Compliance: OWASP Agentic Top 10 conformance fixture pack

[pshkv]

Goal

Publish OWASP ASI01-ASI10 machine-testable runtime enforcement fixture pack.

External context

• Runtime Enforcement Mapping for OWASP Agentic Top 10 (ASI01–ASI10) OWASP/www-project-top-10-for-large-language-model-applications#802

Deliverables

• Mapping: ASI controls -> enforcement checkpoints.
• Required evidence fields by control.
• Negative tests: timeout, stale approvals, revocation races.

Acceptance criteria

• CI report generated from fixture run.
• Mapping doc linked from README.
• Reusable by non-SINT projects.

Collaboration CTA

Offer OWASP maintainers a PR with starter fixtures and invite feedback loop.

[pshkv]

Starting execution on this. Current state from what's already in the codebase:

The OWASP ASI01–ASI10 mapping exists implicitly in the test suite (1,197 tests, 31 packages), but without a machine-readable mapping document that OWASP's own project could reference. This issue converts implicit coverage into explicit, citeable conformance.

What "machine-testable fixture pack" means in practice:

For each ASI control:

• The SINT enforcement checkpoint that addresses it (e.g., ASI05 → CircuitBreaker + shell pattern detection in gate-forbidden-combos)
• The required evidence fields in the EvidenceEvent that prove the control fired
• A positive test (attack attempt → blocked, evidence emitted)
• A negative test (timeout, stale approval, revocation race → fail-closed, not silently allowed)

Controls with strong coverage already:

• ASI01 (Prompt Injection) → MCP proxy intercept + capability token scope check
• ASI04 (Privilege Escalation) → attenuation invariant in delegation + TOKEN_SUBJECT_MISMATCH enforcement
• ASI05 (Dangerous Capabilities) → CircuitBreaker patterns + shell/code execution detection
• ASI06 (Excessive Agency) → tier-based approval gates; T2/T3 require explicit operator/human sign-off

Controls where coverage is partial or needs formalizing:

• ASI02 (Memory Poisoning) → tamper-detection in evidence ledger exists; the attack fixture needs writing
• ASI03 (Tool Poisoning) → SchemaPin integration referenced but not yet an explicit conformance test
• ASI07 (Data Exfiltration) → rate limiting exists; cross-call data flow tracing not yet a fixture
• ASI08 (Resource Exhaustion) → rate limiting + circuit breaker cover this; needs dedicated negative test
• ASI09 (Cascading Hallucinations) → out of scope for SINT; this should be documented with rationale, not left silent
• ASI10 (Trust Boundary Violations) → delegation depth floor + tier escalation cover this; formalize

Proposed deliverable shape:
docs/conformance/owasp-asi-mapping.md with the full matrix, plus packages/conformance/ directory with fixture JSON files tagged by ASI control ID (same format as the A2A fixtures in PR #111). CI report generation can use the existing test runner with the new tags.

If anyone from the OWASP Agentic Security Initiative project is watching — feedback on the fixture format before we commit the schema would be valuable. The goal is a format reusable by non-SINT projects, not just a self-referential test suite.

[pshkv]

Shipped. All three deliverables are on main (commit ee988c5):

docs/conformance/owasp-asi-mapping.md
Citeable mapping of all 10 ASI controls to exact PolicyGateway.intercept() steps, enforcement class, event type emitted, and documented gaps. Direct link: https://github.com/sint-ai/sint-protocol/blob/main/docs/conformance/owasp-asi-mapping.md

packages/conformance-tests/fixtures/security/owasp-asi-conformance.v1.json
30 machine-readable test vectors (attack + safe case per control) in the same schema as the existing MCP attack surface fixtures. Other implementations can run their own gateway against these vectors to verify conformance. Direct link: https://github.com/sint-ai/sint-protocol/blob/main/packages/conformance-tests/fixtures/security/owasp-asi-conformance.v1.json

packages/conformance-tests/src/owasp-asi-conformance.test.ts
29 tests running against a live PolicyGateway instance — all passing in CI (175/175 total).

Coverage summary:

Control	Level	Enforcement Point
ASI01 Goal Hijack	Full	DefaultGoalHijackDetector + forbidden combos
ASI02 Tool Misuse	Full	Resource scope + tier assignment
ASI03 Identity Abuse	Full	Ed25519 validation + expiry + subject check
ASI04 Supply Chain	Full	DefaultSupplyChainVerifier (fingerprint + allowlist)
ASI05 Code Execution	Partial	checkForbiddenCombos (write→exec); gap: no semantic arg analysis
ASI06 Memory Poisoning	Partial	DefaultMemoryIntegrityChecker; gap: no embedding-layer analysis
ASI07 Inter-Agent Trust	Full	A2A bridge + delegation depth limit
ASI08 Resource Exhaustion	Full	Rate limiting + InMemoryCircuitBreaker
ASI09 Human Oversight Bypass	Full	T3_COMMIT forced escalation, fail-closed timeout
ASI10 Rogue Agent	Full	CircuitBreaker.trip() stop button + CSML auto-trip

Sending this to the OWASP Agentic Security Initiative project now for external review.