{
  "schema": "hm.agent-risk-atlas.path-dataset.v1",
  "ruleset": "2026-07-21.1",
  "updated": "2026-07-21",
  "license": "CC-BY-4.0",
  "canonical": "https://hogarmas.net/agent-risk-atlas/paths.json",
  "method": "A path activates only when every required capability identifier is selected. Declared controls affect coverage status but never lower the observed severity or certify safety.",
  "privacy": {
    "userProfilesIncluded": false,
    "toolCatalogsIncluded": false,
    "toolNamesIncluded": false,
    "syntheticActivityPresentedAsReal": false
  },
  "references": {
    "mcp-security": "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices",
    "mcp-annotations": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
    "owasp-agentic": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
    "nist-800-5": "https://www.nist.gov/publications/summary-analysis-responses-request-information-regarding-security-considerations-ai",
    "nist-identity": "https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents",
    "nist-hijacking": "https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations"
  },
  "capabilities": [
    { "id": "untrusted-content", "domain": "input" },
    { "id": "private-data", "domain": "data" },
    { "id": "external-communication", "domain": "egress" },
    { "id": "code-execution", "domain": "execution" },
    { "id": "persistent-memory", "domain": "state" },
    { "id": "identity-delegation", "domain": "identity" },
    { "id": "destructive-write", "domain": "impact" },
    { "id": "financial-action", "domain": "impact" },
    { "id": "autonomous-loop", "domain": "autonomy" },
    { "id": "third-party-oauth", "domain": "identity" },
    { "id": "shared-session", "domain": "transport" },
    { "id": "local-server", "domain": "execution" }
  ],
  "controls": [
    { "id": "untrusted-data-taint", "layer": "runtime" },
    { "id": "egress-allowlist", "layer": "network" },
    { "id": "task-data-boundary", "layer": "data" },
    { "id": "execution-sandbox", "layer": "runtime" },
    { "id": "immediate-confirmation", "layer": "human" },
    { "id": "rollback-idempotency", "layer": "runtime" },
    { "id": "action-budget", "layer": "runtime" },
    { "id": "scoped-tokens", "layer": "identity" },
    { "id": "transaction-ceiling", "layer": "finance" },
    { "id": "memory-provenance", "layer": "storage" },
    { "id": "per-client-consent", "layer": "identity" },
    { "id": "session-binding", "layer": "transport" },
    { "id": "immutable-audit", "layer": "audit" }
  ],
  "paths": [
    { "id": "lethal-trifecta", "category": "data-exfiltration", "severity": "critical", "requiredCapabilities": ["untrusted-content", "private-data", "external-communication"], "recommendedControls": ["untrusted-data-taint", "egress-allowlist", "task-data-boundary"], "references": ["mcp-annotations", "nist-800-5"] },
    { "id": "code-egress-bridge", "category": "execution", "severity": "critical", "requiredCapabilities": ["code-execution", "external-communication"], "recommendedControls": ["execution-sandbox", "egress-allowlist", "task-data-boundary"], "references": ["mcp-security"] },
    { "id": "local-server-compromise", "category": "supply-chain", "severity": "critical", "requiredCapabilities": ["local-server", "code-execution"], "recommendedControls": ["execution-sandbox", "task-data-boundary", "immediate-confirmation"], "references": ["mcp-security"] },
    { "id": "autonomous-destruction", "category": "excessive-agency", "severity": "critical", "requiredCapabilities": ["autonomous-loop", "destructive-write"], "recommendedControls": ["immediate-confirmation", "rollback-idempotency", "action-budget"], "references": ["owasp-agentic", "nist-800-5"] },
    { "id": "autonomous-finance", "category": "excessive-agency", "severity": "critical", "requiredCapabilities": ["autonomous-loop", "financial-action"], "recommendedControls": ["immediate-confirmation", "transaction-ceiling", "scoped-tokens", "action-budget"], "references": ["owasp-agentic"] },
    { "id": "memory-poisoning", "category": "memory-integrity", "severity": "high", "requiredCapabilities": ["untrusted-content", "persistent-memory"], "recommendedControls": ["untrusted-data-taint", "memory-provenance", "immutable-audit"], "references": ["owasp-agentic", "nist-800-5"] },
    { "id": "confused-deputy", "category": "identity", "severity": "high", "requiredCapabilities": ["third-party-oauth", "identity-delegation", "external-communication"], "recommendedControls": ["per-client-consent", "scoped-tokens", "immutable-audit"], "references": ["mcp-security"] },
    { "id": "session-hijack", "category": "transport", "severity": "high", "requiredCapabilities": ["shared-session", "external-communication"], "recommendedControls": ["session-binding", "scoped-tokens", "immutable-audit"], "references": ["mcp-security"] },
    { "id": "privilege-egress", "category": "identity", "severity": "high", "requiredCapabilities": ["identity-delegation", "private-data", "external-communication"], "recommendedControls": ["scoped-tokens", "egress-allowlist", "task-data-boundary", "immutable-audit"], "references": ["nist-identity", "mcp-security"] },
    { "id": "injected-action-loop", "category": "agent-hijacking", "severity": "critical", "requiredCapabilities": ["untrusted-content", "autonomous-loop", "destructive-write"], "recommendedControls": ["untrusted-data-taint", "immediate-confirmation", "action-budget", "rollback-idempotency"], "references": ["nist-hijacking", "owasp-agentic"] }
  ],
  "limitations": {
    "completeThreatModel": false,
    "runtimeVerification": false,
    "controlVerification": false,
    "securityCertification": false
  }
}