{"title":"OWASP ASI Mapping — 10 Workforce AI Security Requirements","description":"Workforce AI security requirements mapped to OWASP Top 10 for Agentic Applications, clause by clause. Agentic security risks ASI01–ASI10, from goal hijack to rogue agents.","updated":"2026-10-21","count":10,"requirements":[{"id":"SPM-009","section":"AI Security Posture Management","requirement":"Risk-score AI tools, connectors and agent workflows","acceptance":"Configurable factors such as vendor location, training on inputs, trust-center availability, account tier, autonomy, data sensitivity and tool power.","tier":"AT0–AT2","whyItMatters":"The risk in an AI tool usually sits in its data-handling terms, which change without the domain changing.","verificationMethod":"W","verificationTest":"Risk scores, with sources and factors, for five tools.","formerly":"DIS-009","alsoIn":[],"sort":8,"adoptionContext":"Risk scoring spans ordinary employee AI and MCP-extended workflows because sensitivity, autonomy and tool power vary independently of approval status.","mappings":[{"frameworks":["csf"],"explanation":"Configurable risk factors can support a repeatable method for documenting and prioritizing inherent risk. The buyer must still define the method and connect scores to threats, likelihood, impact and response decisions.","kind":"framework","references":{"csf":["GV.RM-06","ID.RA-05"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Sensitivity, autonomy and tool-power factors can inform the likelihood and magnitude of impacts. A product score does not by itself document the full range of beneficial and harmful impacts.","kind":"framework","references":{"rmf":["MAP 5.1"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Scoring connectors and agent workflows helps prioritize review of runtime-fetched tools and components exposed to agentic supply-chain risk. Scores do not verify component integrity.","kind":"framework","references":{"owasp":["ASI04"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"The configurable factors provide an AI risk-analysis step and inputs to repeat assessments and supplier due diligence. Risk criteria, likelihood, impact, ownership, acceptance and treatment remain the buyer’s responsibilities; a trust center is not assurance.","kind":"framework","references":{"soc2":["CC3.2","CC9.2"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Security-relevant scoring factors supply risk-analysis inputs; external-vendor factors also support supplier due diligence. The buyer must define risk criteria, likelihood, impact, ownership, acceptance and treatment. A score or vendor trust center is not a complete assessment or assurance; the supplier link applies only to external relationships.","kind":"framework","references":{"iso27001":["Cl. 6.1.2","A.5.19"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"ISO/IEC 42001: Validated tool and workflow risk factors provide inputs to the defined AI risk-assessment process and periodic or change-driven reassessments. A score does not establish a complete assessment, risk acceptance, treatment plan or assessment of effects on people or society. Supplier-specific factors, such as provider use of inputs and account terms, can also inform a defined responsible-AI supplier review; this supplier link applies only to external suppliers and validated evidence.","kind":"framework","references":{"iso":["Cl. 6.1.2","Cl. 8.2","A.10.3"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-009","frameworkRefs":{"ISO27001":["Cl. 6.1.2","A.5.19"],"ISO42001":["Cl. 6.1.2","Cl. 8.2","A.10.3"],"NIST-CSF":["GV.RM-06","ID.RA-05"],"NIST-AI-RMF":["MAP 5.1"],"SOC2":["CC3.2","CC9.2"],"OWASP-ASI":["ASI04"]}},{"id":"GRD-013","section":"Runtime Guardrails","requirement":"Support monitor, warn, block, and restrict actions","acceptance":"Set the action per policy and let the policy owner configure the intervention choices and block-page wording including removing any bypass, and record both the evaluation and the action. Support a monitor-first rollout. Where policy permits a user to proceed after a warning, require a business justification before continuing. Do not offer an override where policy disables bypass.","tier":"AT1–AT4","whyItMatters":"A control that can only block drives work onto personal devices. Graduated actions let policy match the risk.","verificationMethod":"LT","verificationTest":"Pilot users see monitor, warn and block outcomes with your wording, and each action is logged. For a warning policy that permits proceeding, show that the user must enter a business justification before continuing. For a blocking policy configured with no bypass, show that the user cannot override the block.","formerly":"DAT-003","alsoIn":[],"sort":23,"adoptionContext":"Intervention options are relevant across ordinary employee AI and connected-agent workflows, but each surface may support different monitor or enforcement actions.","mappings":[{"frameworks":["csf"],"explanation":"Configured block or restrict actions can protect data in transit when they act before egress. Monitor and warning modes do not establish enforced prevention.","kind":"framework","references":{"csf":["PR.DS-02"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Owner-configured interventions translate documented AI risk responses and responsible-use rules into operational choices. Their effect depends on the selected action; monitor-first rollout does not imply blocking.","kind":"framework","references":{"rmf":["MANAGE 1.3"],"iso":["A.9.