Security Compliance

OWASP Agentic Top 10 — Evidence Matrix

An honest, evidence-backed mapping of Enkstein against the OWASP Top 10 for LLM/Agentic AI Applications (2025). Each entry shows what is actually shipped, what is in progress, and where gaps remain.

Vendor Self-Assessment. Claims in this document have been matched against source code in this repository but have not been independently audited. An independent third-party security assessment is strongly recommended before relying on this document for compliance or procurement purposes. Last reviewed: 2026-08-07 against release 0.8.4; every cited test was re-run and passed.
ID Category Status Test Coverage
LLM01 Prompt Injection Shipped test_asi01_prompt_injection_flagged_by_audit
LLM02 Insecure Output Handling Shipped test_model_router_hardening.py::test_model_router_output_rescan_redacts_sensitive_response, test_cortex_workspace.py::test_provider_download_with_secrets_is_blocked_not_written
LLM03 Training Data Poisoning N/A N/A — uses provider APIs, no training pipeline
LLM04 Model Denial of Service Shipped test_model_router_hardening.py::test_model_route_rate_limit_blocks_after_threshold, test_cortex_workspace.py::test_ai_turn_endpoint_is_rate_limited
LLM05 Supply-Chain Vulnerabilities In Progress test_asi04_supply_chain_scan_returns_result, test_provenance.py
LLM06 Sensitive Information Disclosure Shipped No isolated unit test (gap documented)
LLM07 Insecure Plugin Design Partially Shipped test_ring_policy.py, test_asi05_ring0_always_blocked
LLM08 Excessive Agency Shipped test_ring1_requires_two_approvals, test_asi09_self_approval_is_blocked
LLM09 Overreliance Shipped test_model_router_hardening.py::test_classification_downgrade_requires_justification, ::test_justified_downgrade_is_recorded_in_the_audit_trail
LLM10 Model Theft N/A / Partial N/A — API-only, no model weights stored
LLM01
Prompt Injection
Manipulating LLM inputs to override instructions, exfiltrate data, or cause unintended behavior. Especially dangerous in agentic systems with tool access.
Shipped Show evidence ↓
Evidence
  • backend/app/claws/arcclaw/routes.py (lines 63–91): Every AI event runs a dual-layer inspection — AGT PromptDefenseEvaluator (12-vector injection audit) plus scan_text() pattern detection. Events flagged by either layer are blocked or tagged before any tool execution.
  • backend/app/trust_fabric/agt_bridge.py: audit_prompt() called on every POST /api/v1/arcclaw/events and POST /api/v1/arcclaw/chat.
  • Audit log entries record the risk score, AGT vectors fired, and the outcome for every AI event — providing a forensic trail for injection attempts.
Known Limitations
  • The 12-vector audit may not catch all novel jailbreak techniques — coverage expands with AGT SDK updates.
  • Indirect injection (data poisoning via external sources read by an agent) relies on pattern matching only; semantic detection would require LLM-as-judge tooling.
  • No automated red-team test suite is included in the repository.
LLM02
Insecure Output Handling
Failure to validate or sanitize LLM outputs before they are passed to downstream systems or rendered, leading to XSS, code execution, or SSRF.
Shipped Show evidence ↓
Evidence
  • backend/app/claws/arcclaw/scanner.py: scan_text() redacts secrets, API keys, and PII patterns. Applied to prompts entering the system.
  • backend/app/core/modelclaw/brain_bridge.py: scanning is now symmetric. The prompt is scanned on the way in and the model response is re-scanned on the way out, with the redacted body substituted whenever the completion is sensitive. Verified by test_model_router_hardening.py::test_model_router_output_rescan_redacts_sensitive_response.
  • backend/app/core/marcellus/workspace.py: provider-generated downloads are unpacked and DLP-scanned before they can become a governed file change; a file carrying a live credential is dropped rather than written. Verified by test_cortex_workspace.py::test_provider_download_with_secrets_is_blocked_not_written.
  • API responses are serialized through Pydantic schemas — raw LLM output is not reflected directly to clients without structural validation.
  • DLP scanner in backend/app/services/finding_pipeline.py flags sensitive patterns in event payloads.
Known Limitations
  • No HTML sanitization layer exists for outputs rendered in the frontend dashboard.
  • Output re-scanning is pattern-based secret/PII redaction. It is not a semantic malicious-content classifier, so novel or obfuscated payloads may pass.
LLM03
Training Data Poisoning
Manipulation of training data to introduce backdoors, biases, or vulnerabilities into model behavior.
N/A Show details ↓
Rationale
  • Enkstein does not train, fine-tune, or host model weights. All LLM capability is consumed via provider APIs (Anthropic, OpenAI, Azure OpenAI, Ollama).
  • backend/app/claws/arcclaw/llm_proxy.py: call_llm() delegates to configured providers via API calls. No training pipeline, dataset, or weight files exist in this repository.
Known Limitations
  • Supply-chain risk from model providers remains — if a hosted model is poisoned by a provider, Enkstein has no detection mechanism. Covered partially under LLM05.
