Every control claim on this page maps to a specific field in the record schema and a specific test in the write-storage-seal harness, which covers the commit sequence end to end. Hand this page to your security team.
All 10 risks mapped to specific record fields. Evidence Type distinguishes pre-execution prevention from post-execution recording. The controls exist in the architecture. This is not a marketing document.
| ID | OWASP Risk | Evidence Type | Controls | What the artifact proves |
|---|---|---|---|---|
| ASI01 | Agent goal hijack | Prev + Record | input_hash · substrate enforcement · AUTHORIZATION_INPUT_MISMATCH | Input committed in signed token before execution. Substrate blocks if actual input differs. Artifact proves authorized vs presented input. |
| ASI02 | Tool misuse and exploitation | Prev + Record | tool_call_log · authorization_token_id · action_type · BLOCK_ON_SERVICE_UNAVAILABLE | Signed token declares action_type pre-execution. tool_call_log records every tool invoked. Comparison proves misuse. |
| ASI03 | Identity and privilege abuse | Recording | principal_identity · signing_key_id · HSM signing | Every artifact names the agent the substrate recorded as acting, inside the signed payload. Altering it breaks the signature. |
| ASI04 | Agentic supply chain vulnerabilities | Recording | model_version_hash · registry_validation_status · sdk_binary_sha3 · rekor_log_id | Exact model, SDK binary hash, Sigstore transparency log entry. Complete forensic supply chain traceability. |
| ASI05 | Unexpected code execution | Prev + Record | action_type · tool_call_log · BLOCK_ON_SERVICE_UNAVAILABLE | TIER-A token required before code execution. action_type and tool_call_log prove authorized vs actual execution. |
| ASI06 | Memory and context poisoning | Recording | full_prompt_snapshot · rag_evidence_bundle · causality_chain_hash | Complete prompt captured at call time. RAG sources recorded with provenance. Forensic examiner identifies poisoning across chain. |
| ASI07 | Insecure inter-agent communication | Recording | causality_chain_hash · instrumentation_coverage | Each hand-off commits the parent record’s hash, so an inserted or missing step is detectable afterwards. Uninstrumented agents in the chain are marked, not assumed. PlainReal does not secure the channel; it evidences the hand-off. |
| ASI08 | Cascading failures | Recording | causality_chain_hash · instrumentation_coverage · RECORD_COMMIT_FAILED | Hash-chained record of every step. Coverage records instrumented vs uninstrumented nodes. Failure patterns reconstructable. |
| ASI09 | Human-agent trust exploitation | Prev + Record | policy_version_hash · availability_policy · CONFIGURABLE_BY_ACTION_TYPE | Human approval tokens required for high-risk actions. Policy version bound to artifact proves governance in force at decision time. |
| ASI10 | Rogue agents | Recording | deployment_mode · evidence_tier (TIER-A/B/C) · instrumentation_coverage | Trust level per artifact. Uninstrumented nodes produce TIER-B boundary records flagging potential rogue paths. |
| n/a | Insecure output handlingOWASP LLM Top 10, not on the agentic list | Recording | output_pre_postprocess · execution_result | Raw model output before and after filters. Delta is auditable. Insecure handling detectable from artifact. |
records address specific NIST SP 800-53 controls. The full mapping is published on GitHub alongside the OWASP mapping.
| Control family | Control | How PlainReal™ addresses it |
|---|---|---|
| Audit and Accountability (AU) | AU-2, AU-3, AU-9, AU-10 | Non-repudiable, tamper-evident record of every consequential AI agent action. Ed25519 signature binds the artifact to the signing key. |
| Access Control (AC) | AC-2, AC-3, AC-6 | Authorization Token binds pre-execution approval to a specific action_type and principal_identity before the agent runs. |
| Identification and Authentication (IA) | IA-2, IA-9 | principal_identity + signing_key_id fields provide cryptographic proof of agent identity per artifact. |
| System and Information Integrity (SI) | SI-7 | SHA3-256 record_hash over the 32 signed fields. S3 Object Lock COMPLIANCE mode prevents post-commit modification. |
| Configuration Management (CM) | CM-3, CM-5 | policy_version_hash and model_version_hash bind the exact policy and model in force at decision time to the artifact. |
| Supply Chain Risk Management (SR) | SR-4, SR-11 | sdk_binary_sha3 and rekor_log_id provide Sigstore-anchored supply chain traceability for model and SDK. |
What makes a record hold up is the combination of these four properties. Each one is independently verifiable without PlainReal cooperation.
Every record is signed inside PlainReal infrastructure. Signing today is in software, using Ed25519 (FIPS 186-5). Moving it into a FIPS 140-3 Level 3 HSM is a later phase, with the same algorithm and identical schema. The signature binds each artifact to a specific signing key and proves it could not have been produced by anyone else.
Artifacts are written to your S3 bucket in COMPLIANCE mode, not GOVERNANCE. Once committed, the object cannot be modified or deleted by anyone, including PlainReal, the AWS account root, or your own administrators. This is what gives the record evidentiary integrity under examination.
After the WORM commit confirms, the artifact hash is timestamped by an independent RFC 3161 timestamp authority. Three parties hold pieces of the trust: you (the bucket), PlainReal (the signature), and the TSA (the timestamp). No single party can alter the record.
Any past artifact is independently verifiable using only the published public key, for forensic moments and audit walkthroughs. The signing service, schema currency as regulations evolve, and the auditor reference base are the ongoing PlainReal layer that keeps producing new artifacts.
Every artifact is verifiable offline using the standalone CLI and the published public key. No PlainReal infrastructure required. No vendor cooperation required.
The public key confirms that PlainReal signed the artifact and that it has not been tampered with since. It does not provide access to decision content. The underlying data stays in your S3 bucket, under your own access controls. Possession of the public key by anyone outside your organization gives them nothing they could not already see if they had access to your bucket.
| Verification element | Where it lives | What it proves |
|---|---|---|
| Public key fingerprint | verify.plainreal.com/samples/demo_pubkey.pem | The signing key used to produce the artifact. Verifiable against the artifact's signing_attestation field. |
| record_hash | Artifact field, cryptographic hash | Covers all non-signing fields. Any modification breaks the hash. Verifiable without PlainReal. |
| WORM confirmation | S3 GetObjectRetention (per-artifact) | lock_mode = COMPLIANCE and retain_until_date confirm the object cannot have been modified since commit. |
| RFC 3161 timestamp | separate .tsr token | Evidences that the artifact existed at the stated time, countersigned by a neutral timestamp authority. It is a separate file, not a field: the Ed25519 signature covers content, not time. Published sample records carry no token. |
| Verifier page integrity | signed release tag on github.com/plainreal/verify | Each release is a signed tag whose message names the SHA-256 of public/index.html. A hash published only inside the repository it describes would be circular, since whoever can edit one can edit the other; the signature is what ties those bytes to a key. Hash the page you were served and compare it against the tag to confirm you are running the release, not something substituted for it. |
| Independent verifier | verify.plainreal.com · source | Checks the signature and the record hash in your browser. It makes no network request and stores nothing, so you can read what it does before running it. No PlainReal account, and no PlainReal service involved. |
Send the full OWASP mapping to your security architect. If they have questions we have not addressed here, we want to know.
Contact us ↗