# Source records

Access date for all sources: **2026-10-22**. Only the listed portions were inspected. The user selected DASF as the methodological foundation; a second protocol-specific source supplies a complementary lens.

- **S1 — Databricks Security team, DASF v3 compendium.** [Official workbook](https://docs.google.com/spreadsheets/d/1lD5nKC1QNoUTDXdMp31NA9eKcUYGjhtC34MCfQpqpGo/edit). Inspected all risk/control rows, H–N deployment applicability, mappings and implementation links. Published catalog of 97 risks and 73 controls; observed source inconsistencies remain visible. Does not establish a particular system’s safety or compliance.
- **S2 — Databricks, DASF Version 2.0 whitepaper (2025).** [PDF](https://www.databricks.com/sites/default/files/2025-02/databricks-ebook-dasf-2.pdf). Inspected §1.2 pp. 8–10, intended audience pp. 7–8, red teaming pp. 99–103 and license p. 121. Demonstrates a documented lifecycle and testing practice, not a controlled causal performance study. Base paper counts are superseded by S1 for this catalog.
- **S3 — David Veuve, Omar Khawaja, Arun Pamulapati, Nishith Sinha and Caelin Kaplan, DASF v3 announcement (2026-03-20).** [Article](https://www.databricks.com/blog/agentic-ai-security-new-risks-and-controls-databricks-ai-security-framework-dasf-v30). Inspected component-13 organization, total inventory and official sheet link. Supports the agent/MCP extension; does not verify implemented controls.
- **S4 — Databricks, A guide on how to operationalize DASF.** [Public walkthrough transcript](https://answers.databricks.com/guide-operationalize-databricks-ai-security-framework-dasf-nfdRMIYWhdc). Inspected stakeholder intake, multiselect deployment filter, Yes matching and control aggregation. The demonstration references the older 62-risk version. The private Academy course was not inspected; no exact course-parity claim is made.
- **S5 — MCP maintainers, Security Best Practices, 2026-07-28 documentation.** [Official documentation](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices). Inspected confused deputy, token passthrough/audience, SSRF, state-handle and local-server boundaries. Recognized primary protocol guidance; no claim of independently measured outcomes in this project.

## Adaptations and limits

The ordered audit workflow, tri-state classification, separate source deviations, evidence status model, synthetic verification criteria, plain-language explanation contract and review rubric are authored adaptations. They are not quotations from or endorsements by the source teams.

Databricks and MCP maintainers were selected for documented relevant work and complementary coverage. Their publications are the evidence of practice. No success rate, professional qualification, user learning, revenue or reduction in incidents is inferred.

Source rights and transformation details are recorded in the companion repository’s NOTICE and wiki/sources.md. No private brief, transcript, real target evidence or credential is bundled in this skill.