# AI agent security, from risk to evidence.

Understand what your AI system can read, remember and change. Explore the Databricks AI Security Framework, investigate the relevant risks and give your agent a method for proposing corrections.

[Start the audit checklist](https://mathborgess.github.io/ai-security-wiki/guides/agent-security-checklist.md) · [Connect your agent](https://mathborgess.github.io/ai-security-wiki/docs/clients.md)

## Start with the boundary you need to protect

- **Review an agent.** [Classify the system, inspect its permissions and plan an audit](https://mathborgess.github.io/ai-security-wiki/guides/agent-security-checklist.md).
- **Connect tools safely.** [Review MCP clients, servers, credentials and authorization](https://mathborgess.github.io/ai-security-wiki/guides/mcp-security.md).
- **Investigate prompt injection.** [Trace untrusted content to data access and actions](https://mathborgess.github.io/ai-security-wiki/guides/prompt-injection.md).
- **Learn from a correction.** [Reproduce and fix a synthetic cross-tenant authorization flaw](https://mathborgess.github.io/ai-security-wiki/examples/tenant-boundary.md).
- **Study security investigations.** [Explore PentAGI, Cloudflare's audit skill and Red Blue Field](https://mathborgess.github.io/ai-security-wiki/wiki/research/index.md), then [follow a hypothesis through evidence and retest](https://mathborgess.github.io/ai-security-wiki/guides/evidence-driven-audit.md).

- **Study reconnaissance.** [Explore Jason Haddix's methods, tools and reports, with an attack-surface mapping skill](https://mathborgess.github.io/ai-security-wiki/wiki/research/jason-haddix.md).

- **Ask a cybersecurity study partner.** [Understand mechanisms, challenge hypotheses and choose a practical exercise](https://mathborgess.github.io/ai-security-wiki/skills/ask-cyber-specialist/SKILL.md).
- **Design an AI security evaluation.** [Separate model, guardrail and application outcomes with spikee](https://mathborgess.github.io/ai-security-wiki/wiki/research/spikee-evaluation.md).

## A reference you can inspect

This independent project by Matheus Borges combines a linked wiki, a versioned catalog and a local MCP server. The DASF 3.0 snapshot covers **97 risks and 73 controls** across ML, GenAI and agentic systems. Every record points to its source. The project preserves disagreements in the source and labels its own interpretation.

[Read the audit method](https://mathborgess.github.io/ai-security-wiki/wiki/methodology.md) · [Inspect source caveats](https://mathborgess.github.io/ai-security-wiki/wiki/source-issues.md) · [See what was tested](https://mathborgess.github.io/ai-security-wiki/docs/validation.md)

## Give your agent a method

The MCP helps the calling agent classify a system, select risks, request evidence and propose corrections. Run it locally with Node.js 22+. It requires no model key or Databricks account.

```sh
git clone https://github.com/MathBorgess/ai-security-wiki.git
cd ai-security-wiki
npm ci --ignore-scripts
npm run demo
```

[Claude, Codex, ChatGPT and other agents](https://mathborgess.github.io/ai-security-wiki/docs/clients.md) · [MCP tool contract](https://mathborgess.github.io/ai-security-wiki/docs/mcp.md) · [Portable audit skill](https://mathborgess.github.io/ai-security-wiki/skills/audit-ai-security/SKILL.md)

The website is a readable reference. The local MCP provides tools. A catalog match is a reason to investigate, not proof that a vulnerability exists.

## Explore the reference

Choose a risk, control or research guide below, or navigate by [system component and deployment pattern](https://mathborgess.github.io/ai-security-wiki/wiki/index.md). The six research guides are complementary project references; the DASF snapshot still contains 97 risks and 73 controls. Preserve unknowns and combine every pattern present in your architecture.