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Policy-controlled interventions can limit agent tool misuse when applied to the tool action itself. General prompt monitoring does not establish that unsafe tool invocations are constrained.","kind":"framework","references":{"owasp":["ASI02"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Configurable interventions operationalize data-handling policy, and evaluation/action records provide an event trail. To prevent disclosure, restrictive actions must be enabled and tested before transfer; monitoring and warnings do not prevent egress.\nISO/IEC 27001: A.8.12: Use an active, approved leakage-control workflow at the stated data boundary; classification alone is insufficient. If claiming blocking, demonstrate it before egress. A.8.15: Keep attributable event records with appropriate retention, protection and analysis; a live view is insufficient. Policy approval, rollout criteria and exception ownership remain organizational responsibilities.","kind":"framework","references":{"soc2":["CC5.3","CC6.7"],"iso27001":["Cl. 8.1","A.8.12","A.8.15"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-013","frameworkRefs":{"ISO27001":["Cl. 8.1","A.8.12","A.8.15"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.DS-02"],"NIST-AI-RMF":["MANAGE 1.3"],"SOC2":["CC5.3","CC6.7"],"OWASP-ASI":["ASI02"]}},{"id":"AGT-001","section":"Agent & MCP Governance","requirement":"Govern tool calls at read, write and delete scope","acceptance":"Permit a read while refusing write, delete or other destructive actions, with every attempt logged and attributable.","tier":"AT1, AT3, AT4, AT6","whyItMatters":"One agent can read, write and delete in the same workflow. Allow or deny per app is too blunt.","verificationMethod":"LT","verificationTest":"Reads to a connected system are allowed while attempts to change or delete information are blocked.","formerly":null,"alsoIn":["guardrails"],"sort":36,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows can take consequential tool actions, making operation-level permissions relevant.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Allowing reads while refusing writes, deletes and destructive operations enforces least privilege at the tool-call boundary. Enforce restrictions before the operation and record every attempt with usable attribution, retention, protection and analysis. Warnings or a live view alone are insufficient; runtime refusal does not review or revoke the underlying connector grant.","kind":"framework","references":{"csf":["PR.AA-05"],"soc2":["CC6.3"],"iso27001":["A.8.3","A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"A defined, enforced boundary between permitted reads and prohibited destructive actions implements a concrete responsible-use procedure for agents. It contributes to the wider AI-use process without implying that the standard prescribes these exact API scopes.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Operation-level refusal limits destructive tool misuse and actions attempted through excessive or misapplied delegated identity. Attributable attempts help investigate those failures; the control covers the operations and tool paths where it is enforced.","kind":"framework","references":{"owasp":["ASI02","ASI03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-001","frameworkRefs":{"ISO27001":["A.8.3","A.8.15"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.AA-05"],"SOC2":["CC6.3"],"OWASP-ASI":["ASI02","ASI03"]}},{"id":"AGT-002","section":"Agent & MCP Governance","requirement":"Flag destructive, over-scoped or anomalous agent actions","acceptance":"Detect excessive permissions, unexpected tools, destructive operations, abnormal call sequences and policy bypass.","tier":"AT3, AT4, AT6","whyItMatters":"Destructive or unusual agent actions are often the first sign of a hijacked or misconfigured agent.","verificationMethod":"LT","verificationTest":"A destructive or out-of-pattern tool call in the pilot is flagged with context.","formerly":null,"alsoIn":["aidr"],"sort":37,"adoptionContext":"The listed connected-agent contexts can produce abnormal tool sequences, excessive scope or destructive operations that ordinary prompt inspection may miss.","mappings":[{"frameworks":["csf","iso","soc2","iso27001"],"explanation":"Detecting destructive operations, unexpected tools, abnormal call sequences and policy bypass supplies adverse-event analysis and monitoring of agent behavior. Excess-permission findings also inform access-right review; detection does not prevent an operation or reduce its permissions.