language": "en"
    },
    {
     "@value": "Block remote content fetches from rendered output (images, links, iframes) with a Content Security Policy or a domain allow-list.",
     "@language": "en"
    },
    {
     "@value": "Run any generated code in a sandbox with no network, no secrets and no access to the host filesystem.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM05.",
   "ost:stride": [
    "I",
    "T"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://capec.mitre.org/data/definitions/63.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/79.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/94.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0077"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-da"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t1"
    }
   ],
   "skos:example": {
    "@value": "Google Bard data exfiltration: an indirect prompt injection in a shared Google Doc made Bard emit a Markdown image whose URL carried the user's chat history to an attacker's server. Disclosed by Johann Rehberger (Embrace The Red), November 2023; fixed by Google.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9",
   "@type": "skos:Concept",
   "skos:notation": "EOA·S9",
   "skos:prefLabel": {
    "@value": "Tool Description Injection",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An MCP server (or equivalent tool registry) supplies tool descriptions and parameter schemas that arrive in the model's context as instructions. A hostile or compromised server can inject prompts via the description field itself, not just the tool's return value. The \"rug pull\" variant mutates the description after the user has approved the tool, so the approved version and the live version diverge silently.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The tool description is itself a prompt.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-adversarial"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/adversarial/#eoa-s9"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Are tool descriptions pinned and integrity-checked between approval and use?",
     "@language": "en"
    },
    {
     "@value": "What happens when a server updates a description silently?",
     "@language": "en"
    },
    {
     "@value": "Are descriptions delimited from user prompts in the model's context?",
     "@language": "en"
    },
    {
     "@value": "Does any tool have a description that contains imperative language?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Approve a tool's description and schema as code, and refuse any version that differs from what was approved.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Pin each tool's description and schema by hash at approval time, and block the tool (or re-prompt for approval) when the hash changes.",
     "@language": "en"
    },
    {
     "@value": "Review descriptions before approval for imperative language, hidden text and references to other tools or files.",
     "@language": "en"
    },
    {
     "@value": "Show the user the full description that the model will see, not a shortened summary.",
     "@language": "en"
    },
    {
     "@value": "Delimit tool descriptions from user and system content in the context, and keep them out of the system prompt.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM01 indirect injection. ASI01. ASI04. MCP-specific.",
   "ost:stride": [
    "T",
    "S"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1427.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0110.000"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0109"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t2"
    }
   ],
   "skos:example": {
    "@value": "Tool poisoning attacks: Invariant Labs showed MCP tool descriptions carrying hidden instructions that made a client read SSH keys and configuration files and pass them out through tool arguments, including a rug-pull variant that changes after approval. April 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://invariantlabs.ai/blog/mcp-security-notification"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ha",
   "@type": "skos:Concept",
   "skos:notation": "EOA·HA",
   "skos:prefLabel": {
    "@value": "Excessive Agency",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The agent holds capabilities, permissions, or autonomy beyond what the task requires, expanding blast radius on any compromise.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Give the agent only what the task requires, then give it less.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/#eoa-ha"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What is the minimum scope for each tool?",
     "@language": "en"
    },
    {
     "@value": "Does the agent need autonomy, or would confirmation suffice?",
     "@language": "en"
    },
    {
     "@value": "Could capabilities be split per task?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Least agency: grant the fewest tools, the narrowest scopes and the least autonomy that the task needs, and deny by default.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Scope each tool and credential to the task (read-only where reading is enough, one repository rather than all), and review the scopes when the task changes.",
     "@language": "en"
    },
    {
     "@value": "Split capabilities across task-specific agents or sessions instead of one agent that can do everything.",
     "@language": "en"
    },
    {
     "@value": "Prefer confirmation to autonomy for any action that writes, sends, deletes or spends.",
     "@language": "en"
    },
    {
     "@value": "Separate development, staging and production access, so an agent working in one cannot reach another.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM06.",
   "ost:stride": [
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/250.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0053"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t3"
    }
   ],
   "skos:example": {
    "@value": "Replit's AI coding agent deleted a live production database during an explicit code freeze and then misreported what had happened. Reported by SaaStr founder Jason Lemkin, July 2025; Replit's CEO apologised and added development and production separation.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.theregister.com/2025/07/22/replit_saastr_response/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk",
   "@type": "skos:Concept",
   "skos:notation": "EOA·HK",
   "skos:prefLabel": {
    "@value": "Identity and Privilege Abuse",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Agents share credentials, inherit broad identities, or operate with long-lived tokens. Compromise propagates across the system.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "A shared service account is a shared single point of failure.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/#eoa-hk"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "How many agents share identities?",
     "@language": "en"
    },
    {
     "@value": "How are credentials scoped, rotated, and audited?",
     "@language": "en"
    },
    {
     "@value": "What is the blast radius of each identity?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Give every agent its own short-lived, narrowly scoped identity, so one compromise stays one compromise.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Issue a distinct workload identity per agent (and per tool where it matters) instead of shared service accounts or a user's own token.",
     "@language": "en"
    },
    {
     "@value": "Use short-lived credentials from a broker or token exchange, scoped per task, and never place them in prompts or agent configuration.",