- [DASF-R-1.1: Insufficient access controls](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.1.md)
- [DASF-R-1.2: Missing data classification](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.2.md)
- [DASF-R-1.3: Poor data quality](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.3.md)
- [DASF-R-1.4: Ineffective storage and encryption](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.4.md)
- [DASF-R-1.5: Lack of data versioning](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.5.md)
- [DASF-R-1.6: Insufficient data lineage](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.6.md)
- [DASF-R-1.7: Lack of data trustworthiness](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.7.md)
- [DASF-R-1.8: Legality of data](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.8.md)
- [DASF-R-1.9: Stale data](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.9.md)
- [DASF-R-1.10: Lack of data access logs](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.10.md)
- [DASF-R-1.11: Compromised 3rd-party datasets](https://mathborgess.github.io/ai-security-wiki/wiki/risks/1.11.md)
- [DASF-R-2.1: Preprocessing integrity](https://mathborgess.github.io/ai-security-wiki/wiki/risks/2.1.md)
- [DASF-R-2.2: Feature manipulation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/2.2.md)
- [DASF-R-2.3: Raw data criteria](https://mathborgess.github.io/ai-security-wiki/wiki/risks/2.3.md)
- [DASF-R-2.4: Adversarial partitions](https://mathborgess.github.io/ai-security-wiki/wiki/risks/2.4.md)
- [DASF-R-3.1: Data poisoning](https://mathborgess.github.io/ai-security-wiki/wiki/risks/3.1.md)
- [DASF-R-3.2: Ineffective storage and encryption](https://mathborgess.github.io/ai-security-wiki/wiki/risks/3.2.md)
- [DASF-R-3.3: Label flipping](https://mathborgess.github.io/ai-security-wiki/wiki/risks/3.3.md)
- [DASF-R-4.1: Lack of traceability and transparency of model assets](https://mathborgess.github.io/ai-security-wiki/wiki/risks/4.1.md)
- [DASF-R-4.2: Lack of end-to-end ML lifecycle](https://mathborgess.github.io/ai-security-wiki/wiki/risks/4.2.md)
- [DASF-R-5.1: Lack of tracking and reproducibility of experiments](https://mathborgess.github.io/ai-security-wiki/wiki/risks/5.1.md)
- [DASF-R-5.2: Model drift](https://mathborgess.github.io/ai-security-wiki/wiki/risks/5.2.md)
- [DASF-R-5.3: Hyperparameters stealing](https://mathborgess.github.io/ai-security-wiki/wiki/risks/5.3.md)
- [DASF-R-5.4: Malicious libraries](https://mathborgess.github.io/ai-security-wiki/wiki/risks/5.4.md)
- [DASF-R-6.1: Evaluation data poisoning](https://mathborgess.github.io/ai-security-wiki/wiki/risks/6.1.md)
- [DASF-R-6.2: Insufficient evaluation data](https://mathborgess.github.io/ai-security-wiki/wiki/risks/6.2.md)
- [DASF-R-6.3: Lack of Interpretability and Explainability](https://mathborgess.github.io/ai-security-wiki/wiki/risks/6.3.md)
- [DASF-R-7.1: Backdoor machine learning / Trojaned model](https://mathborgess.github.io/ai-security-wiki/wiki/risks/7.1.md)
- [DASF-R-7.2: Model assets leak](https://mathborgess.github.io/ai-security-wiki/wiki/risks/7.2.md)
- [DASF-R-7.3: ML Supply chain vulnerabilities](https://mathborgess.github.io/ai-security-wiki/wiki/risks/7.3.md)
- [DASF-R-7.4: Source code control attack](https://mathborgess.github.io/ai-security-wiki/wiki/risks/7.4.md)
- [DASF-R-8.1: Model attribution](https://mathborgess.github.io/ai-security-wiki/wiki/risks/8.1.md)
- [DASF-R-8.2: Model theft](https://mathborgess.github.io/ai-security-wiki/wiki/risks/8.2.md)
- [DASF-R-8.3: Model lifecycle without HITL (human-in-the-loop)](https://mathborgess.github.io/ai-security-wiki/wiki/risks/8.3.md)
- [DASF-R-8.4: Model inversion](https://mathborgess.github.io/ai-security-wiki/wiki/risks/8.4.md)
- [DASF-R-9.1: Prompt inject](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.1.md)
- [DASF-R-9.2: Model inversion](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.2.md)
