H

HAIEC

Technical Capability & Control Annex · 2026

Source-backed technical annex

What HAIEC
actually does,
and what it doesn't.

The evidence-basis companion to the executive capability brief. Every capability labeled by readiness. Every claim traceable to a source. Every boundary named before a CISO asks.

Executive capability brief ↗Business value and enterprise POC Technical tables A–F ↗Control and framework crosswalks Scope an enterprise POC ↗Current commercial terms on HAIEC

20 pagesTechnical reference

7 status classesNo conflated counts

Manufacturing S217Verified evaluated case

TM Forum C7/C9/C16Archived control evidence

Architecture02 · Technical proposition

Technical proposition

What HAIEC does. What it does not do. How to read the status labels.

Status legend Demonstrated · persisted evidence Supported pathway Evidence-dependent Preview / held Scenario simulation Cataloged / proposed Not established

What HAIEC does

Establishes consequential actions an AI system can cause.

Compares requested, policy-authorized, effectively granted, code-capable and observed authority.

Evaluates deterministic controls against qualified evidence.

Records human decisions with digest-bound receipts.

Surfaces what remains unknown, unassessed, or held.

What HAIEC does not do

Does not replace IAM, SIEM, AppSec or GRC.

Does not certify compliance — framework mappings are context.

Does not guarantee runtime enforcement — native adapters are per-target.

Does not issue a safety verdict — dispositions are scoped to evidence.

Does not silently promote uploads to detector evidence.

What makes HAIEC different

Deterministic, not LLM-in-the-loop

Assurance engine evaluates fixed rules against qualified evidence. Same input, same result, same digest.

Authority-to-action, not just access

Compares what was approved, granted, code-capable, and observed. The gap is the finding.

Lifecycle, not one stage

Pre-deploy, release, runtime, and audit share the same evidence spine.

Honest about gaps

NOT_ASSESSED never downgraded. Frontier items named. Held features labeled before a CISO asks.

Architecture03 · Operating architecture

Operating architecture

Three pillars, six independent jobs, one evidence spine.

01 · UNDERSTAND

Discover the estate

AI systems, agents, tools, MCP servers, APIs, cloud resources. Ownership, environment, evidence modes.

02 · ASSURE

Evaluate evidence

Five evidence planes. DAI orthogonal comparison. Deterministic dispositions. Per-analyzer participation.

03 · GOVERN & OPERATE

Decide and prove

Human decisions, receipts, runtime monitoring, drift signals, response, verification.

Six independent customer jobs — not sequential stages

🔍

Discover

🛡️

Evaluate

✅

Authorize

👁️

Monitor

🛑

Protect

📋

Verify

Evidence flow

Sources

Repo · IAM · OTLP · SBOM · Attestation

Qualified

Binder · digest · source identity

Engine

Deterministic rules · 5 planes · DAI

Decision

Human approval · scoped

Receipt

Frozen · digest-bound · replayable

Key distinction: the AI assistant and the MCP surface guide and query. The canonical deterministic engines produce evidence-bound decisions. A model response is not a verdict. An uploaded file is not detector evidence until qualified.

Architecture04 · Sources & access

Sources & access

Six source modes. Distinct readiness. Never collapsed.

SourceModeWhat it establishesReadiness

GitHub App

OAuth install

GitHub App remote assurance for authorized repositories. PR scanning, comments and evidence qualification depend on the actual configured workflow and source scope.

Ready

IDE / MCP

Scoped read/write MCP

Inspect systems, evaluations and receipts; separately authorized scoped mutation tools also exist. Human approvals and source consent remain independently gated.

Ready

API

Org-keyed HTTP

Submit typed evidence, SARIF import, scan bundles, IAM exports. Every upload qualified before use.

Ready

Structured source

Binder mapping

JSON, JSONL, CSV, logs to a registered typed profile. Field-mapped; unmapped files stay evidence-only.