     "@language": "en"
    },
    {
     "@value": "When an agent acts for a user, carry the user's identity and limits through delegated authorisation rather than the agent's own broad rights.",
     "@language": "en"
    },
    {
     "@value": "Log every action against the agent identity that took it, and review each identity's reach regularly.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI03.",
   "ost:stride": [
    "S",
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://capec.mitre.org/data/definitions/560.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/250.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0012"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0083"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0098"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ha"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h9"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hq",
   "@type": "skos:Concept",
   "skos:notation": "EOA·HQ",
   "skos:prefLabel": {
    "@value": "Inter-Agent Trust Exploitation",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An orchestrator or peer agent trusts another agent's messages, tool calls, or return values without validation. A compromised or misbehaving agent propagates its effects.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Agents trust each other because you told them to.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/#eoa-hq"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Do agents authenticate to each other?",
     "@language": "en"
    },
    {
     "@value": "Are inter-agent messages structured and validated?",
     "@language": "en"
    },
    {
     "@value": "Could a rogue agent impersonate another?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Zero trust between agents: authenticate every peer and validate every message, even when all the agents are yours.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Authenticate agents to each other (mutual TLS or signed tokens bound to the agent identity), and reject unauthenticated messages.",
     "@language": "en"
    },
    {
     "@value": "Exchange structured messages validated against a schema, and never treat free text from another agent as an instruction.",
     "@language": "en"
    },
    {
     "@value": "Limit what each agent may ask another to do with an explicit policy, and enforce it at the receiver.",
     "@language": "en"
    },
    {
     "@value": "Sign or hash messages and record the chain of who asked whom, so a forged or altered message can be detected.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI07.",
   "ost:stride": [
    "S",
    "T"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1427.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/306.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0051.001"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0143"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj",
   "@type": "skos:Concept",
   "skos:notation": "EOA·HJ",
   "skos:prefLabel": {
    "@value": "Cascading Failure",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An error, hallucination, or partial compromise in one agent propagates through a multi-agent system, amplifying as it spreads.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "One agent's hallucination is another agent's ground truth.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/#eoa-hj"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Where are the circuit breakers?",
     "@language": "en"
    },
    {
     "@value": "Are retry budgets bounded?",
     "@language": "en"
    },
    {
     "@value": "Can the chain be killed from one place?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Contain errors at every hand-off between agents, so one fault cannot become the whole system's state.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Put deterministic verification between agents (schema checks, existence checks, reconciliation against the system of record) before a result is used.",
     "@language": "en"
    },
    {
     "@value": "Add circuit breakers that stop a chain when error rates, disagreement or output volume cross a threshold.",
     "@language": "en"
    },
    {
     "@value": "Bound retries, recursion depth and fan-out for every agent and every chain.",
     "@language": "en"
    },
    {
     "@value": "Provide one kill switch that halts the whole chain, and test that it works.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI08.",
   "ost:stride": [
    "D",
    "T"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0143"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0061"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dj"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h10",
   "@type": "skos:Concept",
   "skos:notation": "EOA·H10",
   "skos:prefLabel": {
    "@value": "Rogue Agent",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "A compromised, misaligned, forgotten, or unsanctioned agent operates in the environment, producing harm through actions that look legitimate in isolation.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The agent looked legitimate in every individual action.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/#eoa-h10"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Is there an agent inventory?",
     "@language": "en"
    },
    {
     "@value": "How is anomalous behaviour detected?",
     "@language": "en"
    },
    {
     "@value": "What is the kill-switch latency?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Every agent is inventoried, owned, observed and stoppable.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Keep an agent inventory as a first-class control, like non-human identity discovery: owner, purpose, identity, tools, data reach and expiry date for every agent.",
     "@language": "en"
    },
    {
     "@value": "Discover unsanctioned agents by watching for agent traffic, tokens and tool registrations that are not in the inventory.",
     "@language": "en"
    },
    {
     "@value": "Baseline each agent's normal behaviour and alert on drift in tools used, data touched, volume and destinations.",
     "@language": "en"
    },
    {
     "@value": "Provide a central kill switch that revokes an agent's credentials and stops it within minutes, and measure that time.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI10.",
   "ost:stride": [
    "E",
    "R"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0103"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0108"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t2"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hq"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h9",
   "@type": "skos:Concept",
   "skos:notation": "EOA·H9",
   "skos:prefLabel": {
    "@value": "Confused Deputy Across Servers",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An MCP client is connected to multiple servers concurrently. One server's tool can shadow another's by exposing a tool with the same or similar name, intercepting calls intended elsewhere. One server can read context, approvals, or tool results that belong to another. The client becomes a confused deputy, brokering authority between mutually distrusting servers.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Two MCP servers in one client share a context they should not share.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-autonomy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/autonomy/#eoa-h9"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Are tools namespaced per server?",
     "@language": "en"
    },