  • No model output consistency checks or behavior baseline comparisons are implemented.
LLM04
Model Denial of Service
Attacks that consume excessive compute, memory, or API quota via crafted inputs — very long prompts, recursive queries, or resource-intensive completions.
Shipped Show evidence ↓
Evidence
  • backend/app/api/routes/auth.py: 10 req/min per-IP rate limiter on /auth/token — brute-force protection.
  • backend/app/core/marcellus/ai_rate_limit.py: the governed AI surface is rate limited per authenticated identity rather than per IP, since every desktop request shares the loopback address. Applied to conversation turns, the streaming variant, and project research through workspace_routes.py and cowork_routes.py; exceeding the budget returns 429 with Retry-After. Tunable via AI_RATE_LIMIT_WINDOW_SECONDS / AI_RATE_LIMIT_MAX_REQUESTS. Verified by test_cortex_workspace.py::test_ai_turn_endpoint_is_rate_limited.
  • backend/app/core/modelclaw/: model routing enforces its own request threshold, verified by test_model_router_hardening.py::test_model_route_rate_limit_blocks_after_threshold.
  • backend/app/services/sre_policy.py: SREPolicyEngine circuit breaker + error budget for governed modules. Tested via test_asi08_circuit_breaker_trips_after_error_budget_exceeded.
  • The platform tracks per-request risk scores which could be used to gate expensive operations.
Known Limitations
  • Prompt length is not capped before being forwarded to the model provider.
  • No token budget or cost-cap enforcement at the API layer.
  • SRE circuit breaker exists for governed modules but is not yet wired to LLM provider 429/503 backpressure.
  • Rate-limit counters are per-process in-memory windows; a multi-worker deployment needs a shared store to enforce one global budget.
LLM05
Supply-Chain Vulnerabilities
Vulnerabilities introduced via third-party model providers, plugins, datasets, fine-tuning services, or compromised Python packages.
In Progress Show evidence ↓
Evidence
  • backend/app/services/secrets_manager.py: Connector credentials Fernet-encrypted at rest. Keys auto-generated per deployment, gitignored.
  • backend/requirements.txt: PyJWT pinned to 2.9.0 (patched). python-multipart pinned to 0.0.12 (patched for CVE-2024-53498).
  • backend/app/services/connector_tester.py: SSRF protection — URLs validated against private IP blocklist before connector test requests.
  • Connector installs require administrator approval via the Zero Trust Baseline policy pack ("ZT — Block Connector Install Without Approval").
  • frontend/Dockerfile and docker-compose.yml: frontend container runs a reproducible production Next.js build, avoids runtime source mounts that shadow build artifacts, and uses Docker-internal API proxying.
Known Limitations
  • SBOM and dependency audit CI surfaces exist, but current dependency advisories still require triage and remediation before production reliance.
  • Connector code is not sandboxed at the OS level — a malicious connector could access process memory or make unexpected system calls.
  • Provider API keys are encrypted at rest but transmitted to third-party endpoints — provider compromise is out of Enkstein's direct threat model.
LLM06
Sensitive Information Disclosure
LLMs inadvertently revealing PII, credentials, financial data, or system internals through memorization, prompt echoing, or insufficient output filtering.
Shipped Show evidence ↓
Evidence
  • backend/app/services/secrets_manager.py: All connector credentials stored Fernet-encrypted at rest. Encryption key auto-generated per deployment in backend/.secrets/ (gitignored). Never stored in plaintext.
  • backend/app/claws/arcclaw/scanner.py: scan_text() pattern-matches API keys, tokens, AWS credentials, credit card numbers, SSNs, and email addresses on every submitted prompt.
  • backend/app/api/routes/exec_channels.py: Credential injection endpoint never returns secret values — secrets are injected into agent runtime only. Response explicitly notes: "Secret value is never returned via API."
  • backend/app/api/routes/connectors.py: Credential hints are masked in responses (partial masking, last characters only).
  • Audit log records actor, action, and outcome but parameters are structured — sensitive values are not interpolated into log strings.
Known Limitations
  • Output scanning redacts secret/PII patterns in completions (see LLM02) but is not a semantic classifier, so novel or obfuscated disclosure may pass.
  • No data classification framework (PII/PHI/PCI field tagging) is integrated into the data model.
  • detail_json in audit log could contain sensitive context if callers are not careful.
LLM07
Insecure Plugin Design
Plugin/tool interfaces that are overly permissive, lack input validation, allow SSRF, or permit privilege escalation through tool parameters.
Partially Shipped Show evidence ↓
Evidence
  • backend/app/services/ring_policy.py: Ring-based execution isolation classifies every action_type and exec channel into ring0..ring3, enforcing privilege tiers. ring0 is unconditionally blocked for all agents and roles.
  • backend/app/api/routes/exec_channels.py: Ring policy check applied before executing approved requests. Hard-blocked (ring0) and role-escalation (viewer → ring1) requests refused with HTTP 403.
