AISECA Tiered Control Framework

A practitioner-led, vendor-agnostic control framework for securing enterprise AI. Each risk is mapped to a NIST AI 600-1 GenAI risk domain and to MITRE ATLAS where a technique applies, then answered with three tiers of control: define it, enforce it, validate it.

Version: 1.0 · Controls: 57 across 12 risk domains · License:CC BY 4.0

v1.0 is a released version of the framework. v1.1 is in progress — practitioner feedback is what shapes it, and disagreement is the point. See Giving feedback.

---

The three tiers

Tier	Name	What it means
1	Define & Constrain	Policy, boundaries, and standards. What is allowed, what is prohibited, who owns it.
2	Enforce & Monitor	Technical enforcement of tier 1. Detection, logging, blocking, escalation.
3	Validate & Adapt	Adversarial testing and continuous evidence that tiers 1 and 2 actually hold.

A tier is not a maturity badge you graduate from. Tier 3 without tier 1 is theatre; tier 1 without tier 2 is a PDF.

How to read a control

Every control is one file under controls/, named by its stable ID. Structured fields live in the YAML frontmatter (domain, severity, NIST AI RMF subcategories, MITRE ATLAS mapping, stakeholder, references); the prose body carries the risk, a real-world scenario, the three tiers, and the tooling landscape.

IDs are stable. Once assigned, a control ID is never reused or renumbered, even if the control is withdrawn.

Machine-readable

dist/framework.json and dist/framework.csv are generated from the Markdown by scripts/build.py. Do not edit them directly — edit the control file and re-run the build. CI enforces this.

python3 scripts/build.py # regenerate
python3 scripts/build.py --check # verify in sync (what CI runs)

Giving feedback

We would rather have an argument than a citation. Three ways in, in order of usefulness:

1. Open an issue — challenge a control, propose a new one, or fix a mapping. The forms ask which control ID and what your operational experience was.
2. Open a pull request — edit the control file directly. One control per PR keeps review tractable. See CONTRIBUTING.md.
3. Start a discussion — org discussions for anything broader than one control: tier boundaries, domain coverage, framework structure.
4. Join the Slack — aiseca.slack.com for working conversation with the board and other practitioners.

If you have implemented one of these controls in production and it did not work as written, that is the single most valuable contribution you can make.

On tooling references

Named tools are open source only — many corporate-originated, none proprietary. Commercial options appear as market categories (SCA, ASPM, AIDR), never as named products. Listing is descriptive, not an endorsement. See CONTRIBUTING.md for the bar.

Risk domains

Domains follow NIST AI 600-1 (Generative AI Profile).

CBRN (Chemical, Biological, Radiological, Nuclear)

ID	Risk	Severity
AISECA-CBRN-001	CBRN knowledge enablement	Medium
AISECA-CBRN-002	Dual-use misuse	Medium

Confabulation (Hallucinations)

ID	Risk	Severity
AISECA-CONF-001	Hallucinated outputs	Medium
AISECA-CONF-002	Incorrect citations or fabricated sources / information	Medium

Dangerous, Violent, or Hateful Content

ID	Risk	Severity
AISECA-DVH-001	Violence facilitation	Medium
AISECA-DVH-002	Extremist or hateful outputs	High

Data Privacy

ID	Risk	Severity
AISECA-PRIV-001	Prompt-based data leakage	High
AISECA-PRIV-002	Sensitive data retention	High
AISECA-PRIV-003	Context Injection via Tools or MCP	High
AISECA-PRIV-004	Re-identification risk	High
AISECA-PRIV-005	Unauthorized training data use	High
AISECA-PRIV-006	Markdown Rendering Exfiltration	Medium

Environmental Impacts (energy usage, carbon footprint, resource consumption)

ID	Risk	Severity
AISECA-ENV-001	Excessive compute consumption	Low
AISECA-ENV-002	Inefficient inference or training	Low

Harmful Bias & Homogenization

ID	Risk	Severity
AISECA-BIAS-001	Discriminatory outputs	Medium
AISECA-BIAS-002	Exclusionary recommendations	Medium
AISECA-BIAS-003	Loss of diversity / homogenized outputs	Medium

Human–AI Configuration & Overreliance

ID	Risk	Severity
AISECA-HAIC-001	Automation bias	Medium
AISECA-HAIC-002	Unsafe agent autonomy	High
AISECA-HAIC-003	Invisible Agent Decision-Making	High
AISECA-HAIC-004	Agent continues execution loops beyond intended bounds or stop conditions	Medium
AISECA-HAIC-005	Unbounded Resource Consumption by Agents	Medium
AISECA-HAIC-006	Uncontrolled Agent Delegation Chains	Medium
AISECA-HAIC-007	Delegation without accountability	Medium

Information Integrity

ID	Risk	Severity
AISECA-INTG-001	Misinformation propagation	Medium
AISECA-INTG-002	Output manipulation	Medium
AISECA-INTG-003	Lack of provenance	Medium

Information Security

ID	Risk	Severity
AISECA-INFOSEC-001	Loss of identity attribution	Medium
AISECA-INFOSEC-002	Compromised AI credentials	High
AISECA-INFOSEC-003	Over-privileged AI identities	High
AISECA-INFOSEC-004	Agent action exceeds authority delegated by initiating identity	Medium
AISECA-INFOSEC-005	Cross-Agent Impersonation	High
AISECA-INFOSEC-006	Untrusted MCP servers or tools gaining implicit trust	High
AISECA-INFOSEC-007	Prompt & instruction manipulation	High
AISECA-INFOSEC-008	Model extraction or abuse	High
AISECA-INFOSEC-009	Indirect Prompt Injection	High
AISECA-INFOSEC-010	Loss of initiating identity through multi-agent workflows	Medium
AISECA-INFOSEC-011	Training data poisoning	High
AISECA-INFOSEC-012	Initialization Race Conditions	High
AISECA-INFOSEC-013	Sandbox Self-Escalation	High
AISECA-INFOSEC-014	Ambient Authority Exploitation	High
AISECA-INFOSEC-015	Recursive Prompt Injection (LLM-as-a-Judge)	High
AISECA-INFOSEC-016	Multimodal Injection	High
AISECA-INFOSEC-017	Semantic Context Shifting	Medium
AISECA-INFOSEC-018	Abuse of Legitimate Agency	High
AISECA-INFOSEC-019	Public Discovery of Internal AI Middleware	Medium

Intellectual Property

ID	Risk	Severity
AISECA-IP-001	Proprietary data leakage	High
AISECA-IP-002	Copyright infringement	Medium
AISECA-IP-003	Model inversion	High

Obscene, Degrading, or Abusive Content

ID	Risk	Severity
AISECA-ODA-001	Sexually explicit outputs	Low
AISECA-ODA-002	Harassment or abuse	Medium

Value Chain & Component Integration

ID	Risk	Severity
AISECA-VC-001	Third-party model risk	High
AISECA-VC-002	Uncontrolled model updates	High
AISECA-VC-003	Security weaknesses inherited from orchestration frameworks or SDKs	High
AISECA-VC-004	Compromised, Untrusted, or Malicious Agent Tool Ecosystem	High
AISECA-VC-005	Insecure plugins or tools	High
AISECA-VC-006	Dependency "Cool-down" Violations	Medium

---

AISECA — AI Security Alliance · aiseca.org · GitHub