\nISO/IEC 27001: A.8.16: Event assessment and response remain wider dependencies; test false-positive and response handling.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"iso":["A.6.2.6"],"soc2":["CC7.2","CC6.3"],"iso27001":["A.8.16","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Runtime findings supply the monitoring and evaluation component of post-deployment risk management. A detection capability alone does not establish the wider plan for user input, incident response, recovery and change management.","kind":"framework","references":{"rmf":["MANAGE 4.1"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Destructive calls and excessive permissions expose tool-misuse and identity-abuse patterns; abnormal sequences and policy bypass can also flag rogue-agent behavior. These are indicators for investigation, rather than proof that every anomalous agent is compromised or that the behavior is contained.","kind":"framework","references":{"owasp":["ASI02","ASI03","ASI10"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-002","frameworkRefs":{"ISO27001":["A.8.16","A.5.18"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MANAGE 4.1"],"SOC2":["CC7.2","CC6.3"],"OWASP-ASI":["ASI02","ASI03","ASI10"]}},{"id":"AGT-004","section":"Agent & MCP Governance","requirement":"Attribute every connector and tool call alert to a person","acceptance":"Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.","tier":"AT3, AT4, AT6","whyItMatters":"Without attribution, an agent action cannot be investigated or tied to accountability.","verificationMethod":"LT","verificationTest":"Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.","formerly":null,"alsoIn":["aidr","audit"],"sort":39,"adoptionContext":"The listed connected-agent contexts need an identity chain from the employee to the server and tool call, including the delegated identity actually used.","mappings":[{"frameworks":["soc2"],"explanation":"Linking the person, execution identity, server, tool, scope and result supplies usable information for correlating calls and reviewing identity use. It can reveal gaps between human and delegated identities; attribution alone does not authenticate the caller, manage the identity lifecycle or authorize the operation.","kind":"framework","references":{"soc2":["CC2.1","CC7.2"]},"relation":null,"conditions":[]},{"frameworks":["iso","iso27001"],"explanation":"The person-to-identity-to-tool chain supplies attribution needed for AI event records and an audit trail. Answering those questions does not by itself require persistent protected logs, and the chain must preserve the distinction between the person and any service or delegated identity.\nISO/IEC 27001: Human attribution must not expose credential values.","kind":"framework","references":{"iso":["A.6.2.8"],"iso27001":["A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Visible identity and scope relationships help investigate inherited-identity abuse, excessive delegation and confused-deputy behavior. Attribution exposes how authority was used; it does not itself stop an unauthorized call.","kind":"framework","references":{"owasp":["ASI03"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Joining the person, execution identity, server, tool, scope and result supports event correlation. Attribution does not authenticate the caller, manage identity lifecycles or authorize the operation.","kind":"framework","references":{"csf":["DE.AE-03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-004","frameworkRefs":{"ISO27001":["A.8.15"],"ISO42001":["A.6.2.8"],"NIST-CSF":["DE.AE-03"],"SOC2":["CC2.1","CC7.2"],"OWASP-ASI":["ASI03"]}},{"id":"AGT-005","section":"Agent & MCP Governance","requirement":"Provide targeted containment for a single connector or tool.","acceptance":"Disable or revoke one connector, tool, plugin, or integration for a user or group without switching off the whole AI tool.","tier":"AT1, AT2, AT3, AT6","whyItMatters":"When one connector misbehaves, switching off the whole AI tool punishes everyone.","verificationMethod":"LT","verificationTest":"One connector is disabled for one pilot group while the AI tool keeps working.","formerly":null,"alsoIn":["aidr"],"sort":40,"adoptionContext":"The listed agent contexts may share an AI client across multiple connectors, making targeted revocation preferable to disabling the whole tool when feasible.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Disabling an affected connector or revoking its token removes a specific access path and supplies an incident-containment action. It contributes to eradication only where it removes the compromised access mechanism; containment alone does not establish complete eradication or incident response.