The Agentic Stack Map

ACM-01Scoped tool catalogue

Every tool the agent can call is listed, with its scope, whether it writes, and what an attacker gains by calling it. A tool nobody documented is a permission nobody reviewed.

Test: Produce the catalogue. Every entry has a written scope and a named owner, and nothing the agent can call is missing from it.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-02Per-tool credentials at minimum scope

Each tool holds its own credential, issued at the narrowest scope the upstream system supports. A read-only tool backed by an admin token is one bug away from being a write tool.

Test: For each tool, show the credential and its server-side scope. No two tools share a credential whose reach exceeds either one.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-03Parameter allowlists

The targets a tool may address — paths, repositories, tables, accounts, recipients — are constrained server-side, so a hijacked agent cannot repoint a legitimate tool at an illegitimate target.

Test: Call each write-capable tool with an out-of-scope target. The call is refused by the tool's own boundary, not by the model declining.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-04Default-deny egress

Outbound traffic reaches only named destinations; everything else is refused. Every exfiltration path ends in an outbound request, so this is the control that still works after the model has been convinced.

Test: From inside the agent's environment, request a host that is not on the list. It fails at the network or proxy layer and the refusal is logged.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-05Denied egress is an alert, not an error

Refused outbound requests are logged as security signal and reach a human. A denial is one of the few unambiguous attack signals an agent stack produces, and it is worthless if it lands in the same bucket as a timeout.

Test: Trigger a denial. It appears as a distinct, alertable event with the destination and the calling agent, not as a generic network error.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-16Transport and origin validation on exposed endpoints

An agent endpoint reachable from outside validates its transport before doing work: origin checked against an allowlist, browser-initiated cross-site calls rejected, and every caller rate limited with a real 429.

Test: Call the endpoint with a foreign Origin and with no Origin. The first is rejected before any handler runs; the second is served and counted against its caller's limit.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-06Ephemeral, credential-free execution

Anything the agent generates or invokes runs in an environment created per task and destroyed after, holding no ambient credentials. Persistence is how a one-off compromise becomes a foothold.

Test: Inside a live task, enumerate the environment. No credential is present that the task did not need, and the environment does not survive the task.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-07Resource caps and timeouts

CPU, memory, disk, wall-clock and call count are bounded by the host. Runaway consumption is the failure mode that arrives first and most often, usually with no adversary involved at all.

Test: Run a task designed not to terminate. It is stopped by a quota, the stop is recorded, and the cost of the attempt is bounded and known.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-17Reversibility and a stop control

Every action the agent can take is either reversible or gated, and a person can stop the agent mid-run without stopping the whole system. Autonomy without an off switch is not autonomy, it is exposure.

Test: Stop a running agent. It halts within the stated time, leaves no half-applied change, and the stop is recorded with who issued it.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-08Approval gate on high-impact actions

Actions that are irreversible, regulated or expensive stop for a person who can approve, edit or reject, with enough context to decide. Gate by risk, not by default — over-gating produces rubber-stamping, which is worse than no gate because it looks like one.

Test: List the gated actions and the risk criterion that put them there. Attempt one; it suspends, routes, and records the decision with the identity of who made it.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-09Escalation path with a named owner

When the agent is uncertain, blocked or out of policy, there is a defined path to a person, and that person is named. An escalation route with no owner is a queue.

Test: Force an escalation. It reaches a named human within the stated time, and the handoff carries the context needed to act without re-deriving it.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-10Correlated trace of every decision and tool call

Each run produces an immutable, correlated record: inputs, model and version, tool calls with arguments and outcomes, and the final action. Enough to reconstruct what happened, and nothing that turns the log itself into the breach.

Test: Pick a past run at random and reconstruct it end to end from the log alone. Then confirm the log holds no secret or raw personal data it did not need.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-11Evaluation suite gating change

A curated set of cases runs on every change, and a regression blocks release. Without it, 'it seems to work' is the entire quality argument, and nothing distinguishes a fix from a change.

Test: Introduce a known regression. The suite catches it and the change does not ship. A suite never seen failing is a suite never verified.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-12Untrusted content is isolated and marked

Retrieved documents, tool results and third-party output are delimited as data, never merged into the instruction channel. The model cannot reliably tell them apart, so the harness must.

Test: Plant an instruction inside a document the agent retrieves. The agent may read it; it must not act on it, and the attempt must be visible afterwards.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-13Model output treated as untrusted input

Anything the model emits that reaches a renderer, a shell, a query or another system is encoded and validated exactly as input from a stranger would be.

Test: Make the model emit a payload for each downstream sink you have. Each is neutralised at the boundary before it arrives.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-14Memory integrity and expiry

What the agent writes to persistent memory is attributed, reviewable and expirable. Memory is what turns a one-shot attack into one that re-triggers on future, unrelated tasks.

Test: Write a false fact through a normal interaction. Show where it came from, who can remove it, and when it would expire on its own.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-15Provenance for models, prompts and servers

Models, system prompts, MCP servers, packages and datasets are pinned, reviewed on change, and traceable to a source. A dependency that can rewrite a tool description can rewrite the agent's behaviour.

Test: For each external dependency, name the pinned version and who reviewed the last change. Change a tool description upstream; the change is detected before it reaches production.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas

ACM-18A threat model that is maintained and tested

The attack surfaces are written down with a control and an owner each, accepted risks are named as accepted, and the document is revisited whenever a tool, a data source or an autonomy level changes.

Test: Show the current threat model and the date of the last change to the tool catalogue. If the catalogue is newer than the model, the model is out of date and this control fails.

eu-ai-actiso-42001nist-ai-rmfowasp-llm-top10mitre-atlas