Every control claim on this page maps to a specific field in the record schema and a specific test in the WSS Protocol test harness. Hand this page to your security team.
All 10 risks mapped to specific record fields. Evidence Type distinguishes pre-execution prevention from post-execution recording. The controls exist in the architecture. This is not a marketing document.
| # | OWASP Risk | Evidence Type | Controls | What the artifact proves |
|---|---|---|---|---|
| 1 | Goal hijacking | Prev + Record | input_hash · substrate enforcement · AUTHORIZATION_INPUT_MISMATCH | Input committed in signed token before execution. Substrate blocks if actual input differs. Artifact proves authorized vs presented input. |
| 2 | Tool misuse | Prev + Record | tool_call_log · authorization_token_id · action_type · BLOCK_ON_SERVICE_UNAVAILABLE | Signed token declares action_type pre-execution. tool_call_log records every tool invoked. Comparison proves misuse. |
| 3 | Identity abuse | Recording | principal_identity · signing_key_id · HSM signing | Every artifact names the agent the substrate recorded as acting, inside the signed payload. Altering it breaks the signature. |
| 4 | Memory poisoning | Recording | full_prompt_snapshot · rag_evidence_bundle · causality_chain_hash | Complete prompt captured at call time. RAG sources recorded with provenance. Forensic examiner identifies poisoning across chain. |
| 5 | Cascading failures | Recording | causality_chain_hash · instrumentation_coverage · RECORD_COMMIT_FAILED | Hash-chained record of every step. Coverage records instrumented vs uninstrumented nodes. Failure patterns reconstructable. |
| 6 | Insecure output handling | Recording | output_pre_postprocess · execution_result | Raw model output before and after filters. Delta is auditable. Insecure handling detectable from artifact. |
| 7 | Code execution abuse | Prev + Record | action_type · tool_call_log · BLOCK_ON_SERVICE_UNAVAILABLE | TIER-A token required before code execution. action_type and tool_call_log prove authorized vs actual execution. |
| 8 | Human-agent trust exploitation | Prev + Record | policy_version_hash · availability_policy · CONFIGURABLE_BY_ACTION_TYPE | Human approval tokens required for high-risk actions. Policy version bound to artifact proves governance in force at decision time. |
| 9 | Supply chain risks | Recording | model_version_hash · registry_validation_status · sdk_binary_sha3 · rekor_log_id | Exact model, SDK binary hash, Sigstore transparency log entry. Complete forensic supply chain traceability. |
| 10 | Rogue agents | Recording | deployment_mode · evidence_tier (TIER-A/B/C) · instrumentation_coverage | Trust level per artifact. Uninstrumented nodes produce TIER-B boundary records flagging potential rogue paths. |
records address specific NIST SP 800-53 controls. The full mapping is published on GitHub alongside the OWASP mapping.
| Control family | Control | How PlainReal addresses it |
|---|---|---|
| Audit and Accountability (AU) | AU-2, AU-3, AU-9, AU-10 | Non-repudiable, tamper-evident record of every consequential AI agent action. Ed25519 signature binds the artifact to the signing key. |
| Access Control (AC) | AC-2, AC-3, AC-6 | Authorization Token binds pre-execution approval to a specific action_type and principal_identity before the agent runs. |
| Identification and Authentication (IA) | IA-2, IA-9 | principal_identity + signing_key_id fields provide cryptographic proof of agent identity per artifact. |
| System and Information Integrity (SI) | SI-7 | SHA3-256 record_hash over 28 fields. S3 Object Lock COMPLIANCE mode prevents post-commit modification. |
| Configuration Management (CM) | CM-3, CM-5 | policy_version_hash and model_version_hash bind the exact policy and model in force at decision time to the artifact. |
| Supply Chain Risk Management (SR) | SR-4, SR-11 | sdk_binary_sha3 and rekor_log_id provide Sigstore-anchored supply chain traceability for model and SDK. |
What makes a record audit-grade is the combination of these four properties. Each one is independently verifiable without PlainReal cooperation.
Every record is signed inside PlainReal infrastructure. Production uses a FIPS 140-2 Level 3 HSM. Design partner phase uses software signing with the same Ed25519 algorithm and identical schema. The signature binds each artifact to a specific signing key and proves it could not have been produced by anyone else.
Artifacts are written to your S3 bucket in COMPLIANCE mode, not GOVERNANCE. Once committed, the object cannot be modified or deleted by anyone, including PlainReal, the AWS account root, or your own administrators. This is what gives the record evidentiary integrity under examination.
After the WORM commit confirms, the artifact hash is timestamped by an independent RFC 3161 timestamp authority. Three parties hold pieces of the trust: you (the bucket), PlainReal (the signature), and the TSA (the timestamp). No single party can alter the record.
Any past artifact is independently verifiable using only the published public key, for forensic moments and audit walkthroughs. The signing service, schema currency as regulations evolve, and the auditor reference base are the ongoing PlainReal layer that keeps producing new artifacts.
Every artifact is verifiable offline using the standalone CLI and the published public key. No PlainReal infrastructure required. No vendor cooperation required.
The public key confirms that PlainReal signed the artifact and that it has not been tampered with since. It does not provide access to decision content. The underlying data stays in your S3 bucket, under your own access controls. Possession of the public key by anyone outside your organization gives them nothing they could not already see if they had access to your bucket.
| Verification element | Where it lives | What it proves |
|---|---|---|
| Public key fingerprint | keys.plainreal.com (coming soon) | The signing key used to produce the artifact. Verifiable against the artifact's signing_attestation field. |
| record_hash | Artifact field, cryptographic hash | Covers all non-signing fields. Any modification breaks the hash. Verifiable without PlainReal. |
| WORM confirmation | S3 GetObjectRetention (per-artifact) | lock_mode = COMPLIANCE and retain_until_date confirm the object cannot have been modified since commit. |
| RFC 3161 timestamp | separate .tsr token | Evidences that the artifact existed at the stated time, countersigned by a neutral timestamp authority. It is a separate file, not a field: the Ed25519 signature covers content, not time. Published sample records carry no token. |
| Standalone verify CLI | Published at launch (open source) | Verifies signature, hash, and WORM confirmation from any environment. No PlainReal account required. |
Send the full OWASP mapping to your security architect. If they have questions we have not addressed here, we want to know.
Contact us ↗