\nISO/IEC 27001: A.5.26: Integrate containment into the buyer’s incident process. A.5.18: Review effective access and adjust or revoke it where required; cached access and in-flight actions may survive revocation.","kind":"framework","references":{"csf":["RS.MI-01","RS.MI-02"],"soc2":["CC6.3","CC7.4"],"iso27001":["A.5.26","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"A targeted disablement mechanism enables disengagement of an unsafe AI dependency while other functions remain available. It contributes to operational response, but the capability alone does not establish who has authority to invoke it or a complete operational-support process.","kind":"framework","references":{"rmf":["MANAGE 2.4"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Isolating a connector, tool or token can interrupt propagation through an agent workflow, matching the isolation and circuit-breaker approach to cascading failures. The scope and timing of disablement determine which downstream actions it can contain.","kind":"framework","references":{"owasp":["ASI08"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-005","frameworkRefs":{"ISO27001":["A.5.26","A.5.18"],"ISO42001":["A.6.2.6"],"NIST-CSF":["RS.MI-01","RS.MI-02"],"NIST-AI-RMF":["MANAGE 2.4"],"SOC2":["CC6.3","CC7.4"],"OWASP-ASI":["ASI08"]}},{"id":"AGT-006","section":"Agent & MCP Governance","requirement":"Discover the MCP servers and connectors employees attach to their AI clients","acceptance":"Inventory local and remote MCP servers reached from desktop, IDE and CLI AI tools with owner, scope and exposure.","tier":"AT3, AT4, AT6","whyItMatters":"MCP-capable clients now ship inside IDEs, terminals and desktop apps, and each connector is a new path to corporate data.","verificationMethod":"LT","verificationTest":"Local and remote MCP servers used by pilot users appear with client, owner, scope and exposure.","formerly":"DIS-007","alsoIn":["spm"],"sort":41,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows can attach external servers, so connector discovery must reach those integration paths.","mappings":[{"frameworks":["csf","rmf"],"explanation":"The MCP and connector inventory identifies third-party components and services, with owner, scope and exposure to inform supplier prioritization and component-risk mapping. Discovery alone does not assess their risks.","kind":"framework","references":{"csf":["GV.SC-04","ID.AM-04"],"rmf":["MAP 4.1"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"ISO/IEC 42001: The local and remote MCP/connector inventory documents resources relevant to AI activities, including their owner, scope and exposure, supporting A.4.2. External MCP servers and connectors also identify supplier relationships to govern under A.10.3; locally owned servers are not automatically suppliers. Inventory does not establish supplier due diligence or trustworthiness.","kind":"framework","references":{"iso":["A.4.2","A.10.3"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"The inventory exposes external MCP servers and runtime-connected components relevant to agentic supply-chain compromise. It provides a review surface, not evidence that components are trustworthy.","kind":"framework","references":{"owasp":["ASI04"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Owned connector records supply usable inventory/control information and inputs to supplier-risk review. Keeping the register current does not itself approve a connector or reduce its permissions.\nISO/IEC 27001: Maintain usable, owned inventory records. Internally owned servers are not automatically suppliers, and discovery does not assess supplier security.","kind":"framework","references":{"soc2":["CC2.1","CC9.2"],"iso27001":["A.5.9","A.5.19"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-006","frameworkRefs":{"ISO27001":["A.5.9","A.5.19"],"ISO42001":["A.4.2","A.10.3"],"NIST-CSF":["GV.SC-04","ID.AM-04"],"NIST-AI-RMF":["MAP 4.1"],"SOC2":["CC2.1","CC9.2"],"OWASP-ASI":["ASI04"]}},{"id":"AGT-007","section":"Agent & MCP Governance","requirement":"Map the actions available via each connector.","acceptance":"Show, per connector/MCP server, what actions are available and which are currently enabled.","tier":"AT3, AT4, AT6","whyItMatters":"Approving a connector without knowing which actions it exposes and which are enabled leaves the scope of available functionality unclear.","verificationMethod":"W","verificationTest":"For three connectors you name, the console lists the actions each exposes and shows which are currently enabled.","formerly":"DIS-008","alsoIn":["spm"],"sort":42,"adoptionContext":null,"mappings":[{"frameworks":["soc2","iso27001"],"explanation":"An inventory of connector actions and their enabled status supports risk assessment and access-rights review. It provides review inputs; it does not demonstrate effective permissions or their enforcement.","kind":"framework","references":{"soc2":["CC3.2","CC6.3"],"iso27001":["Cl. 6.1.2","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Knowing which actions a connector exposes helps identify risks and control needs associated with third-party components.","kind":"framework","references":{"rmf":["MAP 4.