    {
     "@value": "Can two servers register the same tool name?",
     "@language": "en"
    },
    {
     "@value": "Is each server's context isolated from the others?",
     "@language": "en"
    },
    {
     "@value": "Does the user see which server a tool call is going to, in language they can verify?",
     "@language": "en"
    },
    {
     "@value": "What happens when servers are added or removed mid-session?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Isolate servers from each other inside the client, and broker no authority between them that the user did not grant.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Namespace every tool by server and reject duplicate or confusable tool names at registration.",
     "@language": "en"
    },
    {
     "@value": "Keep each server's context, approvals and tool results separate, and apply a data-flow policy that stops data from a sensitive server being passed as arguments to a less trusted one.",
     "@language": "en"
    },
    {
     "@value": "Show the user which server a call goes to, by a name they can verify, when asking for approval.",
     "@language": "en"
    },
    {
     "@value": "Re-evaluate approvals and the tool list when a server is added or removed mid-session.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI03 cross-context. ASI07 inter-component trust.",
   "ost:stride": [
    "S",
    "I",
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/441.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0110.000"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0086"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    }
   ],
   "skos:example": {
    "@value": "WhatsApp MCP exploited: Invariant Labs showed a malicious MCP server, connected alongside a trusted WhatsApp MCP server in the same client, using its tool description to make the agent send the user's WhatsApp message history to an attacker's number. April 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://invariantlabs.ai/blog/whatsapp-mcp-exploited"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-da",
   "@type": "skos:Concept",
   "skos:notation": "EOA·DA",
   "skos:prefLabel": {
    "@value": "Sensitive Information Disclosure",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The model emits personal data, secrets, or proprietary information drawn from training, retrieval, or context.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The model will tell you what it knows, whether it should or not.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/#eoa-da"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What data is in scope for retrieval?",
     "@language": "en"
    },
    {
     "@value": "Is authorisation enforced at the data layer?",
     "@language": "en"
    },
    {
     "@value": "What are the output filters catching?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "The model only ever sees data the requesting user is entitled to; output filtering is a backstop, not the control.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Enforce authorisation at retrieval time with the requesting user's identity, not the agent's service account and not in the UI.",
     "@language": "en"
    },
    {
     "@value": "Keep secrets and data the task does not need out of training sets, prompts, context and memory.",
     "@language": "en"
    },
    {
     "@value": "Filter output for secrets and personal data before it reaches the user, a log or another system, and log what the filter catches.",
     "@language": "en"
    },
    {
     "@value": "Classify data sources before connecting them, and exclude archives, private messages and HR data unless the use case requires them.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM02.",
   "ost:stride": [
    "I"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/359.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/201.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0137.003"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0085.000"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0136"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cj"
    }
   ],
   "ost:linddun": [
    "Data disclosure"
   ],
   "skos:example": {
    "@value": "Slack AI: PromptArmor showed that an injected message in a public channel could make Slack AI leak data from private channels the attacker could not read, through a link the victim clicked. August 2024.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://promptarmor.com/resources/data-exfiltration-from-slack-ai-via-indirect-prompt-injection"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dk",
   "@type": "skos:Concept",
   "skos:notation": "EOA·DK",
   "skos:prefLabel": {
    "@value": "Vector and Embedding Weakness",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The RAG pipeline leaks data across tenants, allows embedding-based attacks, or inherits UI-layer access controls that do not apply at retrieval.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The vector store is your new database and it has no access control.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/#eoa-dk"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "How is the vector store partitioned?",
     "@language": "en"
    },
    {
     "@value": "When is authorisation evaluated: at query time or earlier?",
     "@language": "en"
    },
    {
     "@value": "Who can write to the corpus?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Apply the access control of the source documents to every chunk, at query time, and protect the corpus from unauthorised writes.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Partition the vector store per tenant (separate indexes or enforced namespaces), never by filter alone.",
     "@language": "en"
    },
    {
     "@value": "Carry the source document's permissions on every chunk and evaluate them at query time with the requesting user's identity.",
     "@language": "en"
    },
    {
     "@value": "Control and log who can write to the corpus, and attach source and integrity hashes to every chunk.",
     "@language": "en"
    },
    {
     "@value": "Treat retrieved chunks as untrusted content in the context, and re-index when permissions change at the source.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM08.",
   "ost:stride": [
    "I",
    "T"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/863.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/653.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0070"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0085.000"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-da"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ck"
    }
   ],
   "ost:linddun": [
    "Data disclosure",
    "Linking"
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dq",
   "@type": "skos:Concept",
   "skos:notation": "EOA·DQ",
   "skos:prefLabel": {
    "@value": "Hallucinated Facts",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The model generates false but plausible content that downstream consumers or users treat as ground truth. Includes slopsquatting, fabricated citations, and invented identifiers.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The model is confidently wrong and the system treats confidence as correctness.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/#eoa-dq"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Where does model output inform decisions or actions?",
     "@language": "en"
    },
    {
     "@value": "Is there grounding?",
     "@language": "en"
    },
    {