- [DASF-R-9.3: Model breakout](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.3.md)
- [DASF-R-9.4: Looped input](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.4.md)
- [DASF-R-9.5: Infer training data membership](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.5.md)
- [DASF-R-9.6: Discover ML model ontology](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.6.md)
- [DASF-R-9.7: Denial of Service (DoS)](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.7.md)
- [DASF-R-9.8: LLM hallucinations](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.8.md)
- [DASF-R-9.9: Input Resource Control](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.9.md)
- [DASF-R-9.10: Accidental exposure of unauthorized data to models](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.10.md)
- [DASF-R-9.11: Model Inference API Access](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.11.md)
- [DASF-R-9.12: LLM Jailbreak](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.12.md)
- [DASF-R-9.13: Excessive agency](https://mathborgess.github.io/ai-security-wiki/wiki/risks/9.13.md)
- [DASF-R-10.1: Lack of audit and monitoring inference quality](https://mathborgess.github.io/ai-security-wiki/wiki/risks/10.1.md)
- [DASF-R-10.2: Output manipulation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/10.2.md)
- [DASF-R-10.3: Discover ML model ontology](https://mathborgess.github.io/ai-security-wiki/wiki/risks/10.3.md)
- [DASF-R-10.4: Discover ML model family](https://mathborgess.github.io/ai-security-wiki/wiki/risks/10.4.md)
- [DASF-R-10.5: Black-box attacks](https://mathborgess.github.io/ai-security-wiki/wiki/risks/10.5.md)
- [DASF-R-10.6: Sensitive data output from a model](https://mathborgess.github.io/ai-security-wiki/wiki/risks/10.6.md)
- [DASF-R-11.1: Lack of MLOps — repeatable enforced standards](https://mathborgess.github.io/ai-security-wiki/wiki/risks/11.1.md)
- [DASF-R-12.1: Lack of vulnerability management](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.1.md)
- [DASF-R-12.2: Lack of penetration testing, red teaming and bug bounty](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.2.md)
- [DASF-R-12.3: Lack of incident response](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.3.md)
- [DASF-R-12.4: Unauthorized privileged access](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.4.md)
- [DASF-R-12.5: Poor security in the software development lifecycle](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.5.md)
- [DASF-R-12.6: Lack of compliance](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.6.md)
- [DASF-R-12.7: Initial Access](https://mathborgess.github.io/ai-security-wiki/wiki/risks/12.7.md)
- [DASF-R-13.1: Memory Poisoning](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.1.md)
- [DASF-R-13.2: Tool Misuse](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.2.md)
- [DASF-R-13.3: Privilege Compromise](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.3.md)
- [DASF-R-13.4: Resource Overload](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.4.md)
- [DASF-R-13.5: Cascading Hallucination Attacks](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.5.md)
- [DASF-R-13.6: Intent Breaking & Goal Manipulation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.6.md)
- [DASF-R-13.7: Misaligned & Deceptive Behaviors](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.7.md)
- [DASF-R-13.8: Repudiation & Untraceability](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.8.md)
- [DASF-R-13.9: Identity Spoofing & Impersonation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.9.md)
- [DASF-R-13.10: Overwhelming Human in the Loop](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.10.md)
- [DASF-R-13.11: Unexpected RCE and Code Attacks](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.11.md)
- [DASF-R-13.12: Agent Communication Poisoning](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.12.md)