Ready

Local / CI bundle

ZIP or tar.gz

Preview distribution. Bundle submitted, then qualified. Full static depth requires source tree to be complete.

Preview

Runtime endpoint test

Authorized probe

Empirical attack simulation against authorized endpoint. Not passive monitoring. Requires operator consent.

Available with authorization

Ingest ≠ qualified ≠ evaluated. HTTP 200 means the request was received. Qualification means it was authenticated, source-bound, and schema-validated against a binder. Evaluation means a detector actually ran against it. A successful upload can stop at the first stage.

Architecture05 · Action paths

Consequential action paths

Agent → capability → tool → target → consequence. With the evidence frontier drawn.

support-triage-v3

refund.create

session.read

stripe-tool

customer-db

stripe-prod

db-prod

undeclared ???

unreg-tool

target ???

━ qualified path

┅ candidate (source-reachable, not confirmed)

┈ unknown (registry gap)

Qualified path

Every step backed by evidence: source, runtime observation, registry, or target readback. Can be claimed in an evaluation.

Candidate + unknown path

Source reaches it, but downstream is not established. Never rendered as proven. Never asserted as absent.

Missing edge ≠ no risk. When a registry entry doesn't exist, HAIEC cannot see what the path affects. The honest state is NOT_ESTABLISHED — a reason to request further evidence, not a silent pass.

Architecture06 · Five planes + DAI

The authority gap

Five independent evidence planes. DAI as a separate comparison — not a sixth plane.

01

Requested

What the AI system asks to do.

02

Policy-authorized

What the business permits.

03

Effectively granted

What credentials actually allow.

04

Code-capable

What code can reach.

05

Observed

What runtime evidence shows.

Comparison, not sequence

The five planes are independent assertions. HAIEC does not require them to be supplied in order, and does not require all five to reach a finding. A single-plane evaluation is valid — it just names fewer established facts.

The mismatch is the finding. Requested but not policy-authorized → business policy gap. Policy-authorized but not effectively granted → provisioning gap. Effectively granted but not code-reachable → dead privilege. Code-reachable but not observed → latent exposure.

DAI — nine orthogonal dimensions

OPERATION

action semantics

TARGET

resource or entity

SCOPE

tenant, domain, boundary

MAGNITUDE

amount or volume

DURATION

time window

APPROVAL

human authority

DATA_CLASS

sensitivity tier

ENVIRONMENT

prod / staging / dev

GEOGRAPHY

jurisdiction or region

Delegation ≠ a sixth plane. DAI compares a delegated chain against the policy that authorized it. The five planes describe authority classes; DAI describes narrowing or widening at a specific delegation hop. Both are required to answer the authority question.

Architecture07 · Assurance Engine

The deterministic engine

Claim → evidence → finding → disposition. Nothing bypasses a step.

1

Claim

A statement the profile asks about

↓

2

Evidence scope

Which sources, analyzers, window

↓

3

Qualification

Binder, digest, source identity

↓

4

Finding

Rule evaluated, result persisted

↓

5

Disposition

Scoped ALLOW / REVIEW / BLOCK

↓

6

Receipt

Frozen, digest-bound, replayable

Disposition is not authorization

An assessment may produce ALLOW / REVIEW / BLOCK only within the evaluated claim and configured decision semantics. It is not permission to deploy. It is not a certification. It is not a runtime enforcement action. Each of those is a separate layer.

Proof frontier — always visible

Every evaluation ships with an explicit NOT_ASSESSED list. Missing evidence is never scored as zero risk. Frontier items name the exact producers, sources, or registry entries that would close them.

What "reproducible" means

·Same input scope → same findings
·Same findings → same digest
·Change one byte of evidence → digest invalidates
·No LLM in the verdict path

AI security08 · AI AppSec package

AI AppSec — separate package

Static analysis for AI application code. A distinct developer package, not automatic SaaS assurance.