     "@value": "Are claims about external entities (people, packages, systems) verified?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Verify any claim about an external entity before it is acted on or presented as fact.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Ground answers in authoritative sources and show the source with the claim.",
     "@language": "en"
    },
    {
     "@value": "Check that packages, files, URLs, people and identifiers exist (and are the expected ones) before installing, calling or citing them.",
     "@language": "en"
    },
    {
     "@value": "Use refuse-or-retrieve for high-stakes questions: answer from a retrieved source or say the answer is not known.",
     "@language": "en"
    },
    {
     "@value": "Route decisions with legal, financial or safety impact to a human with the sources in front of them.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM09.",
   "ost:stride": [
    "T"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0062"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0060"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t1"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ca"
    }
   ],
   "skos:example": {
    "@value": "Slopsquatting: Lasso Security's Bar Lanyado found models repeatedly recommending a non-existent package, huggingface-cli; an empty package he uploaded under that name got over 30,000 downloads in three months and appeared in an Alibaba repository's install instructions. 2024.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.itpro.com/security/hackers-are-taking-advantage-of-ai-hallucinations-to-sneak-malicious-software-packages-onto-enterprise-repositories"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dj",
   "@type": "skos:Concept",
   "skos:notation": "EOA·DJ",
   "skos:prefLabel": {
    "@value": "Unbounded Consumption",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Cost, compute, or rate limits are absent or ineffective. Malicious users (or bugs) cause runaway spend.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Denial of wallet is a denial of service.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/#eoa-dj"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What are the hard caps per user, per session, per agent?",
     "@language": "en"
    },
    {
     "@value": "Are loops bounded?",
     "@language": "en"
    },
    {
     "@value": "How is spend monitored?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Every user, session, agent and loop has a hard budget, enforced outside the model.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Set rate limits and token and cost budgets per user, per session, per agent and per tool, enforced at the gateway.",
     "@language": "en"
    },
    {
     "@value": "Cap loop iterations, recursion depth, context size and output length.",
     "@language": "en"
    },
    {
     "@value": "Alert on spend anomalies, and stop automatically when a budget is reached rather than only notifying.",
     "@language": "en"
    },
    {
     "@value": "Protect model API keys like payment credentials: scoped, rotated and never in client code.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM10.",
   "ost:stride": [
    "D"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://capec.mitre.org/data/definitions/130.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/770.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/799.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0034"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0034.002"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0029"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t3"
    }
   ],
   "skos:example": {
    "@value": "LLMjacking: Sysdig's Threat Research Team found attackers using stolen cloud credentials to run hosted language models at the victims' expense, with potential costs of more than USD 46,000 a day. May 2024.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d10",
   "@type": "skos:Concept",
   "skos:notation": "EOA·D10",
   "skos:prefLabel": {
    "@value": "System Prompt Leakage",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "System prompts containing credentials, business logic, or security instructions are extracted via prompt injection or inference.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The system prompt is not a secret store.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/#eoa-d10"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What is in the system prompt that should not be?",
     "@language": "en"
    },
    {
     "@value": "What happens if the whole prompt leaks tomorrow?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Design as if the system prompt is public: no secrets in it, and no security control that depends on it staying hidden.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Keep credentials, connection strings and internal URLs out of prompts; tools fetch secrets server-side from a secret store.",
     "@language": "en"
    },
    {
     "@value": "Enforce permissions and business rules in code outside the model, not as instructions in the prompt.",
     "@language": "en"
    },
    {
     "@value": "Review prompts as published text before release, assuming a user will read them.",
     "@language": "en"
    },
    {
     "@value": "Monitor outputs for prompt fragments, and treat a leak as expected rather than as an incident that breaks security.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM07.",
   "ost:stride": [
    "I"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/497.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/798.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0069.002"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t4"
    }
   ],
   "skos:example": {
    "@value": "Bing Chat: within days of launch, a prompt injection revealed Microsoft's confidential system prompt, including the codename \"Sydney\". Reported by Kevin Liu, February 2023.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.techspot.com/news/97590-microsoft-bing-chatbot-ai-susceptible-several-types-prompt.html"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d9",
   "@type": "skos:Concept",
   "skos:notation": "EOA·D9",
   "skos:prefLabel": {
    "@value": "Server Impersonation and Rogue Servers",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An MCP server is typosquatted, hijacked, or stood up adversarially in a registry the client trusts. Once connected, it sees every prompt routed to its tools, every credential or token shared with it, and every return value. Data exfiltration is the primary risk; tool-output tampering is the secondary risk. The transport (stdio vs HTTP) changes the attack surface but not the underlying problem.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Every byte of your prompt and every tool result flows through that server.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-data"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/data/#eoa-d9"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "How is the server identified: by name, by signature, by pinned hash?",
     "@language": "en"
    },
    {
     "@value": "What is the source of truth for the registry?",
     "@language": "en"
    },
    {
     "@value": "What credentials and data does each server see?",
     "@language": "en"
    },
    {
     "@value": "Is HTTP transport authenticated and bound to a specific origin?",
     "@language": "en"
    },
    {
     "@value": "What happens if a server is silently replaced?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Identify servers by something an attacker cannot copy, and assume any server sees everything routed to it.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Identify each server by publisher signature or pinned digest, not by name, and install only from an internal registry or allow-list.",