- [DASF-R-13.13: Rogue Agents in Multi-Agent Systems](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.13.md)
- [DASF-R-13.14: Human Attacks on Multi-Agent Systems](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.14.md)
- [DASF-R-13.15: Human Manipulation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.15.md)
- [DASF-R-13.16: Prompt Injection](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.16.md)
- [DASF-R-13.17: Confused Deputy](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.17.md)
- [DASF-R-13.18: Tool Poisoning](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.18.md)
- [DASF-R-13.19: Credential and Token Exposure](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.19.md)
- [DASF-R-13.20: Insecure Server Configuration](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.20.md)
- [DASF-R-13.21: Supply Chain Attacks](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.21.md)
- [DASF-R-13.22: Excessive Permissions and Scope Creep](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.22.md)
- [DASF-R-13.23: Data Exfiltration](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.23.md)
- [DASF-R-13.24: Context Spoofing and Manipulation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.24.md)
- [DASF-R-13.25: Insecure Communication](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.25.md)
- [DASF-R-13.26: Malicious Server Connection](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.26.md)
- [DASF-R-13.27: Insecure Credential Storage](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.27.md)
- [DASF-R-13.28: UI/UX Deception](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.28.md)
- [DASF-R-13.29: Insufficient Server Validation](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.29.md)
- [DASF-R-13.30: Client-Side Data Leakage](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.30.md)
- [DASF-R-13.31: Excessive Permission Granting](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.31.md)
- [DASF-R-13.32: Client-Side Code Execution](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.32.md)
- [DASF-R-13.33: Insecure Communication Handling](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.33.md)
- [DASF-R-13.34: Session and State Management Failures](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.34.md)
- [DASF-R-13.35: Update and Patch Management](https://mathborgess.github.io/ai-security-wiki/wiki/risks/13.35.md)
- [DASF-1: SSO with IdP and MFA](https://mathborgess.github.io/ai-security-wiki/wiki/controls/1.md)
- [DASF-2: Sync users and groups](https://mathborgess.github.io/ai-security-wiki/wiki/controls/2.md)
- [DASF-3: Restrict access using IP access lists](https://mathborgess.github.io/ai-security-wiki/wiki/controls/3.md)
- [DASF-4: Restrict access using private link](https://mathborgess.github.io/ai-security-wiki/wiki/controls/4.md)
- [DASF-5: Control access to data and other objects](https://mathborgess.github.io/ai-security-wiki/wiki/controls/5.md)
- [DASF-6: Classify data](https://mathborgess.github.io/ai-security-wiki/wiki/controls/6.md)
- [DASF-7: Enforce data quality checks on batch and streaming datasets](https://mathborgess.github.io/ai-security-wiki/wiki/controls/7.md)
- [DASF-8: Encrypt data at rest](https://mathborgess.github.io/ai-security-wiki/wiki/controls/8.md)
- [DASF-9: Encrypt data in transit](https://mathborgess.github.io/ai-security-wiki/wiki/controls/9.md)
- [DASF-10: Version data](https://mathborgess.github.io/ai-security-wiki/wiki/controls/10.md)
- [DASF-11: Capture and view data lineage](https://mathborgess.github.io/ai-security-wiki/wiki/controls/11.md)
- [DASF-12: Delete records from datasets](https://mathborgess.github.io/ai-security-wiki/wiki/controls/12.md)
- [DASF-13: Use near real-time data](https://mathborgess.github.io/ai-security-wiki/wiki/controls/13.md)
- [DASF-14: Audit actions performed on datasets](https://mathborgess.github.io/ai-security-wiki/wiki/controls/14.md)
