add(control): Agent Threat Rules guideline-mappings for CCC.GenAI catalog#986
Draft
eeee2345 wants to merge 1 commit into
Draft
add(control): Agent Threat Rules guideline-mappings for CCC.GenAI catalog#986eeee2345 wants to merge 1 commit into
eeee2345 wants to merge 1 commit into
Conversation
Adds Agent Threat Rules (ATR) as a Gemara MappingReference in the CCC GenAI catalog metadata, plus EntryMapping blocks under four GenAI controls where ATR's detection coverage is genuinely adjacent to the control's intent: - CCC.GenAI.CN01 (Model Input Filtering) → ATR prompt-injection rules (00001, 00002, 00003, 00440) - CCC.GenAI.CN02 (Model Output Filtering) → ATR context-exfiltration + agent-manipulation rules (00020, 00021, 00132) - CCC.GenAI.CN04 (Sanitisation of Ingested Data)→ ATR indirect-injection + credential-disclosure rules (00002, 00021) - CCC.GenAI.CN06 (Least Privilege for Plugins) → ATR tool-poisoning / privilege-escalation rules (00010, 00040, 00060, 00441) The mapping is one-way and lossy by design: ATR is a detection-rule corpus (runtime / scanner-time pattern-based), not a control framework. Consumers of the CCC controls reading the mapping should understand that an ATR rule offers a detection signal adjacent to a control's intent, not a control equivalent. Each EntryMapping's remarks field clarifies the specific adjacency. This follows the directional guidance in finos#985 from @eddie-knight to use a Gemara mapping document rather than a schema-invasive integration. Implementation mirrors the existing MappingReference / EntryMapping pattern used by CCC for FINOS-AIGF, SAIF, MITRE-ATLAS, etc. Scope is intentionally narrow (4 controls × 14 rule-references) rather than a full sweep of all 8 GenAI controls. After this first batch lands, the same pattern can extend to CN03, CN08, and the threat-level mappings. ATR upstream: https://github.com/Agent-Threat-Rule/agent-threat-rules (MIT, v2.1.2, 338 rules across 10 attack categories).
✅ Deploy Preview for common-cloud-controls canceled.
|
|
|
eeee2345
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per discussion in #985 with @eddie-knight: this adds Agent Threat Rules (ATR) as a Gemara MappingReference for the CCC GenAI catalog, plus EntryMapping blocks under four GenAI controls. Non-invasive, no schema changes, mirrors the existing FINOS-AIGF / SAIF / MITRE-ATLAS mapping pattern.
What this adds
catalogs/ai-ml/gen-ai/metadata.yaml: one newagent-threat-rulesentry inmapping-references(id, title, version pinned to v2.1.2, description, url).catalogs/ai-ml/gen-ai/controls.yaml: ATRguideline-mappingsentries under four controls:Total: 14 control-to-rule references across 4 of the 8 GenAI controls.
What this does NOT do
additionalPropertiesconstraints on existing controls / metadata / capability schemas are not touched.remarksfield naming the specific adjacency. Controls where the relationship is unclear (CN03, CN05, CN07, CN08) are intentionally not mapped in this first batch — easier to add than to retract.threats.yamlyet. The threat-level mapping (TH01 Prompt Injection → ATR prompt-injection category, etc.) is a sibling change that can land separately if the maintainers want it.On the one-way / lossy framing
ATR is a detection-rule corpus (runtime / scanner-time / regex-based pattern matching), not a governance / control framework. The mapping should be read as "this CCC control's intent is operationally validated by these ATR detection rules at the runtime level". It is not "ATR rule X is equivalent to CCC control Y". The metadata
descriptionfield makes this distinction explicit, and eachEntryMappingremarks field reinforces it for the specific control.Pattern alignment
mapping_inline.cuespec used by the CCC delivery-toolkit.catalogs/ai-ml/gen-ai/controls.yaml.strength: 0placeholder used consistently with the existing GenAI catalog entries that have not yet been graded.Validation
metadata.yaml(category-idstyping) andcontrols.yaml(control-families.idrequirement) are NOT introduced by this PR — they exist onmainand my changes neither extend nor newly trigger them. Verified by runningcheck-jsonschemaagainst both upstreammainand my branch.On scope and next steps
Per @eddie-knight's suggestion in #985 of starting with a 5–10 mapping first batch, this PR is intentionally narrow. Happy to:
threats.yaml) as a separate PR once the control-level shape is reviewed.remarksgranularity, or drop / rephrase specific entries if the adjacency reasoning isn't strong enough.Background context
ATR is referenced by the MISP taxonomy and galaxy threat-intel sharing layers (MISP/misp-taxonomies#323 + MISP/misp-galaxy#1207, both merged 2026-05-10 by Alexandre Dulaunoy as the MISP project lead) and is shipped in production by Cisco AI Defense and Microsoft Agent Governance Toolkit. Different distribution paths than CCC, but if a CCC consumer ever chains through to MISP-tagged threat-intel events, the rule-ID namespace is now stable across both. Mentioning since it informs the
descriptiontext in the MappingReference.ATR repo: https://github.com/Agent-Threat-Rule/agent-threat-rules — MIT, v2.1.2 (338 rules at the time of this PR).
Closes / addresses #985.