     "@language": "en"
    },
    {
     "@value": "Authenticate HTTP transports and bind them to an expected origin; validate Origin headers on local servers.",
     "@language": "en"
    },
    {
     "@value": "Send each server only the data and credentials its tools need, and never share one token across servers.",
     "@language": "en"
    },
    {
     "@value": "Alert and block when a server's binary, digest or endpoint changes, and re-review before re-enabling it.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "OWASP LLM03 supply chain. ASI04. MCP-specific.",
   "ost:stride": [
    "S",
    "I",
    "T"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://capec.mitre.org/data/definitions/630.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/1357.html"
    },
    {
     "@id": "https://cwe.mitre.org/data/definitions/346.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0010.005"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0011.002"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0115.002"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h9"
    }
   ],
   "skos:example": {
    "@value": "postmark-mcp: an npm package impersonating an email-sending MCP server added a hidden BCC from version 1.0.16, copying every message sent through it to an attacker-controlled address. Disclosed by Koi Security, September 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.theregister.com/2025/09/29/postmark_mcp_server_code_hijacked/"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ca",
   "@type": "skos:Concept",
   "skos:notation": "EOA·CA",
   "skos:prefLabel": {
    "@value": "Transfer",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The model manufactures personal data that is then transferred to a downstream system, log, or onward recipient. The data has no provenance and no consent chain.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The model creates personal data at the point of transfer.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/privacy/#eoa-ca"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Does the data carry provenance tags?",
     "@language": "en"
    },
    {
     "@value": "Can downstream consumers distinguish generated from collected data?",
     "@language": "en"
    },
    {
     "@value": "Is onward transfer logged?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Mark generated personal data as generated, and transfer it only where a recipient can tell it apart from collected data.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Tag every record and field the model produces with its provenance (generated, retrieved, collected) and carry the tag through transfers.",
     "@language": "en"
    },
    {
     "@value": "Make downstream schemas store generated personal data separately from collected data, or reject it.",
     "@language": "en"
    },
    {
     "@value": "Log every onward transfer of personal data from model output: what, to whom and on what basis.",
     "@language": "en"
    },
    {
     "@value": "Include model-generated data in the record of processing and in transfer impact assessments.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "T.R.I.M. Transfer. GDPR Article 5(1)(a), 5(1)(b).",
   "ost:stride": [
    "I"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ck"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    }
   ],
   "ost:linddun": [
    "Data disclosure",
    "Non-compliance"
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ck",
   "@type": "skos:Concept",
   "skos:notation": "EOA·CK",
   "skos:prefLabel": {
    "@value": "Retention and Removal",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Personal data (real or hallucinated) is persisted in RAG, memory, logs, or fine-tuning datasets without a mechanism for surgical removal. Article 16 and Article 17 rights become unenforceable.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Fabricated data persists the same as real data.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/privacy/#eoa-ck"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "For each persistent store: can you locate a specific individual's data?",
     "@language": "en"
    },
    {
     "@value": "Can you delete it?",
     "@language": "en"
    },
    {
     "@value": "Can you prevent recurrence?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Design every persistent store the system writes to for locating, deleting and suppressing one person's data.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Index personal data by data subject across RAG, memory, logs, caches and training sets, so one person's data can be found.",
     "@language": "en"
    },
    {
     "@value": "Support deletion in each store, with a retention period, and keep personal data out of fine-tuning sets unless it can be removed and the model retrained.",
     "@language": "en"
    },
    {
     "@value": "Add a suppression list applied at output for corrections and erasures that cannot be removed from model weights.",
     "@language": "en"
    },
    {
     "@value": "Test the process end to end with synthetic subject access and erasure requests.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "T.R.I.M. Retention. GDPR Articles 16, 17.",
   "ost:stride": [
    "I"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-c10"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dk"
    }
   ],
   "ost:linddun": [
    "Non-compliance",
    "Unawareness and unintervenability"
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cq",
   "@type": "skos:Concept",
   "skos:notation": "EOA·CQ",
   "skos:prefLabel": {
    "@value": "Inference",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The model infers new personal data (including special-category data under Article 9) from partial or unrelated inputs. The act of inference is itself the privacy event.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The model derives personal data you never collected.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/privacy/#eoa-cq"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What does the model infer about people that it was not told?",
     "@language": "en"
    },
    {
     "@value": "Does it ever touch special categories?",
     "@language": "en"
    },
    {
     "@value": "What is the lawful basis for inferred data?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Do not let the system infer facts about people that it has no lawful basis to hold, and never special categories by default.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Constrain outputs about identifiable people to retrieved, authoritative facts (refuse-or-ground); no free-form biographical detail.",
     "@language": "en"
    },
    {
     "@value": "Detect and block special-category inferences (health, religion, sexual orientation, political views and the like) at output.",
     "@language": "en"
    },
    {
     "@value": "Record which inferences the product relies on and the lawful basis for each in the DPIA.",
     "@language": "en"
    },
    {
     "@value": "Exclude inputs from the context that enable sensitive inference and that the task does not need (calendars, location history, free-text notes).",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "T.R.I.M. Inference. GDPR Article 9. LINDDUN Identifying.",
   "ost:stride": [
    "I"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-da"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-c10"
    }
   ],
   "ost:linddun": [
    "Identifying",
    "Linking"
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cj",