Detectors

122

Rule definitions in the AI AppSec security package

Security checks

79

Grouped into observable findings across AI-specific code patterns

What it examines

·Unsafe AI-output execution — model output fed into shells, SQL, templates, or eval
·Prompt and RAG trust boundaries — untrusted content flowing into system prompts
·Exposed secrets — API keys, tokens, credentials in source
·Insecure API usage — permissive CORS, weak auth, missing rate limits
·AI-specific vulnerabilities — tool exposure, memory risks, output handling

Separate package, not an automatic pipeline. The 122/79 AI AppSec package can operate independently of the SaaS assurance surface. It does not automatically feed the core Assurance Engine unless a qualified integration route exists. Its findings appear as AI AppSec output, not as HAIEC-verified control results.

The distinction matters. A source-code finding is a claim about a file. It becomes an assurance finding only when that file is part of a qualified evaluation scope. HAIEC preserves the boundary in both its API and its UI.

AI security09 · MCP & tenant isolation

MCP & tenant isolation — separate package

57 deterministic rules for the boundary between tenants. Static detection ≠ exploit proof.

Multi-tenant rules

42

Data, query, session, cache, and tool isolation checks

MCP-specific rules

15

Model Context Protocol boundary and authorization checks

What it examines

Tenant A

data · query · session · cache · tools

Tenant B

data · query · session · cache · tools

↕ boundary checks per rule class

MCP server

tool exposure · schema · identity · auth

What it establishes

Source-visible weaknesses: a query path that could return cross-tenant data, a cache key that omits tenant id, a tool that a tenant can reach outside its scope.

What it does not establish

That the weakness is exploitable at runtime. That requires observed telemetry or empirical endpoint testing. Static detection is a candidate risk, not a proven exploit.

SARIF in, findings out. Imported SARIF from these rules is preserved with tool identity and scan scope. It appears in coverage as "imported — package at revision," not as "HAIEC-verified." The 57 rules are part of a package boundary, not the core 176-rule detection registry.

AI security10 · OWASP taxonomy

Threat taxonomy mapping

OWASP Agentic Top 10 (2026) and LLM Top 10 (2026). Mappings are not coverage claims.

OWASP Agentic Top 10 · 2026

ID	Threat	Status
ASI01	Agent Goal Hijack	Runtime + static
ASI02	Tool Misuse	MCP · code
ASI03	Identity & Privilege Abuse	IAM · 5-plane
ASI04	Agentic Supply Chain	Repo · SBOM
ASI05	Unexpected Code Execution	Reachability
ASI06	Memory & Context Poisoning	Bounded probes
ASI07	Inter-Agent Comms	DAI · handoff
ASI08	Cascading Failures	Drift signals
ASI09	Human Trust Manipulation	Output checks
ASI10	Overreliance / Rogue	Scope checks

OWASP LLM Top 10 · 2026

ID	Threat	Status
LLM01	Prompt Injection	Authorized probes + source checks
LLM02	Sensitive Information Disclosure	Output checks; evidence-dependent
LLM03	Excessive Agency	Authority planes + DAI
LLM04	Supply Chain	Repository + SBOM evidence
LLM05	Data and Model Poisoning	Not established
LLM06	Unbounded Consumption	Qualified usage and thresholds
LLM07	Misinformation	Application-level review
LLM08	Hidden Context Exposure	Scoped prompt/output checks
LLM09	Vector and Embedding Weaknesses	RAG source and retrieval evidence
LLM10	Improper Output Handling	Static sink analysis

Mapping is not coverage. HAIEC references OWASP as a taxonomy for organizing checks, not as a claim of full coverage or validated mitigation. A "demonstrated" status means an executable producer exists and runs in a qualified evaluation. A "held" status means no producer is wired. Neither is a certification.

AI security11 · Denominators

What the counts actually mean

Six separate denominators. Never added together.

