# H/M Agent Risk Atlas

H/M Agent Risk Atlas is a free browser-local capability composition model for AI-agent systems.

- Human tool: https://hogarmas.net/agent-risk-atlas/
- Path dataset: https://hogarmas.net/agent-risk-atlas/paths.json
- Export schema: https://hogarmas.net/agent-risk-atlas/schema.json
- Packet schema: `hm.agent-risk-atlas.v1`
- Ruleset: `2026-07-21.1`
- Price: USD 0
- Languages: English, Spanish, Chinese by browser preference

## What it does

1. The user selects actual agent capabilities or imports an `hm.agent-scope.v1` report.
2. The user declares controls enforced outside model reasoning.
3. The deterministic engine activates a path only when every required capability is present.
4. Each active path shows uncovered, partial or declared-covered control status.
5. A minimum control plan ranks missing controls by active-path severity and reuse.
6. The user can download a content-minimized JSON or Markdown review packet.

## Composition model

The current ruleset models 12 capabilities, 13 external controls and 10 attack paths. Paths include:

- untrusted content plus private data plus external communication
- code execution plus network egress
- local server plus code execution
- autonomous loops plus destructive or financial authority
- untrusted content plus persistent memory
- delegated identity plus third-party authorization or data egress
- shared sessions plus external communication

The path dataset is public and versioned. It does not contain user profiles, tool catalogs or observed activity.

## Agent Scope import

The browser can read an H/M Agent Scope JSON export. It maps only capability booleans into the Atlas profile.

- The source file is not uploaded.
- Tool names are not copied into Atlas state or exports.
- Descriptions, schemas and findings are not copied.
- The exported Atlas packet records only a SHA-256 digest and capability identifiers.
- Capabilities not represented by Agent Scope, including autonomy, memory, sessions and OAuth topology, must be selected manually.

## Control status

`declared-covered` means every recommended control for that path was selected by the user. It does not mean:

- the control exists in production
- the control is correctly configured
- authorization or isolation was tested
- the runtime resisted an attack
- the system is safe or certified

Observed path severity is not reduced by self-reported controls.

## Privacy and network behavior

- Source profiles are analyzed in the browser.
- No model is called.
- No tool is executed.
- No Agent Scope report is uploaded.
- No profile is stored in localStorage, sessionStorage or IndexedDB.
- Optional aggregate metrics contain only a fixed page path, a fixed action identifier, language and dwell time.
- Metrics never contain capabilities, controls, paths, tool names, source hashes or report contents.

Fixed action identifiers:

- `agent-risk-atlas-analyze`
- `agent-risk-atlas-preset`
- `agent-risk-atlas-import`
- `agent-risk-atlas-copy-plan`
- `agent-risk-atlas-export-json`
- `agent-risk-atlas-export-markdown`

## Primary references

- MCP Security Best Practices: https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices
- MCP tool composition and annotation limits: https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/
- OWASP Top 10 for Agentic Applications 2026: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
- NIST AI 800-5: https://www.nist.gov/publications/summary-analysis-responses-request-information-regarding-security-considerations-ai
- NIST agent identity and authorization concept: https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents
- NIST agent hijacking evaluations: https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations

## Limitations

The Atlas is a bounded architecture-review model, not a complete threat model, runtime monitor, authorization engine, penetration test or security certification. New attacks and deployment-specific paths may not be represented. Controls must be verified independently and enforced outside model reasoning.