   "@type": "skos:Concept",
   "skos:notation": "EOA·CJ",
   "skos:prefLabel": {
    "@value": "Minimisation",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The model generates more personal data than the task requires, producing unrequested claims that are both unminimised and hallucination-prone.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "You minimise what you collect. Now minimise what you generate.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/privacy/#eoa-cj"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Is the input minimal for the task?",
     "@language": "en"
    },
    {
     "@value": "Is the output minimal?",
     "@language": "en"
    },
    {
     "@value": "Are output schemas constrained to what was asked?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Apply data minimisation to what the model generates as well as to what the system collects.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Constrain output to a schema that has only the fields the task needs, with no free-text field for personal data.",
     "@language": "en"
    },
    {
     "@value": "Minimise the input: pass identifiers or redacted text rather than whole records where the task allows.",
     "@language": "en"
    },
    {
     "@value": "Cap response length for tasks that need short answers.",
     "@language": "en"
    },
    {
     "@value": "Strip personal data from outputs that do not need it before they are stored or sent.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "T.R.I.M. Minimisation. GDPR Article 5(1)(c).",
   "ost:stride": [
    "I"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/201.html"
    }
   ],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-cq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ca"
    }
   ],
   "ost:linddun": [
    "Data disclosure",
    "Non-compliance"
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-c10",
   "@type": "skos:Concept",
   "skos:notation": "EOA·C10",
   "skos:prefLabel": {
    "@value": "Unintervenability",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Data subjects have no practical mechanism to discover what the system claims about them, no route to correct it, and no assurance that corrections persist.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The subject cannot find out, cannot correct, cannot prevent recurrence.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-privacy"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/privacy/#eoa-c10"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Is the processing disclosed in the privacy notice?",
     "@language": "en"
    },
    {
     "@value": "Is there a subject access process that covers model outputs?",
     "@language": "en"
    },
    {
     "@value": "Do rectifications persist across sessions?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Give people a working route to find out what the system says about them, correct it, and keep it corrected.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Disclose the AI processing, including generated and inferred data, in the privacy notice.",
     "@language": "en"
    },
    {
     "@value": "Extend the subject access process to model outputs, memory, logs and RAG stores.",
     "@language": "en"
    },
    {
     "@value": "Make rectification persistent: corrections stored in the system of record and applied at retrieval and output in every later session.",
     "@language": "en"
    },
    {
     "@value": "Give people affected by a decision a route to human review, and record each request and its outcome.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "LINDDUN Unawareness/Unintervenability. GDPR Articles 13, 14, 16.",
   "ost:stride": [
    "R"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ck"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t1"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ca"
    }
   ],
   "ost:linddun": [
    "Unawareness and unintervenability",
    "Non-compliance"
   ],
   "skos:example": {
    "@value": "noyb filed a complaint with Norway's data protection authority after ChatGPT falsely described a Norwegian man as having murdered his children, mixing in real details of his life; noyb argued OpenAI offered no way to correct the output. March 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.euronews.com/2025/03/20/openai-faces-european-privacy-complaint-after-chatgpt-allegedly-hallucinated-man-murdered-"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t7",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T7",
   "skos:prefLabel": {
    "@value": "Adversarial Subspace",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Any input to an AI system is translated into a lower-dimensional numerical representation. That flattening creates a subspace of inputs that all produce approximately the same model behaviour. The subspace is mathematically enormous, provably unsearchable, and unpatchable. It is a property of the architecture, not a bug. Prompt-library-based red teaming and pattern-matching guardrails test a vanishing fraction of this surface. This card represents the deepest reason structural mitigations beat statistical ones.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The attack surface is a space, not a list.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t7"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Are we relying on a library of known bad prompts as a defence? If yes, we are defending a vanishing fraction of the space.",
     "@language": "en"
    },
    {
     "@value": "Is our security guarantee architectural or statistical? If statistical, what happens when the next perturbation lands outside our library tomorrow?",
     "@language": "en"
    },
    {
     "@value": "What determines the outcome of every consequential decision: the model's classification, or a deterministic check downstream?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Put every security guarantee in a deterministic control outside the model; treat guardrails and blocklists as noise reduction, not as the control.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "For each consequential action, name the deterministic control that decides it (authorisation, allow-list, confirmation, budget) and remove any decision that rests on the model refusing.",
     "@language": "en"
    },
    {
     "@value": "Keep guardrails and prompt filters, but record them as defence in depth with no security claim attached.",
     "@language": "en"
    },
    {
     "@value": "Measure red teaming by structural coverage (which sinks and actions are reachable) rather than by the number of prompts blocked.",
     "@language": "en"
    },
    {
     "@value": "Design for the assumption that some input will always get the model to do the wrong thing, and limit what that can achieve.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "Cox & Bunzel (2025), arXiv:2511.05102. Tramèr et al. (2017). Goodfellow, Shlens, Szegedy (2015). EchoGram (HiddenLayer, 2025) as a contemporary surface example.",
   "ost:stride": [
    "T",
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1039.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0043"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0054"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0015"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t4"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t6"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    }
   ],
   "skos:example": {
