feat(schema): optional verification_method field + Agentic_AIUC1 pilot

CHANGELOG.md

@@ -21,6 +21,10 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   scope changes (LLM01 cross-modal 2.2.3/2.2.4, LLM04 artifact provenance 3.1.1/3.1.3, LLM05 fine-tuning subversion
   6.1.2/3.5.1, LLM08 hidden context 10.2.4, LLM10 generated code 9.3.7). AISVS has no requirement for scanning
   generated code itself; the LLM10 section says so.
+- **Optional `verification_method` mapping field** (#101). Records how an assessor can check the control is implemented.
+  Non-breaking: rows without it are unchanged. Documented in `docs/SCHEMA_V2_MIGRATION.md`; not exported to OLIR.
+  Piloted in `agentic-top10/Agentic_AIUC1.md` (all values DRAFT pending SME review), with methods adapted from the
+  NPW Agentic AI Control Catalogue.
 
 Next: npm publish to npmjs.com, custom domain (crosswalk.owasp.org), vendor integration packs, NeMo Guardrails configs.
 

data/entries/ASI01.json

@@ -777,6 +777,7 @@
       "control_name": "Third-party testing of adversarial robustness",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Injection test executed through each distinct ingestion path + Inject a sub-goal in test; confirm detection and that the attempt is counted (NPW C02, C07); evidence: current third-party test report",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -786,6 +787,7 @@
       "control_name": "Detect adversarial input",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Inject a sub-goal in test; confirm detection and that the attempt is counted + Introduce a known deviation and confirm the auditing model flags it (NPW C07, H08)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -795,6 +797,7 @@
       "control_name": "Implement real-time input filtering",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Filter evaluated against a defined test set + Run a maintained payload test corpus (NPW C05, C03)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -804,6 +807,7 @@
       "control_name": "Prevent unauthorized AI agent actions",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Agent Charter present, current, and matching observed behaviour + Attempt objective modification through the reflection path; confirm rejection (NPW B01, C08)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI02.json

@@ -771,6 +771,7 @@
       "control_name": "Third-party testing of adversarial robustness",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Execute a known policy-circumventing chain in a test environment + Attempt an out-of-scope tool call and confirm denial (NPW H09, A08); evidence: current third-party test report",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -780,6 +781,7 @@
       "control_name": "Prevent AI endpoint scraping",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Review limit configuration; force a breach in a test environment (NPW B04)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -789,6 +791,7 @@
       "control_name": "Prevent unauthorized AI agent actions",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Diff the tool registry against the per-agent allowlist + Inspect grant and revocation records for a sampled task (NPW B02, B09)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -798,6 +801,7 @@
       "control_name": "Enforce user access privileges to AI systems",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Attempt an out-of-scope tool call and confirm denial (NPW A08); repeat for several users with different permissions",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI03.json

@@ -766,6 +766,7 @@
       "control_name": "Enforce user access privileges to AI systems",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Trace a downstream system call and confirm the principal is resolvable + Escalation attempt in a test environment (NPW A04, F03)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -775,6 +776,7 @@
       "control_name": "Protect model deployment environment",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Secret scanning across agent runtime and logs + Inspect credential store; confirm maximum time-to-live against policy (NPW E08, A02)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI04.json

@@ -757,6 +757,7 @@
       "control_name": "Third-party testing of adversarial robustness",
       "tier": "Hardening",
       "scope": "Both",
+      "verification_method": "DRAFT — Confirm tools, connectors and MCP servers are in the scope of the current third-party adversarial test report",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -775,6 +776,7 @@
       "control_name": "Protect model deployment environment",
       "tier": "Hardening",
       "scope": "Both",
+      "verification_method": "DRAFT — Verification record for each deployed component + Verify signatures; reconcile the SBOM against deployed components (NPW E02, E09)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI05.json