Inventory snapshot, not live tenant coverage. Registered executable rules and control profiles must not be presented as 157 evaluated detections or 45 enforced controls.

Detection rules

176

Registered definitions across 31 families (dated Oct-17 snapshot). 157 executable registrations, 19 register-only.

Control catalog entries

45

Cataloged control objectives. Not 45 completed tests. Includes 3 specialist C7/C9/C16 plus 42 general.

Visibility profiles

11

Controls with a currently implemented visibility projection. Not 11 successful tests.

Launch-priority IDs

15

Prioritized subset for phased rollout. Not 15 certified controls.

Typed intake profiles

26

Registered schema binders. Enables structured ingest, not a capability count.

Audit questions

221

Agent-audit question catalog. Many require human answer; not detection rules.

EXECUTABLE vs REGISTER_ONLY

157 PRODUCER-BACKED REGISTRATIONS — a producer is registered. When the requested scoped batch is supplied, the detector runs.

19 REGISTER_ONLY — a rule definition exists, but no producer is wired for customer data. (CERT 5 · TIME 5 · CICD 5 · plus 4 AI_AGENT.)

What not to infer

Do not add these numbers. 176 rules + 45 controls + 26 profiles + 11 visibility + 15 launch + 221 questions ≠ anything meaningful. Each count describes a different technical category. Adding them produces a number that misleads a CISO.

AI security12 · Control effectiveness

Control effectiveness

A control exists in the catalog ≠ a control was exercised. Ten separate facets, no fake green.

Illustrative control passport: R03, policy version, named reviewer, connection, monitoring and test states below are a hypothetical example, not a verified customer control result.

R03

Runtime guardrail enforcement

Mixed

5 of 10 facets qualified. This is not "50% passed." It is a specific operational state: the policy is approved, but the target is not wired. In this fictional example, the target is not wired, monitoring is stale and control testing is pending; these states are not a real tenant assessment.

The ten facets

1. Cataloged

6. Target wired

2. Applicable

7. Monitoring fresh

3. Configured

8. Alert delivered

4. Policy approved

9. Enforced

5. Deployed

10. Effect verified

No composite "control passed" badge. Each facet is independently qualified. Do not replace these independent facets with a single overall green control badge.

DevSecOps13 · CI/CD integration

DevSecOps integration

Four separate facts about a release. Never collapsed into one gate status.

Code diff

PR opened → source analyzed

GitHub App static analysis on changed files. Full-tree coverage requires full scan.

Static evidence

AI AppSec · secrets · dependencies

Findings at scan scope. Package attribution preserved. Not automatically qualified.

Assurance

Deterministic engine · scoped disposition

ALLOW / REVIEW / BLOCK over the qualified evaluation scope. Not a deployment decision.

Human approval

Named reviewer · digest-bound record

Separation of duties. Approval is not execution. It is a decision about the scope.

CI gate

Independently configured pass/fail

CI gate is a pipeline policy, not the engine disposition. Requires correct integration.

Ready

GitHub App full executor on linked installations. Full static + PR comments + qualified evidence.

Held

GitHub Action v2 pending reconciliation of distributable identity. v1 PAT flow is deprecated.

Preview

Local/CI bundle path. Bounded coverage by bundle contents. Full static requires complete source tree.

CI_RESULT ≠ ASSURANCE_ENGINE_DISPOSITION ≠ HUMAN_APPROVAL ≠ DEPLOYMENT_BLOCK. These are four separate facts. A CI gate passing does not mean the Assurance Engine approved. A disposition of REVIEW does not automatically block a pipeline. Building a release process on the wrong fact will produce the wrong outcome at exactly the wrong time.

DevSecOps14 · Runtime adversarial testing

Runtime adversarial testing

Model claim ≠ tool execution ≠ external effect. Three separate statements per test.

What an authorized endpoint test can establish

Prompt injection

Does the model follow injected instructions when content is treated as data? Bounded finding.