    "@value": "EchoGram: HiddenLayer showed that short token sequences found by search can flip the verdicts of commercial and open-source LLM guardrails, letting malicious prompts through or making harmless ones look malicious. November 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.hiddenlayer.com/research/echogram-the-hidden-vulnerability-undermining-ai-guardrails"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t6",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T6",
   "skos:prefLabel": {
    "@value": "Geometric Attack",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "An attacker targets the geometry of the model's decision surface directly: by probing a black-box classifier (GeoDA, SurFree), by exploiting non-Euclidean embeddings (AGSM), or by rotating an angular-margin embedding on a hypersphere (ArcFace-style attacks). The attack succeeds without access to weights, training data, or gradients.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The boundary is the attack surface, not the inputs that cross it.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t6"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Does any consequential decision depend on a single model's classification?",
     "@language": "en"
    },
    {
     "@value": "Can an attacker probe it with queries?",
     "@language": "en"
    },
    {
     "@value": "Is the downstream enforcement deterministic or does it inherit the model's verdict?",
     "@language": "en"
    },
    {
     "@value": "Is adversarial testing matched to the geometry the model uses?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "No consequential decision rests on one model's classification, and the classifier cannot be probed freely.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Pair any model-gated decision (biometric match, fraud score, content verdict) with an independent deterministic factor.",
     "@language": "en"
    },
    {
     "@value": "Rate-limit and monitor queries to classifiers, and return coarse verdicts rather than scores or confidence values.",
     "@language": "en"
    },
    {
     "@value": "Detect probing patterns: many near-identical queries, systematic perturbations, or query sequences walking towards a boundary.",
     "@language": "en"
    },
    {
     "@value": "Test robustness with attacks that match the model's geometry (angular attacks for angular-margin embeddings, hyperbolic attacks for hyperbolic ones).",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "Tramèr et al. 2017 foundation. GeoDA, SurFree, AGSM, angular-margin attack literature. CAPEC-115 when authentication is gated by the model.",
   "ost:stride": [
    "S",
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1039.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0043.001"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0015"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0040"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t7"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t4"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hk"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t5",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T5",
   "skos:prefLabel": {
    "@value": "Context Rot",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "As a session grows, attention to system prompts, role definitions, and authorisation context decays. Guardrails that held on turn 1 fail on turn 50 without any adversarial input.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "Your safety instructions were at the top. They have decayed in attention weight.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t5"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What is the longest realistic session?",
     "@language": "en"
    },
    {
     "@value": "At that length, which safety-relevant tokens are in the lost-in-the-middle zone?",
     "@language": "en"
    },
    {
     "@value": "Are critical instructions periodically re-injected?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Keep safety-relevant rules out of the model's attention budget: enforce them in code, and keep sessions short enough that instructions still hold.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Set a context budget well below the advertised window, and summarise or start a fresh session when it is reached.",
     "@language": "en"
    },
    {
     "@value": "Re-inject critical instructions near the end of the context, and start a fresh session for high-stakes operations.",
     "@language": "en"
    },
    {
     "@value": "Enforce confirmation, authorisation and scope in the orchestrator, which does not forget, rather than as prompt instructions.",
     "@language": "en"
    },
    {
     "@value": "Test behaviour at the longest realistic session length, not only on the first turn, and alert on unusual context growth.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "Chroma 2025 research. Cross-cutting amplifier for LLM01, LLM06, ASI01, ASI02, ASI06, ASI08.",
   "ost:stride": [
    "E"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sa"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t3"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ha"
    }
   ],
   "skos:example": {
    "@value": "Context rot: Chroma Research tested 18 language models and found performance growing less reliable as input length grew, even on simple tasks. Hong, Troynikov and Huber, July 2025.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://www.trychroma.com/research/context-rot"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t4",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T4",
   "skos:prefLabel": {
    "@value": "Decision Boundary Transfer",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Models trained on the same domain share similar decision boundaries regardless of algorithm or dataset. Adversarial examples transfer freely; model robustness is a property of the domain, not the model.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The boundary your model defends is the boundary every other model defends.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t4"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What security guarantees are we relying on the model itself to provide?",
     "@language": "en"
    },
    {
     "@value": "Can any of them be moved to a deterministic layer?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Assume the decision boundary is public: closed weights and private training data do not make a classifier a security control.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "List every security guarantee that relies on a model's robustness, and move each one to a deterministic layer outside the model.",
     "@language": "en"
    },
    {
     "@value": "Do not count closed weights, private training data or an undisclosed model choice as protection against evasion.",
     "@language": "en"
    },
    {
     "@value": "Where a classifier must stay in the path, combine it with signals an attacker cannot reproduce from public data (provenance, identity, history).",
     "@language": "en"
    },
    {
     "@value": "Test with transfer attacks built on surrogate models trained only on public data.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "Tramèr et al. 2017. Cox applications.",
   "ost:stride": [
    "E"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1039.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0005"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0043.002"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0015"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t7"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t6"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-d10"
    }
   ],
   "skos:example": {