- [DASF-15: Explore datasets and identify problems](https://mathborgess.github.io/ai-security-wiki/wiki/controls/15.md)
- [DASF-16: Secure model features](https://mathborgess.github.io/ai-security-wiki/wiki/controls/16.md)
- [DASF-17: Track and reproduce the training data used for ML model training](https://mathborgess.github.io/ai-security-wiki/wiki/controls/17.md)
- [DASF-18: Govern model assets](https://mathborgess.github.io/ai-security-wiki/wiki/controls/18.md)
- [DASF-19: Manage end-to-end machine learning lifecycle](https://mathborgess.github.io/ai-security-wiki/wiki/controls/19.md)
- [DASF-20: Track ML training runs](https://mathborgess.github.io/ai-security-wiki/wiki/controls/20.md)
- [DASF-21: Monitor data and AI system from a single pane of glass](https://mathborgess.github.io/ai-security-wiki/wiki/controls/21.md)
- [DASF-22: Build models with all representative, accurate and relevant data sources](https://mathborgess.github.io/ai-security-wiki/wiki/controls/22.md)
- [DASF-23: Register, version, approve, promote, deploy and monitor models](https://mathborgess.github.io/ai-security-wiki/wiki/controls/23.md)
- [DASF-24: Control access to models and model assets](https://mathborgess.github.io/ai-security-wiki/wiki/controls/24.md)
- [DASF-25: Use retrieval augmented generation (RAG) with large language models (LLMs)](https://mathborgess.github.io/ai-security-wiki/wiki/controls/25.md)
- [DASF-26: Fine-tune large language models (LLMs)](https://mathborgess.github.io/ai-security-wiki/wiki/controls/26.md)
- [DASF-27: Pretrain a large language model (LLM)](https://mathborgess.github.io/ai-security-wiki/wiki/controls/27.md)
- [DASF-28: Create model aliases, tags and annotations](https://mathborgess.github.io/ai-security-wiki/wiki/controls/28.md)
- [DASF-29: Build MLOps workflows](https://mathborgess.github.io/ai-security-wiki/wiki/controls/29.md)
- [DASF-30: Encrypt models](https://mathborgess.github.io/ai-security-wiki/wiki/controls/30.md)
- [DASF-31: Secure model serving endpoints](https://mathborgess.github.io/ai-security-wiki/wiki/controls/31.md)
- [DASF-32: Govern and monitor access of AI model and model serving endpoints](https://mathborgess.github.io/ai-security-wiki/wiki/controls/32.md)
- [DASF-33: Manage credentials securely](https://mathborgess.github.io/ai-security-wiki/wiki/controls/33.md)
- [DASF-34: Run models in multiple layers of isolation](https://mathborgess.github.io/ai-security-wiki/wiki/controls/34.md)
- [DASF-35: Track model performance](https://mathborgess.github.io/ai-security-wiki/wiki/controls/35.md)
- [DASF-36: Set up monitoring alerts](https://mathborgess.github.io/ai-security-wiki/wiki/controls/36.md)
- [DASF-37: Set up inference tables for monitoring and debugging models](https://mathborgess.github.io/ai-security-wiki/wiki/controls/37.md)
- [DASF-38: Platform security — penetration testing, red teaming, bug bounty and vulnerability management](https://mathborgess.github.io/ai-security-wiki/wiki/controls/38.md)
- [DASF-39: Platform security — Incident Response Team](https://mathborgess.github.io/ai-security-wiki/wiki/controls/39.md)
- [DASF-40: Platform security — internal access](https://mathborgess.github.io/ai-security-wiki/wiki/controls/40.md)
- [DASF-41: Platform security — secure SDLC](https://mathborgess.github.io/ai-security-wiki/wiki/controls/41.md)
- [DASF-42: Employ data-centric MLOps and LLMOps](https://mathborgess.github.io/ai-security-wiki/wiki/controls/42.md)
- [DASF-43: Use access control lists](https://mathborgess.github.io/ai-security-wiki/wiki/controls/43.md)
- [DASF-44: Triggering actions in response to a specific event](https://mathborgess.github.io/ai-security-wiki/wiki/controls/44.md)
- [DASF-45: Evaluate models](https://mathborgess.github.io/ai-security-wiki/wiki/controls/45.md)
- [DASF-46: Store and retrieve embeddings securely](https://mathborgess.github.io/ai-security-wiki/wiki/controls/46.md)