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Reviewing available and enabled actions helps identify unnecessarily broad functionality. Assessing identity and privilege abuse also requires evidence about agent identities, credentials and delegated permissions. These mappings concern action visibility and review, not reachable-file discovery or data-flow mapping.","kind":"framework","references":{"owasp":["ASI03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-007","frameworkRefs":{"ISO27001":["Cl. 6.1.2","A.5.18"],"NIST-AI-RMF":["MAP 4.2"],"SOC2":["CC3.2","CC6.3"],"OWASP-ASI":["ASI03"]}},{"id":"AGT-008","section":"Agent & MCP Governance","requirement":"Support local and remote MCP gateway placement for employee AI clients","acceptance":"Support applicable Windows, macOS and Linux patterns, allow endpoint-integrated or remote placement, and define traffic coverage for each.","tier":"AT3, AT4, AT6","whyItMatters":"Different MCP clients need different gateway placements to be covered.","verificationMethod":"W + D","verificationTest":"The vendor shows local and remote MCP gateway placement and documents what each covers.","formerly":"ARC-005","alsoIn":[],"sort":43,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows motivate local or remote gateway placement; these contexts do not necessarily involve agent-to-agent communication.","mappings":[{"frameworks":["rmf"],"explanation":"Documented MCP gateway placement identifies where component controls can operate and which traffic they cover. It supplies architecture evidence rather than proof of effective authentication or inspection.","kind":"framework","references":{"rmf":["MAP 4.2"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Operating-system patterns, local or remote gateways and their dependencies provide computing-resource information for AI deployment. Availability of placement options does not establish secure operation.","kind":"framework","references":{"iso":["A.4.5"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"An MCP gateway’s location and coverage can establish an inspection boundary for runtime-fetched servers and other agentic supply-chain components. Placement alone neither assesses their trustworthiness nor prevents malicious components.","kind":"framework","references":{"owasp":["ASI04"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-008","frameworkRefs":{"ISO42001":["A.4.5"],"NIST-AI-RMF":["MAP 4.2"],"OWASP-ASI":["ASI04"]}},{"id":"AGT-009","section":"Agent & MCP Governance","requirement":"Detect indirect prompt injection in content agents read","acceptance":"Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.","tier":"AT3, AT4, AT6","whyItMatters":"A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.","verificationMethod":"LT","verificationTest":"Injected instructions in content returned to pilot users' agents are detected and attributed to their source.","formerly":"DAT-014","alsoIn":["aidr"],"sort":44,"adoptionContext":"Indirect injection enters through connected-agent workflows and retrieved content; the listed tiers do not imply identical detection coverage.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Evidence and source attribution for injection, jailbreak and bypass behavior support adverse-event analysis, security monitoring and event triage. Test connector responses, retrieved content and tool outputs even with benign user prompts; prompt injection is not automatically malware, and detection does not guarantee blocking or constitute malware prevention.\nISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"soc2":["CC7.2"],"iso27001":["A.8.16","A.5.25"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Detection evidence, originating sources, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.","kind":"framework","references":{"rmf":["MEASURE 3.1"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Direct and indirect malicious instructions can hijack agent goals under ASI01. ASI06 applies when content poisons retained or retrievable context; a malicious connector response is not automatically memory poisoning. Detection coverage must be demonstrated, and blocking is not guaranteed.","kind":"framework","references":{"owasp":["ASI01","ASI06"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-009","frameworkRefs":{"ISO27001":["A.8.16","A.5.25"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MEASURE 3.1"],"SOC2":["CC7.2"],"OWASP-ASI":["ASI01","ASI06"]}}]}