Security
PUBLISHEDAI systems under adversarial conditions, and containing their behaviour.
This domain assumes general information security competence and does not restate it.
D8 describes what AI changes. A person meeting D8 statements at Applied level is assumed to already hold equivalent general security competence at Applied level — classification, access control, credential handling, incident reporting. The framework does not publish that competence because it is well covered elsewhere and is not specific to AI.
This matters for credential builders. A D8 credential that does not verify general security competence as a prerequisite will certify people who can describe indirect prompt injection but cannot handle a credential safely. State the prerequisite in the credential specification.
| Excluded | Where it lives |
|---|---|
| General information, network and infrastructure security | Assumed prerequisite |
| Agentic attack surface in depth: planning, multi-step tool use, agent-to-agent trust | X-AGT |
| Adversarial machine learning research, model extraction, training-data attacks | X-MOD |
| Whether a use is permissible, as distinct from whether it is secure | D7 |
| Systematic evaluation methodology | D6 |
Where this domain abuts another, and how the line is drawn
The governing test: would this statement be true of a software system with no AI in it? If yes, it belongs to the assumed prerequisite, not to D8. This test excludes a large amount of material that competing offerings include, and doing so is deliberate.
D3 covers a person directing a system. D8 covers the same surface when the input is hostile. D3 asks how do I get a good result; D8 asks what happens when the content is adversarial. Cross-reference; never duplicate.
D2 covers judgement about whether a source is fit to use. D8 covers protecting data from disclosure and protecting systems from what a source contains. Where the statement concerns an adversary, it is D8.
D4 covers building the integration. D8 covers the attack surface that integration creates. A statement about how to connect is D4; about what that connection exposes, D8.
D6 detects a security failure as a quality failure. D8 covers the adversary that caused it. D8.L3.04 and D8.L3.08 sit deliberately close to D6.L3.04 and D6.L3.08; the pairing is intended and both should be cited in any assurance credential.
D8 covers systems that execute defined steps. The agentic extension covers systems that determine their own. The line is who decides the sequence. Agent security is D8 plus X-AGT, not a replacement for either.
Every identifier is a permanent address. Indicators are normative; they state what would be observed in a person who meets the statement.
L1 Aware
5 statementsDescribe how content an AI system reads can alter its behaviour.
Identify information that must not be entered into an AI system.
State that AI output may be unsafe for a downstream system or person to act on.
Recognise AI use falling outside sanctioned tools and channels.
Describe why an AI system’s access to other systems is a security concern.
L2 Applied
7 statementsFollow organisational policy on which AI systems may be used, and for what material.
Check AI output for content that should not be passed to a downstream system or person.
Configure an AI system’s access so that it holds only the permissions its task requires.
Apply organisational controls for secrets and credentials in AI workflows.
Recognise and report suspected manipulation of an AI system.
Document the data an AI workflow reads, retains and transmits.
Check the provenance and requested access of a model, tool or connector before use.
L3 Proficient
9 statementsDesign an AI feature so that untrusted content cannot cause privileged action.
Threat model an AI feature, identifying assets, entry points and adversaries.
Design controls that limit what a system can do when its instructions are compromised.
Evaluate the effectiveness of guardrails and output controls under realistic conditions.
Diagnose how sensitive data reached a prompt, context window, log or output.
Evaluate supply chain risk in models, tools, extensions and connectors.
Design least-privilege access for systems acting on behalf of people.
Resolve an incident in which an AI system was the vector, and identify the control that failed.
Advise on unsanctioned AI use, addressing the need that produced it.
L4 Advanced
4 statementsEstablish the security standard AI systems must meet before deployment.
Define the conditions under which a system’s access or autonomy must be reduced or withdrawn.
Govern the introduction of AI models, tools and connectors across an organisation.
Lead response to an incident in which an AI system caused or enabled harm.
Known gaps, open questions and contested points
Published because the record is more useful than the appearance of completeness.
L3 carries nine statements, the largest level in the domain. This is deliberate: security design work sits at Proficient — threat modelling, blast-radius design, least privilege for delegated access. L2 can follow controls; only L3 can design them.
Statements describe defensive competence, not attack technique. Every statement is framed as recognising, designing against or responding to. None describes constructing an attack.
D8.L3.09 and D8.L4.03 are paired deliberately. Unsanctioned use is a governance failure before it is a user failure. Both statements require the response to address provision, not only prohibition.
The assumed-competence note is load-bearing. Without it, D8 either restates general security at length or produces credential holders with a conspicuous gap.