Risk taxonomy · 10 risks · 2026
A compromised server can't hand your agent a new tool. You chose the tools, and nothing else can add to them.
Provenant does it. You can show it before your agent runs.
Where the standard asks you to prevent something the model might do, Provenant limits how far it gets.
| Ref | Requirement | How | Mechanism |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | Contained | The goal can be hijacked; what it can do can't |
| ASI02 | Tool Misuse and Exploitation | Enforced | What your agent can do next depends on what it has done and who approved it |
| ASI03 | Identity and Privilege Abuse | Enforced | Your agent can't grant itself anything |
| ASI04 | Agentic Supply Chain Vulnerabilities | Enforced | A compromised server can't hand your agent a new tool |
| ASI05 | Unexpected Code Execution | Contained | You know everything that could run before it does |
| ASI06 | Memory and Context Poisoning | Contained | Untrusted content can only affect what you allowed it to |
| ASI07 | Insecure Inter-Agent Communication | Enforced | A sub-agent can only send back what you allowed |
| ASI08 | Cascading Failures | Contained | You know how far a failure could spread before it does |
| ASI09 | Human-Agent Trust Exploitation | Enforced | You choose what the approver sees before they decide |
| ASI10 | Rogue Agents | Enforced | An agent can't operate outside what you allowed |