ADR-0009.

Date: 2026-07-09 Status: accepted Deciders: Thibault Souris (maintainer) Method: decision-loop — ecosystem veille (2026), sourced state of the art, challenge, durable position

Context

The 2026 ecosystem veille surfaced a stable, peer-reviewed risk taxonomy: the OWASP Top 10 for Agentic Applications (ASI01–ASI10), distinct from the LLM Top 10 — goal/intent hijack, tool misuse, identity abuse, memory poisoning, unsafe inter-agent communication, and so on. It is the shared grammar a security lead or an auditor already reads. runward's craft rules and its Rule conformance manifest currently speak runward's own vocabulary. That is legible to an engineer, opaque to a CISO.

Two forces make an alignment worth locking: the manifest becomes audit-ready supporting evidence that feeds an ISO/IEC 42001 programme and the EU AI Act technical documentation (art. 11 / Annex IV) (high-risk obligations binding 2027-12-02, postponed from 2026-08-02 by the Digital Omnibus on AI) — an input to that work, never a conformity assessment and never a substitute for art. 12 runtime logging — and ecosystem CVEs (MCP tool poisoning, rug-pull, memory injection) can be turned into opposable deterministic rules rather than left as prose warnings. The decision is at the tooling/method boundary (the rule schema and the manifest), deterministic, zero-LLM.

Decision

Adopt ASI01–ASI10 as the reference risk taxonomy of the gate:

• Each CRITICAL/HIGH craft rule declares an additive asi: frontmatter field mapping it to one or more ASI categories. The conformance report can then be read as ASI coverage — legible to a CISO, usable as audit-ready supporting evidence.
• Add CVE-derived deterministic craft rules the veille made concrete: an MCP server consumed by the system is pinned by version and hash; a change to a signed tool forces re-approval (against rug-pull / tool poisoning); retrieved content and memory items carry provenance and never gain instruction authority (memory poisoning).
• The mapping is descriptive and deterministic. No LLM classifies risk — the mapping is declared and exact.

Alternatives discarded

• Keep only runward's own vocabulary. Legible to engineers, opaque to auditors and security — it forfeits the audit-readiness value exactly when regulation demands it.
• An LLM that classifies each rule's risk. Violates the zero-LLM invariant; a declared mapping is exact where an LLM guess is not.
• Adopt the LLM Top 10 instead. The agentic taxonomy is the correct, distinct one for tool-using, memory-bearing, multi-agent systems.

Consequences

• Positive. The conformance manifest doubles as an ISO 42001 / EU AI Act evidence artifact; ecosystem CVEs become deterministic, opposable rules; the gate speaks the security world's language.
• Negative, accepted. A mapping to keep honest as OWASP revises the taxonomy; a few new craft rules to maintain.
• On other boundaries. Rule frontmatter gains asi:; the conformance report can group by ASI; the doctrine's security section can reference ASI as the shared grammar. Zero-LLM invariant untouched.

Reevaluation trigger (mandatory, dated)

Reopen when OWASP publishes a revised Agentic Top 10 (category renames/renumbering): re-map the asi: fields and pin the taxonomy version referenced. Reopen sooner if a mapping proves misleading to auditors in practice.

Trigger set on: 2026-07-09 · Watched via: OWASP Agentic Top 10 releases and the ecosystem CVE feed.

References

• ADR-0001 — the conformance manifest this grammar annotates.
• OWASP Top 10 for Agentic Applications (ASI01–10), 2026 — the reference taxonomy.
• ISO/IEC 42001 · EU AI Act art. 12–13 (binding 2027-12-02, postponed by the Digital Omnibus on AI) — the audit frame the manifest serves.
• templates/rules/*.md, the Rule conformance manifest — the surfaces this ADR touches.