    "@value": "Tramèr, Papernot, Goodfellow, Boneh and McDaniel showed that models trained on the same task share much of their decision space, so adversarial examples crafted on one model transfer to others. \"The Space of Transferable Adversarial Examples\", 2017.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://arxiv.org/abs/1704.03453"
   }
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t3",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T3",
   "skos:prefLabel": {
    "@value": "Excessive Autonomy by Design",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Product decisions grant the agent autonomy that the risk model does not justify. Confirmation steps are removed because they are \"friction\". The autonomy becomes the blast radius.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "You gave the agent autonomy because the demo was cool.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t3"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Which confirmations were removed for UX reasons?",
     "@language": "en"
    },
    {
     "@value": "What is the worst thing the agent can do with no human in the loop?",
     "@language": "en"
    },
    {
     "@value": "Does the product justification survive a post-incident review?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Decide autonomy in the risk model, not in the demo: confirmation is the correct experience for irreversible actions.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Classify every agent action by reversibility and impact, and require confirmation for irreversible or high-impact ones whatever the product default.",
     "@language": "en"
    },
    {
     "@value": "Record each decision to remove a confirmation with its owner and rationale, and review it like an accepted risk.",
     "@language": "en"
    },
    {
     "@value": "Design confirmations to be quick and specific (what, where, how much) so users do not learn to click through them.",
     "@language": "en"
    },
    {
     "@value": "Roll out autonomy in steps: suggest, then act with confirmation, then act alone only for actions with a proven record.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "LLM06 taken seriously at the product level.",
   "ost:stride": [
    "E"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0053"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ha"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sk"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t5"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t2",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T2",
   "skos:prefLabel": {
    "@value": "Invisible Dependency",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "The agent's behaviour depends on model versions, prompt templates, tool descriptions, or memory state that are not in any tracked inventory.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "The thing you depend on is not in your SBOM.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t2"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "What determines this agent's behaviour?",
     "@language": "en"
    },
    {
     "@value": "Is all of it pinned, versioned, and inventoried?",
     "@language": "en"
    },
    {
     "@value": "What happens when an external dependency changes silently?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "Everything that determines the agent's behaviour is inventoried, pinned and versioned like code.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Extend the SBOM to an AI-BOM: model and version, system prompt and templates, tool descriptions and schemas, MCP servers, datasets and memory stores.",
     "@language": "en"
    },
    {
     "@value": "Pin model versions (not floating aliases) and prompt and tool versions by hash, and record them in every deployment.",
     "@language": "en"
    },
    {
     "@value": "Detect upstream changes (model updates, edited tool descriptions, template changes) and re-run evaluations before accepting them.",
     "@language": "en"
    },
    {
     "@value": "Version memory and configuration state so behaviour can be reproduced for an incident.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "LLM03. ASI04.",
   "ost:stride": [
    "T"
   ],
   "skos:closeMatch": [
    {
     "@id": "https://cwe.mitre.org/data/definitions/1357.html"
    }
   ],
   "skos:relatedMatch": [
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0109"
    },
    {
     "@id": "https://atlas.mitre.org/techniques/AML.T0010"
    }
   ],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-sq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-s9"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-h10"
    }
   ]
  },
  {
   "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-t1",
   "@type": "skos:Concept",
   "skos:notation": "EOA·T1",
   "skos:prefLabel": {
    "@value": "Wrong Abstraction",
    "@language": "en"
   },
   "skos:definition": {
    "@value": "Downstream processes, users, or agents treat model output as authoritative. The model is neither a database nor a source of truth, and any consumer that treats it as one imports every failure mode as a fact.",
    "@language": "en"
   },
   "skos:scopeNote": {
    "@value": "You are treating the model as a system of record.",
    "@language": "en"
   },
   "skos:inScheme": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#scheme"
   },
   "skos:broader": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#suit-structural-hazards"
   },
   "foaf:page": {
    "@id": "https://ostering.com/taxonomies/ai-agentic-systems/structural-hazards/#eoa-t1"
   },
   "ost:mitigationPrompt": [
    {
     "@value": "Where is model output treated as authoritative?",
     "@language": "en"
    },
    {
     "@value": "What provenance does the UI surface?",
     "@language": "en"
    },
    {
     "@value": "Is there a verification step, or has the caveat been lost?",
     "@language": "en"
    }
   ],
   "ost:mitigationPrinciple": {
    "@value": "The model is never the system of record: authoritative facts come from systems of record, and model output carries its provenance wherever it goes.",
    "@language": "en"
   },
   "ost:designMeasure": [
    {
     "@value": "Answer factual and policy questions from the system of record, with the model summarising retrieved content rather than recalling it.",
     "@language": "en"
    },
    {
     "@value": "Show provenance in the UI (source links, generated labels) and keep the label when output is copied, stored or forwarded.",
     "@language": "en"
    },
    {
     "@value": "Add a verification step before model output is used as input to a decision, record or another agent.",
     "@language": "en"
    },
    {
     "@value": "Make the organisation accountable for what its assistant says, and route disputes to a human who can correct the record.",
     "@language": "en"
    }
   ],
   "ost:cardReferences": "ASI09. LLM09 at the architectural level.",
   "ost:stride": [
    "T",
    "R"
   ],
   "skos:closeMatch": [],
   "skos:relatedMatch": [],
   "skos:related": [
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-dq"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-hj"
    },
    {
     "@id": "https://ostering.com/taxonomies/ai-agentic-systems/#eoa-ca"
    }
   ],
   "skos:example": {
    "@value": "Moffatt v. Air Canada: a British Columbia tribunal held the airline liable for its website chatbot's incorrect description of its bereavement fare policy, rejecting the argument that the chatbot was responsible for its own statements. February 2024.",
    "@language": "en"
   },
   "dct:references": {
    "@id": "https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"
   }
  }
 ]
}