Tool forcing

Can an attacker cause a tool call the agent would not normally make? Bounded by test scope.

Role confusion & leakage

Does the model reveal context, change behavior under role framing, or expose sensitive info? Bounded by prompt set.

1

Probe sent

Authorized endpoint · operator consent · scope pre-declared

↓

2

Model response

What the model returned — a claim, not a fact about the tool

↓

3

Tool call observed

Did a tool get called? Would require qualified telemetry to confirm

↓

4

External effect

Did anything land at the target? Requires independent readback — separate from tool execution

Not every probe is a test. Runtime endpoint testing is opt-in. It requires an authorized endpoint, operator consent, and bounded scope. It is not passive continuous monitoring. A model claiming "I will call tool X" is not evidence that the tool was called. A tool being called is not evidence that its effect landed.

DevSecOps15 · Monitoring & drift

Continuous monitoring

Baseline vs current, with source health visible. An anomaly is not a breach.

What monitoring observes

·Agent tools & permissions — new tool, changed scope, new identity
·Actions outside approved scope — resource, magnitude, target divergence
·Identity & delegation — chain continuity, credential reuse, handoff gaps
·Token / usage / cost — deviations against comparable baseline
·Guardrail & alert — decision + denial + delivery evidence
·Source health — freshness, continuity, coverage gaps

Illustrative baseline vs current — not live HAIEC telemetry

Signal	Baseline	Current
Tool calls / turn	2.1	2.8
Tokens / request	1.2K	1.8K
DATA_CLASS mix	standard	includes_pii
Tool inventory	12	14

Source health is visible next to every signal. Stale evidence cannot establish detection coverage for its own source. Other connected sources may still generate alerts. Silence is never proof of safety.

What monitoring establishes

With qualified monitoring inputs, a signal may be compared against a specific source and baseline. The example above is fictional.

What monitoring does not establish

That a breach occurred. That an alert was acknowledged. That the underlying source is complete or continuous.

DevSecOps16 · Protect & kill switch

Protection & enforcement

Guard code exists. Native adapters are per-target. Dotted arrows are honest.

The six-state intervention lifecycle

🔔

Alert

SHIPPED

👤

Human auth

SHIPPED

📤

Dispatch

INTEGRATION

🛑

Guard ack

PER-TARGET

✓

Effect witness

READBACK

↻

Recovery

OPERATIONAL

What exists in HAIEC source

Execution guard code. Kill-switch foundation. Intended native adapter contract. Human authorization workflow. Alerting framework. The pathway for a response.

What is not universally wired

Native enforcement adapters per target provider. A production-wide automatic enforcement guarantee. Universal kill-switch coverage across every AI system.

Assessment BLOCK ≠ physical stop. A disposition of BLOCK means the evaluation found evidence outside approved scope. It does not mean the target refused the action. It does not mean the pipeline blocked. It does not mean the API call was denied. Those are separate operational facts that require a native adapter to actually occur.

Dotted arrows are honest arrows. Any intervention step that requires target-native integration is drawn dotted. It communicates "the pathway exists" without claiming "the pathway is wired." A CISO can see exactly where the boundary is.

Governance17 · Human decisions

Human governance

Versioned authority. Named humans. Separation of duties. Digest-bound records.

What a decision packet contains

Illustrative human-review record: Names, scopes, timestamps, digests and reviewer outcomes on this page are fictional examples.

Requested operationrefund.create

Scope≤ $1,000 · US · prod

Requesterbob.kumar

Assigned revieweralice.chen

SoD verified✓ PASS

Policy versionEnvelope v12

Policy digestsha256:8f2a…c4b1

Evaluation basiseval-2f4a-9d3b · REVIEW

Conditionsnone

Expiry2026-10-24 09:14 UTC

What the reviewer can do

Approve as scoped

Binds the exact scope and digest. Expires at declared time. Reversible until revoked.

Approve with conditions

Names specific conditions, due dates, and consequences of failure. Weaker than full approval.