@@ -747,6 +747,7 @@
       "control_name": "Third-party testing of adversarial robustness",
       "tier": "Foundational",
       "scope": "Build",
+      "verification_method": "DRAFT — Sandbox escape test + Submit code with a known finding through the pipeline; confirm it is blocked (NPW B06, B14); evidence: current third-party test report",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -765,6 +766,7 @@
       "control_name": "Prevent unauthorized AI agent actions",
       "tier": "Foundational",
       "scope": "Build",
+      "verification_method": "DRAFT — Sandbox escape test + Confirm sandbox lifecycle configuration; verify no state survives an execution (NPW B06, B10)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -774,6 +776,7 @@
       "control_name": "Limit output over-exposure",
       "tier": "Foundational",
       "scope": "Build",
+      "verification_method": "DRAFT — Submit code with a known finding through the pipeline; confirm it is blocked (NPW B14)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI06.json

@@ -755,6 +755,7 @@
       "control_name": "Detect adversarial input",
       "tier": "Hardening",
       "scope": "Both",
+      "verification_method": "DRAFT — Inject a known anomaly and confirm the alert fires + Log sample showing write source for each memory entry (NPW D06, D04)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -764,6 +765,7 @@
       "control_name": "Implement real-time input filtering",
       "tier": "Hardening",
       "scope": "Both",
+      "verification_method": "DRAFT — Attempt to commit an unverified fact and confirm the gate fires (NPW D07)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI07.json

@@ -746,6 +746,7 @@
       "control_name": "Enforce user access privileges to AI systems",
       "tier": "Hardening",
       "scope": "Build",
+      "verification_method": "DRAFT — Attempt a cross-zone instruction from a lower to a higher trust zone + Escalation attempt in a test environment (NPW F09, F03)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -755,6 +756,7 @@
       "control_name": "Protect model deployment environment",
       "tier": "Hardening",
       "scope": "Build",
+      "verification_method": "DRAFT — Attempt to spoof an agent message and confirm rejection (NPW F01)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI08.json

@@ -755,6 +755,7 @@
       "control_name": "Prevent unauthorized AI agent actions",
       "tier": "Foundational",
       "scope": "Both",
+      "verification_method": "DRAFT — Review limit configuration; force a breach in a test environment + Attempt a high-risk operation with a single agent and confirm it is blocked (NPW B04, F08)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/entries/ASI10.json

@@ -763,6 +763,7 @@
       "control_name": "Third-party testing of adversarial robustness",
       "tier": "Hardening",
       "scope": "Both",
+      "verification_method": "DRAFT — Induce a deviation and confirm the alert + Discovery run record and disposition of findings (NPW H05, H07); evidence: current third-party test report",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -772,6 +773,7 @@
       "control_name": "Detect adversarial input",
       "tier": "Hardening",
       "scope": "Both",
+      "verification_method": "DRAFT — Induce a deviation and confirm the alert (NPW H05)",
       "confidence": "unreviewed",
       "reviewed_by": []
     },

data/schema.json

@@ -164,6 +164,10 @@
             "type": "string",
             "description": "The framework release this row was authored against, e.g. \"ISO 27001:2022\". Pinning it is what makes version rot detectable instead of silent."
           },
+          "verification_method": {
+            "type": "string",
+            "description": "How can we check that the control is implemented for this risk: the evidence, test or artefact to examine. Optional. Not exported to OLIR, which has no corresponding field."
+          },		  
           "reviewed_by": {
             "type": "array",
             "items": {

docs/SCHEMA_V2_MIGRATION.md

@@ -36,6 +36,7 @@ than a rewrite of it.
 | `framework_version` | string | crosswalk |
 | `reviewed_by` | string[] | crosswalk |
 | `review_date` | date | crosswalk |
+| `verification_method` | string | crosswalk |
 
 ### `relationship` — the logical comparison
 
@@ -103,6 +104,19 @@ against ASVS 4.0.3 and a mapping written against 5.0 are indistinguishable.
 
 `reviewed_by` holds named humans. An agent never adds itself.
 
+### `verification_method` — how the control is checked
+
+`verification_method` says how an assessor confirms the control is actually in
+place: evidence, validation test(s), or artefacts to inspect.
+
+The field is optional and non-breaking. Rows without it are unchanged.
+
+- Method is a security judgment, so it lands as `DRAFT — <method>` pending SME
+  review, the same as `relationship` and `confidence`.
+- Where a method is adapted from an external source, cite the specific control
+  in the cell and attribute the source in the file header.
+- It is not exported to OLIR, which has no corresponding field.
+
 ---
 
 ## Migration state