1. Plan: AI Policy & Safe Experimentation
1.1
Inadequate AI and Agentic Policy
1.10
No Vetting Path for Tools and External Context Sources
1.11
Missing Autonomy-Level Classification
1.12
No Action-Authorization Policy Defined
1.13
No Agentic Identity Policy Defined
1.2
Governance Misalignment
1.3
Undefined Risk Tolerance & Categorization
1.4
Unmonitored AI and Agent Experimentation
1.5
Insecure Experiment Logging & Monitoring
1.6
Overly Permissive Permissions in Experimentation
1.7
Experiment Output Data Leakage
1.8
Unauthorised / Prohibited Component Usage
1.9
Incomplete Threat Modeling for AI and Agentic Systems
2. Code/No Code: AI Asset Discovery
2.1
Incomplete Asset Inventory
2.2
Unidentified Third-Party AI and Agentic Integrations
2.3
Undocumented Data and Agent Communication Flows
2.4
Lack of Clarity on AI System Purpose and Criticality
2.5
Discovery of Outdated or Orphaned AI and Agentic Assets
2.6
Untracked Agent Identities
2.7
Unmapped Inter-Agent Topology
2.8
Unvetted Local / Endpoint Agents
3. Build: AI Security Posture Management
3.1
Vulnerable AI Frameworks, Harnesses, and Agentic Platforms
3.10
Failure to Specify or Enforce Secure Agent Posture
3.11
Insufficient Understanding of Agent Reachable Graph
3.12
Exposed AI and Agent Access Credentials in Discovered Assets
3.13
Over-Scoped Agent Tool Permissions and Connectors
3.14
Inherited Identity Sprawl
3.15
Insecure Agent Memory and Vector Store Configuration
3.16
Missing Per-Action Authorization Policy at Build
3.17
Unvetted MCP Server Definitions
3.18
Posture Drift / Configuration Drift Over Time
3.2
Insecure Agent Instructions Prompt and Configuration Design
3.3
Insecure ML, Data, and Agentic Pipeline Jobs
3.4
Intellectual Property (IP) Theft of Models
3.5
Misclassified or Undocumented Sensitive Data Usage
3.6
Insufficient Human Oversight in Model and Agent Development
3.7
Insecure Temporary Artifacts or Intermediate Data Storage
3.8
Unvetted Use of Open-Source and Third-Party AI and Agentic Components
3.9
Exposed or Hardcoded Credentials in Build Artifacts
4. Test: AI Red Teaming
4.1
Untested Agent
4.10
Untested Reasoning-Chain Manipulation
4.11
Untested Endpoint Agent Behaviors
4.2
Incomplete Red-Team Coverage
4.3
Lack of Risk Assessment Process
4.4
Insecure Storage of Red Teaming Artifacts
4.5
Insufficient Multimodal Security Testing
4.6
Limited Foreign Language Red Teaming
4.7
Limited Scope of Evasion Technique Testing
4.8
Untested Tool Chain and Multi-Agent Workflows
4.9
Untested Memory Persistence Attacks
5. Deploy: Runtime Guardrails
5.1
Insecure Agent Harness and Runtime Configuration
5.10
Malicious or Policy-Violating Action by Agent
5.11
Runaway Agent / Reasoning Loop DoS
5.12
Agent Resource Abuse
5.13
Missing Action-Level Authorization at Runtime
5.14
Excessive IAM Role Assumption by Cloud Agent Runtime
5.15
Agent Sandbox Escape via Runtime DNS or Filesystem
5.16
Cross-Tenant or Cross-Workspace Data Leak via Embedded Copilots
5.17
Maker-Identity Inheritance in Low-Code Agents
5.18
Agent Session Smuggling and A2A Identity Impersonation
5.19
Unsafe Consumption of Agent Output by Downstream Systems
5.2
Unauthorized Agent Config or System Prompt Tampering at Runtime
5.20
Privilege Amplification via Confused-Deputy Agent
5.3
Direct Prompt Injection at Agent Entry
5.4
Indirect / Cross-Source Prompt Injection (XPIA)
5.5
Tool Result Poisoning at Runtime
5.6
Agent Memory and Context Poisoning
5.7
Insecure Memory and Telemetry Storage
5.8
Sensitive Data Exfiltration via Agent Output or Tool Calls
5.9
Goal Hijacking / Intent Manipulation
6. Operate: Safe Execution Environment (Sandbox)
6.1
Sandbox Not Enabled or Inadequate Isolation
6.10
Autonomous Policy / Compliance Violation
6.11
Endpoint Agent Sandbox Bypass
6.12
Browser Agent Cross-Origin / DOM Trust Failure
6.13
Human Approval Fatigue / HITL Overload
6.14
Irreversible Agent Actions Without Rollback Path
6.2
Unrestricted API/Tool Invocation
6.3
Dynamic / On-the-Fly Dependency Injection
6.4
Task Decomposition for Policy Evasion
6.5
Indirect Prompt / Instruction Injection
6.6
Autonomous Resource Provisioning / Abuse
6.7
Cross-Agent / Inter-Agent Abuse
6.8
Agentic System Self-Modification
6.9
Covert Channel Use / Evasion
7. Monitor: AI Activity Tracing
7.1
Insufficient AI and Agent Interaction Logging
7.2
Missing Real-time Security Alerts
7.3
Undetected Agent Drift
7.4
Data Exfiltration via Monitoring / Telemetry
7.5
Absence of AI- and Agent-Specific Incident Response Plan
7.6
Missing Agent-Specific Anomaly Detection
7.7
Untracked Agent Decommissioning

SAIL 2.0

/

Build - AI Security Posture Management

/

Insufficient Understanding of Agent Reachable Graph

3.11

.

Insufficient Understanding of Agent Reachable Graph

sail
3.11
Download
Risk

Insufficient Understanding of Agent Reachable Graph

Description

Failure to clearly map an agent's complete reachable graph — all tools it can invoke, data stores it can query, downstream agents it can call, and external systems it can affect.

Example

An agent built for invoice processing is found to have transitive access via a shared MCP server to the HR database that nobody mapped at build time.

Assets Affected

AI Agent

AI App

Model Inference Endpoint

Tool

MCP Server

3rd-Party AI Integration

Agent Communication Protocol (ACP)

Mitigation
  • Map each agent's reachable graph during build
  • document tools, scopes, MCP servers, and downstream agents
  • review the graph for over-reach
  • restrict transitive access through MCP gateways.
Standards Mapping
  • ISO: A.6.2.3, A.4.2
  • OWASP agentic: ASI02, ASI03
  • OWASP LLM: LLM06:2025
  • EU AI Act: Art. 11, Art. 9
  • DASF: Agents-Core 13.2, Agents-MCP Server 13.22
  • AIUC-1: E004, B006