Reject with rationale

Requester sees the reason. Rejection is a valid outcome, not a failure.

Request changes

Returns to requester without approving or rejecting. Preserves the request.

Approval ≠ authorization to deploy. It is a named human's decision about a requested scope. Deployment, target enforcement, and effect verification are separate operations with their own evidence requirements.

Governance18 · Framework crosswalks

Compliance & responsible AI

Framework-oriented evidence. Mapping is not certification. Applicability is not implementation.

Framework	HAIEC evidence contribution	Status
OWASP LLM Top 10 (2026)	Taxonomy for organizing AI application security checks. Per-threat mapping to executable rules where they exist.	Mapped
OWASP Agentic Top 10 (2026)	Agent-specific threat taxonomy. Coverage matrix with demonstrated / partial / held labels.	Mapped
ISO/IEC 42001	AI management system evidence: control mapping, decision records, evidence provenance, change history.	Supporting evidence
ISO/IEC 27001	Information security control evidence for the AI-specific layers: authorization, monitoring, incident records.	Supporting evidence
NIST AI RMF	Govern / Map / Measure / Manage evidence artifacts. Measure 2.6 monitoring evidence.	Supporting evidence
NIST CSF	Identify / Protect / Detect / Respond / Recover evidence for AI systems specifically.	Supporting evidence
SOC 2	CC-series evidence where AI systems affect the trust services criteria. Not a SOC 2 attestation.	Mapped — not certified
EU AI Act	Applicability context for high-risk classification, evidence artifacts for documentation obligations.	Context only
GDPR · HIPAA	Privacy-control evidence for AI actions touching personal or health data.	Supporting evidence
NYC Local Law 144	Specialized hiring-regulation workflow evidence where applicable.	Workflow-specific

Never claim certification. HAIEC provides framework-oriented evidence. It does not certify compliance with any framework. A mapping is context. Applicability is separate from implementation. Implementation is separate from evidence. Evidence is separate from a reviewer's attestation. A "Compliance Twin" preview exists but is a versioned state view, not a certification artifact.

Proof19 · Manufacturing S217

Verified evaluated case · SYS-217

Wrong-target divergence on a synthetic manufacturing estate — the assessment is real, the later controls are simulated.

◐ Assessed · persisted evaluated evidence

◇ Simulated · browser-local illustration

1

Approved: WO-217-4802 under envelope scope

2

Dispatched: mes.work_order.update

3

Readback: effect landed on RESOURCE:WO-217-4803

4

Detector: MFG-EFF-001 wrong-target mismatch

5

Result: OBSERVED_OUTSIDE_DELEGATION · REVIEW

This lane is real. Persisted evaluation, digest-verified. 45 canonical evaluations of synthetic evidence in the corpus. All 45 result as REVIEW.

6

Attempt: DEMO-GW-SYS-217-02 dispatched by agent

7

Hold: synthetic demo gateway holds the write

8

Review: fictional Quality approver assigned

9

Advisory: permissible work continues locally

10

Monitor: simulated MES / ERP / equipment state

This lane is illustrative. Browser-local simulation. Fictional approver. Not proof of production MES enforcement. The demo gateway is not a customer integration.

Do not conflate the two lanes. A real evaluated wrong-target event precedes a subsequent simulated hold. The assessment is genuine; the factory-enforcement behavior is illustrative. A CISO who tests this distinction will find the label accurate — and that accuracy is the point.

Proof20 · TM Forum & POC

Archived control evidence & POC

Real control tests in a telecom workshop environment. Participant-published archive — not organizer audit.

C16 · Token and cost control

SATISFIED run

35,559 tokens against 60,000-token cap

Measured control verdict — the run stayed within the frozen cap

NOT_SATISFIED run

106,829 tokens against 60,000-token cap

Measured control verdict — the run exceeded the frozen cap

Measured verdict ≠ enforcement proof. The cap was exceeded. The archive does not prove that an over-cap call was blocked at the target.