  • backend/app/services/connector_tester.py: SSRF protection — connector test URLs validated against private/reserved IP blocklist before requests.
  • Connector field validation (URL format, required fields) enforced in connector creation routes.
  • backend/app/claws/arcclaw/security_agent.py: TOOLS list explicitly bounds which tools the security agent can invoke.
Test Coverage
  • backend/tests/test_ring_policy.py — 32 tests covering ring classification, enforcement, role escalation blocking, and channel mapping.
Known Limitations
  • Tool parameters passed to agents are not schema-validated against a strict allowlist — callers can supply arbitrary JSON within the parameters field.
  • No OS-level sandbox (seccomp, container isolation) prevents plugins from making unexpected system calls.
  • Plugin authentication is via the platform JWT — there is no per-plugin scoped token or capability token.
  • The ring policy covers exec channels and remediation approvals but not all tool invocation paths in the AI Security agent.
LLM08
Excessive Agency
LLM agents given more capabilities or permissions than needed — leading to unauthorized actions, data destruction, or unintended side effects.
Shipped Show evidence ↓
Evidence
  • backend/app/services/ring_policy.py: Four-ring privilege isolation for actions evaluated by the service: ring0 (blocked) → ring1 (2 approvals) → ring2 (1 approval or trust ≥ 80) → ring3 (auto-allowed). Ring evaluation rejects an execution that does not satisfy its assigned tier.
  • backend/app/api/routes/exec_channels.py execute_request: Ring policy evaluated before execution. Violations return HTTP 403 with policy_name and deny_reason.
  • backend/app/api/routes/remediation.py approve_action: Ring policy check before calling approve_remediation. Blocks role-escalation by low-privilege callers.
  • backend/app/api/routes/exec_channels.py approve_request: Self-approval blocked (approver == r.requested_by → HTTP 403). Dual approvals required for shell/browser/credential channels.
  • backend/app/models/exec_channels.py: ProductionGate model enforces dual approval for all production changes — tracked in database with approver identities.
  • backend/app/services/exec_policy.py: evaluate_exec_request() blocks commands matching destructive or credential-access patterns before any approval is requested.
  • AGT/Swarm governance policy pack enforces swarm parallelism limits and requires explicit human approval for containment actions (isolate, block, suspend).
Test Coverage
  • backend/tests/test_ring_policy.py — 32 tests. Covers ring classification, auto-allow/deny logic, approval gate counts, role escalation blocking, and channel mapping.
Known Limitations
  • The AI Security agent tool list is bounded but not dynamically cross-checked against the ring policy at each tool invocation.
  • Workflow runner can chain multiple actions — inter-step privilege accumulation is not yet tracked across a session.
  • No per-session capability token — an agent that gains approval for one action could theoretically reference that context for adjacent actions in the same session.
LLM09
Overreliance
Users or automated systems trusting LLM outputs without verification — leading to incorrect decisions, missed alerts, or automated actions based on hallucinated information.
Shipped Show evidence ↓
Evidence
  • backend/app/claws/arcclaw/routes.py: Every AI event stored with a risk_score and outcome computed by the AGT audit and scanner. Users can review scores in the dashboard before acting.
  • Overriding the system's own classification is not silent. Downgrading a detected sensitivity level requires an explicit written justification, and the detected level, the asserted level, and the stated reason all survive into the audit entry. Verified by test_model_router_hardening.py::test_classification_downgrade_requires_justification and ::test_justified_downgrade_is_recorded_in_the_audit_trail.
  • AI events are not auto-executed — they surface as findings requiring human review or policy-matched response with approval.
  • Remediation playbooks have requires_approval flag — high-risk playbooks require human sign-off before execution.
  • Findings include severity and confidence fields to help operators contextualize AI-generated detections.
Known Limitations
  • Risk scores are displayed but no mechanism prevents operators from always approving high-risk AI recommendations without actual review.
  • No counter-factual explanation or uncertainty quantification is presented alongside AI findings.
  • Classification overrides are audited, but passively ignoring an AI-generated alert is still not recorded as an explicit dismissal event.
  • No calibration data or false-positive rate reporting is implemented to help operators judge AI reliability over time.
LLM10
Model Theft
Extracting model weights, system prompts, or training data through API abuse, timing attacks, or adversarial probing.
N/A / Partial Show details ↓
Evidence
  • Enkstein does not host model weights — inference is via provider APIs. Theft of model weights from the Enkstein platform is not applicable.
  • backend/app/services/secrets_manager.py: Provider API keys encrypted at rest with Fernet. Keys are never logged or returned via API response.
  • AuditLog entries record API key usage events without embedding the key value.
Known Limitations
  • System prompts used by AI Security's security agent (backend/app/claws/arcclaw/security_agent.py) are stored in source code — if source is leaked, prompt IP is exposed.
  • No mechanism to detect adversarial probing attempts (repeated queries designed to reconstruct the system prompt).
  • Provider-side model theft is entirely dependent on the provider's own security posture.