- [DASF-47: Compare LLM outputs on set prompts](https://mathborgess.github.io/ai-security-wiki/wiki/controls/47.md)
- [DASF-48: Use hardened Runtime for Machine Learning](https://mathborgess.github.io/ai-security-wiki/wiki/controls/48.md)
- [DASF-49: Automate LLM evaluation](https://mathborgess.github.io/ai-security-wiki/wiki/controls/49.md)
- [DASF-50: Platform compliance](https://mathborgess.github.io/ai-security-wiki/wiki/controls/50.md)
- [DASF-51: Share data and AI assets securely](https://mathborgess.github.io/ai-security-wiki/wiki/controls/51.md)
- [DASF-52: Source code control](https://mathborgess.github.io/ai-security-wiki/wiki/controls/52.md)
- [DASF-53: Third-party library control](https://mathborgess.github.io/ai-security-wiki/wiki/controls/53.md)
- [DASF-54: Implement AI guardrails](https://mathborgess.github.io/ai-security-wiki/wiki/controls/54.md)
- [DASF-55: Monitor audit logs](https://mathborgess.github.io/ai-security-wiki/wiki/controls/55.md)
- [DASF-56: Restrict outbound connections from models](https://mathborgess.github.io/ai-security-wiki/wiki/controls/56.md)
- [DASF-57: Use attribute-based access controls (ABAC)](https://mathborgess.github.io/ai-security-wiki/wiki/controls/57.md)
- [DASF-58: Protect data with filters and masking](https://mathborgess.github.io/ai-security-wiki/wiki/controls/58.md)
- [DASF-59: Use clean rooms](https://mathborgess.github.io/ai-security-wiki/wiki/controls/59.md)
- [DASF-60: Rate limit number of inference queries](https://mathborgess.github.io/ai-security-wiki/wiki/controls/60.md)
- [DASF-61: Train users on AI risk taxonomy and AI/ML security](https://mathborgess.github.io/ai-security-wiki/wiki/controls/61.md)
- [DASF-62: Implement network segmentation](https://mathborgess.github.io/ai-security-wiki/wiki/controls/62.md)
- [DASF-63: Update software](https://mathborgess.github.io/ai-security-wiki/wiki/controls/63.md)
- [DASF-64: Limit access from AI models and agents](https://mathborgess.github.io/ai-security-wiki/wiki/controls/64.md)
- [DASF-65: Implement end-to-end AI traceability](https://mathborgess.github.io/ai-security-wiki/wiki/controls/65.md)
- [DASF-66: Use Human-in-the-loop feedback](https://mathborgess.github.io/ai-security-wiki/wiki/controls/66.md)
- [DASF-67: Federate authentication](https://mathborgess.github.io/ai-security-wiki/wiki/controls/67.md)
- [DASF-68: Use Securely Hosted Managed MCP Servers](https://mathborgess.github.io/ai-security-wiki/wiki/controls/68.md)
- [DASF-69: Securely host Custom MCP Servers](https://mathborgess.github.io/ai-security-wiki/wiki/controls/69.md)
- [DASF-70: Securely connect to External MCP Servers](https://mathborgess.github.io/ai-security-wiki/wiki/controls/70.md)
- [DASF-71: Log and register AI agents](https://mathborgess.github.io/ai-security-wiki/wiki/controls/71.md)
- [DASF-72: Securely store and reuse agent state](https://mathborgess.github.io/ai-security-wiki/wiki/controls/72.md)
- [DASF-73: Register prompts](https://mathborgess.github.io/ai-security-wiki/wiki/controls/73.md)
- [security-research: Security research: PentAGI, Cloudflare and Red Blue Field](https://mathborgess.github.io/ai-security-wiki/wiki/research/index.md)
- [pentagi: PentAGI: study agentic security investigations](https://mathborgess.github.io/ai-security-wiki/wiki/research/pentagi.md)
- [cloudflare-audit: Cloudflare security-audit-skill: evidence and verification](https://mathborgess.github.io/ai-security-wiki/wiki/research/cloudflare-security-audit.md)
- [red-blue-field: Red Blue Field: from reference methods to a learning laboratory](https://mathborgess.github.io/ai-security-wiki/wiki/research/red-blue-field.md)
- [evidence-playbook: Evidence-driven AI security audit: hypothesis, coverage and retest](https://mathborgess.github.io/ai-security-wiki/guides/evidence-driven-audit.md)
- [coverage-template: Coverage ledger for an AI security audit](https://mathborgess.github.io/ai-security-wiki/wiki/templates/coverage-ledger.md)