C9 · Performance control

Two assessed runs

SATISFIED under frozen v2 thresholds

No sanctioned assessed live breach exists in the archive

C7 · Audit trail

9 of 10 required coverage

One negotiation event missing

Partial result — NOT_EVALUATED for the missing event

Partial is a valid result. This case shows how HAIEC represents incomplete evidence: 9/10 coverage with the gap explicitly named. Not a pass, not a fail. A specific operational state.

Monitoring + Kill switch

Monitoring

OTLP ingestion, detector canary, alert delivery recorded

Clean real-telemetry negative + separately labeled synthetic canary

Kill switch

Organizer environment pause/recovery pathway

External enforcement — HAIEC engine not invoked for this action

Scoped enterprise POC · acceptance criteria (commonly 4–8 weeks after readiness)

Scope: one consequential AI system, one business owner, one technical counterpart, one named risk question.
Access: source repository or archive, operating envelope or intent, IAM grants (live or export), optional 7–14 days OTLP.
Deliverable: scoped disposition + proof frontier + frozen receipt + prioritized remediation list.
Success: at least one confirmed authority gap; evidence coverage score across the five planes; receipt defensible to an external reviewer.
Explicit: no invented ROI, no incident-reduction rate, no "we block all dangerous actions" claim until native adapter binding, guard decision, and effect witness are proved.

Sources · github.com/subodhkc/tmf-2026-evidence · register.yaml · SUBMISSION_PROVENANCE_AND_VERIFICATION.md · release v7a0bb5f3 · participant-published, integrity-verifiable archive

What HAIECactually does,and what it doesn't.

What HAIEC does. What it does not do. How to read the status labels.

What HAIEC does

What HAIEC does not do

What makes HAIEC different

Three pillars, six independent jobs, one evidence spine.

Discover the estate

Evaluate evidence

Decide and prove

Six independent customer jobs — not sequential stages

Six source modes. Distinct readiness. Never collapsed.

Agent → capability → tool → target → consequence. With the evidence frontier drawn.

Five independent evidence planes. DAI as a separate comparison — not a sixth plane.

Comparison, not sequence

DAI — nine orthogonal dimensions

Claim → evidence → finding → disposition. Nothing bypasses a step.

Proof frontier — always visible

What "reproducible" means

Static analysis for AI application code. A distinct developer package, not automatic SaaS assurance.

What it examines

57 deterministic rules for the boundary between tenants. Static detection ≠ exploit proof.

What it examines

OWASP Agentic Top 10 (2026) and LLM Top 10 (2026). Mappings are not coverage claims.

OWASP Agentic Top 10 · 2026

OWASP LLM Top 10 · 2026

Six separate denominators. Never added together.

EXECUTABLE vs REGISTER_ONLY

What not to infer

A control exists in the catalog ≠ a control was exercised. Ten separate facets, no fake green.

The ten facets

Four separate facts about a release. Never collapsed into one gate status.

Model claim ≠ tool execution ≠ external effect. Three separate statements per test.

What an authorized endpoint test can establish

Baseline vs current, with source health visible. An anomaly is not a breach.

What monitoring observes

Illustrative baseline vs current — not live HAIEC telemetry

Guard code exists. Native adapters are per-target. Dotted arrows are honest.

The six-state intervention lifecycle

Versioned authority. Named humans. Separation of duties. Digest-bound records.

What a decision packet contains

What the reviewer can do

Framework-oriented evidence. Mapping is not certification. Applicability is not implementation.

Wrong-target divergence on a synthetic manufacturing estate — the assessment is real, the later controls are simulated.

Real control tests in a telecom workshop environment. Participant-published archive — not organizer audit.

C16 · Token and cost control

C9 · Performance control

C7 · Audit trail

Monitoring + Kill switch

What HAIEC
actually does,
and what it doesn't.