1. Plan: AI Policy & Safe Experimentation
1.1
Inadequate AI and Agentic Policy
1.10
No Vetting Path for Tools and External Context Sources
1.11
Missing Autonomy-Level Classification
1.12
No Action-Authorization Policy Defined
1.13
No Agentic Identity Policy Defined
1.2
Governance Misalignment
1.3
Undefined Risk Tolerance & Categorization
1.4
Unmonitored AI and Agent Experimentation
1.5
Insecure Experiment Logging & Monitoring
1.6
Overly Permissive Permissions in Experimentation
1.7
Experiment Output Data Leakage
1.8
Unauthorised / Prohibited Component Usage
1.9
Incomplete Threat Modeling for AI and Agentic Systems
2. Code/No Code: AI Asset Discovery
2.1
Incomplete Asset Inventory
2.2
Unidentified Third-Party AI and Agentic Integrations
2.3
Undocumented Data and Agent Communication Flows
2.4
Lack of Clarity on AI System Purpose and Criticality
2.5
Discovery of Outdated or Orphaned AI and Agentic Assets
2.6
Untracked Agent Identities
2.7
Unmapped Inter-Agent Topology
2.8
Unvetted Local / Endpoint Agents
3. Build: AI Security Posture Management
3.1
Vulnerable AI Frameworks, Harnesses, and Agentic Platforms
3.10
Failure to Specify or Enforce Secure Agent Posture
3.11
Insufficient Understanding of Agent Reachable Graph
3.12
Exposed AI and Agent Access Credentials in Discovered Assets
3.13
Over-Scoped Agent Tool Permissions and Connectors
3.14
Inherited Identity Sprawl
3.15
Insecure Agent Memory and Vector Store Configuration
3.16
Missing Per-Action Authorization Policy at Build
3.17
Unvetted MCP Server Definitions
3.18
Posture Drift / Configuration Drift Over Time
3.2
Insecure Agent Instructions Prompt and Configuration Design
3.3
Insecure ML, Data, and Agentic Pipeline Jobs
3.4
Intellectual Property (IP) Theft of Models
3.5
Misclassified or Undocumented Sensitive Data Usage
3.6
Insufficient Human Oversight in Model and Agent Development
3.7
Insecure Temporary Artifacts or Intermediate Data Storage
3.8
Unvetted Use of Open-Source and Third-Party AI and Agentic Components
3.9
Exposed or Hardcoded Credentials in Build Artifacts
4. Test: AI Red Teaming
4.1
Untested Agent
4.10
Untested Reasoning-Chain Manipulation
4.11
Untested Endpoint Agent Behaviors
4.2
Incomplete Red-Team Coverage
4.3
Lack of Risk Assessment Process
4.4
Insecure Storage of Red Teaming Artifacts
4.5
Insufficient Multimodal Security Testing
4.6
Limited Foreign Language Red Teaming
4.7
Limited Scope of Evasion Technique Testing
4.8
Untested Tool Chain and Multi-Agent Workflows
4.9
Untested Memory Persistence Attacks
5. Deploy: Runtime Guardrails
5.1
Insecure Agent Harness and Runtime Configuration
5.10
Malicious or Policy-Violating Action by Agent
5.11
Runaway Agent / Reasoning Loop DoS
5.12
Agent Resource Abuse
5.13
Missing Action-Level Authorization at Runtime
5.14
Excessive IAM Role Assumption by Cloud Agent Runtime
5.15
Agent Sandbox Escape via Runtime DNS or Filesystem
5.16
Cross-Tenant or Cross-Workspace Data Leak via Embedded Copilots
5.17
Maker-Identity Inheritance in Low-Code Agents
5.18
Agent Session Smuggling and A2A Identity Impersonation
5.19
Unsafe Consumption of Agent Output by Downstream Systems
5.2
Unauthorized Agent Config or System Prompt Tampering at Runtime
5.20
Privilege Amplification via Confused-Deputy Agent
5.3
Direct Prompt Injection at Agent Entry
5.4
Indirect / Cross-Source Prompt Injection (XPIA)
5.5
Tool Result Poisoning at Runtime
5.6
Agent Memory and Context Poisoning
5.7
Insecure Memory and Telemetry Storage
5.8
Sensitive Data Exfiltration via Agent Output or Tool Calls
5.9
Goal Hijacking / Intent Manipulation
6. Operate: Safe Execution Environment (Sandbox)
6.1
Sandbox Not Enabled or Inadequate Isolation
6.10
Autonomous Policy / Compliance Violation
6.11
Endpoint Agent Sandbox Bypass
6.12
Browser Agent Cross-Origin / DOM Trust Failure
6.13
Human Approval Fatigue / HITL Overload
6.14
Irreversible Agent Actions Without Rollback Path
6.2
Unrestricted API/Tool Invocation
6.3
Dynamic / On-the-Fly Dependency Injection
6.4
Task Decomposition for Policy Evasion
6.5
Indirect Prompt / Instruction Injection
6.6
Autonomous Resource Provisioning / Abuse
6.7
Cross-Agent / Inter-Agent Abuse
6.8
Agentic System Self-Modification
6.9
Covert Channel Use / Evasion
7. Monitor: AI Activity Tracing
7.1
Insufficient AI and Agent Interaction Logging
7.2
Missing Real-time Security Alerts
7.3
Undetected Agent Drift
7.4
Data Exfiltration via Monitoring / Telemetry
7.5
Absence of AI- and Agent-Specific Incident Response Plan
7.6
Missing Agent-Specific Anomaly Detection
7.7
Untracked Agent Decommissioning

SAIL 2.0

/

Code/ No Code - AI Asset Discovery

/

Undocumented Data and Agent Communication Flows

2.3

.

Undocumented Data and Agent Communication Flows

sail
2.3
Download
Risk

Undocumented Data and Agent Communication Flows

Description

The pathways by which data enters, is processed within, and exits AI systems are not fully mapped, obscuring potential leakage points or non-compliance.

Example

An agent fetches sensitive customer data from a third-party CRM during reasoning, but its data sources, scopes, and downstream uses are not documented anywhere.

Assets Affected

Dataset / RAG

AI App

Pipeline Job

3rd-Party AI Integration

Agent Communication Protocol (ACP)

MCP Server

Agent Memory / Cache

Mitigation
  • Map data and communication flows for all discovered agentic systems
  • implement data lineage and inter-agent topology tracking
  • document data provenance and agent communication patterns.
Standards Mapping
  • ISO: A.7.5, A.4.3
  • OWASP agentic: ASI07
  • EU AI Act: Art. 10, Art. 11
  • DASF: Raw Data 1.6, Governance 4.1
  • AIUC-1: A001, E011