Each row takes one dated test from the evidence record and lists the NIST AI RMF 1.0 subcategories and OWASP Agentic Top 10 items it gives evidence for. Where an item is not covered by a test, this page says so.
These are mappings, not certifications. Each row maps one dated, Candor-reported test to the framework items it gives evidence for. No row claims conformance with a framework, and no framework body has reviewed these results. Where a framework item is not covered by a test, the table says so.
Row numbers follow the order of the nineteen behaviors on the evidence page. Dates and results are copied from that page.
| Date | Verified behavior | Result | NIST AI RMF 1.0 | OWASP ASI (2026) |
|---|---|---|---|---|
| 15 Sep 2026 | 1. Sustained load | 600 consecutive governed evaluations, no degradation; p90 latency 2.4 s | MEASURE 2.3 (performance measured under deployment-like conditions); MEASURE 2.5 (valid and reliable before deployment) | Supports ASI08 (governance layer does not degrade under sustained load); no single ASI item |
| 17 and 18 Sep 2026 | 2. Discovery of undeclared agents | Discovery runs against three fleet shapes, none disclosed in advance | GOVERN 1.6 (inventory of AI systems); MAP 1.1 (context and deployment setting documented) | ASI10 Rogue Agents |
| 18 Sep 2026 | 3. Tree revocation | Ten agents lost authority on both planes; replacement generation live in under three minutes | MANAGE 2.4 (supersede, disengage or deactivate); MANAGE 2.3 (respond to and recover from a newly identified risk) | ASI03 Identity and Privilege Abuse; ASI08 Cascading Failures; ASI10 Rogue Agents |
| 21 Sep 2026 | 4. Identity and credential | Forged and replayed credentials quarantined | MEASURE 2.7 (security and resilience evaluated, adversarial attack) | ASI03 Identity and Privilege Abuse |
| 21 Sep 2026 | 5. No credential, no action | Agent with no credential refused | MEASURE 2.7 | ASI03 |
| 21 Sep 2026 | 6. Authority check and human hold | 24 of 24 and 20 of 20 | MAP 3.5 (human oversight processes); GOVERN 3.2 (human roles for oversight defined) | ASI02 Tool Misuse and Exploitation; ASI03 |
| 21 Sep 2026 | 7. Containment | Exfiltration attempt stopped; agent quarantined at the engine | MANAGE 2.4; MEASURE 2.7 | ASI02; ASI10 |
| 21 Sep 2026 | 8. Probation after restore | 24 of 24 | MANAGE 2.3; MANAGE 4.1 (recovery and change management after deployment) | ASI10; ASI08 |
| 21 Sep 2026 | 9. Observation mode | 29 of 29 | MEASURE 2.4 (functionality and behavior monitored in production); MANAGE 4.1 (post-deployment monitoring) | Supports ASI02 and ASI10 (observe before enforce); no single ASI item |
| 21 Sep 2026 | 10. Report from the ledger | 3,409 records chain-verified before reporting | MEASURE 2.8 (transparency and accountability, audit trails); GOVERN 4.2 (risks and impacts documented and shared) | Cross-cutting: tamper-evident logging is a listed mitigation across ASI01 to ASI10; no single item |
| 21 Sep 2026 | 11. Sealed platform | 15 of 15 probes blocked on both machines | MEASURE 2.7 | ASI05 Unexpected Code Execution; partial ASI04 (egress sealed; not a supply-chain test) |
| 21 Sep 2026 | 12. Our own fleet under control | Ten-agent department governed | GOVERN 1.6; MANAGE 4.1 | ASI10 |
| 3 Oct 2026 | 13. Sandbox compatibility | Identical outcomes across four runs. Tested compatible; not an NVIDIA certification or product integration | MEASURE 2.3 | ASI05 |
| 3 Oct 2026 | 14. Sealed, governed department | 18 of 18 seal probes passed | MEASURE 2.7 | ASI05; partial ASI04 |
| 5 Oct 2026 | 15. Work in flight at revocation | 21 checks passed, run twice | MANAGE 2.4 | ASI03; ASI08; ASI10 |
| 5 Oct 2026 | 16. Operator authentication | 12 of 12 | GOVERN 3.2; MAP 3.5 | ASI09 Human-Agent Trust Exploitation; ASI03 |
| 5 Oct 2026 | 17. Handoff integrity controls | 17 checks passed | MEASURE 2.8 | ASI07 Insecure Inter-Agent Communication; ASI01 Agent Goal Hijack |
| 19 Oct 2026 | 18. A revoked agent stays out | 6 of 6 | MANAGE 2.4; GOVERN 1.7 (decommissioning carried out safely) | ASI03; ASI10 |
| 19 Oct 2026 | 19. Retrieved content cannot redirect an agent | 3 of 3; full run 20 of 20 | MEASURE 2.7 (adversarial attack, data poisoning) | ASI01 Agent Goal Hijack; ASI06 Memory and Context Poisoning |
The one-line answer for a reviewer: which item, which rows, the latest test date and the status.
| ASI item | Evidence rows | Latest test | Status |
|---|---|---|---|
| ASI01 Agent Goal Hijack | 17, 19 | 19 Oct 2026 | Tested |
| ASI02 Tool Misuse and Exploitation | 6, 7 (9 supporting) | 21 Sep 2026 | Tested |
| ASI03 Identity and Privilege Abuse | 3, 4, 5, 6, 15, 16, 18 | 19 Oct 2026 | Tested. Limit: requester scope across agents not yet evaluated |
| ASI04 Agentic Supply Chain Vulnerabilities | 11, 14 (sealed egress only) | 3 Oct 2026 | Partial. No supply-chain test (model or tool provenance) is listed on the evidence page |
| ASI05 Unexpected Code Execution | 11, 13, 14 | 3 Oct 2026 | Tested in the sealed sandbox arm |
| ASI06 Memory and Context Poisoning | 19 | 19 Oct 2026 | Tested for retrieved content; persistent memory poisoning not separately tested |
| ASI07 Insecure Inter-Agent Communication | 17 | 5 Oct 2026 | Tested. Limit: covert channels between agents not tested |
| ASI08 Cascading Failures | 3, 15 (1 supporting) | 5 Oct 2026 | Tested at ten-agent tree scale only |
| ASI09 Human-Agent Trust Exploitation | 16 | 5 Oct 2026 | Tested on the operator boundary only |
| ASI10 Rogue Agents | 2, 3, 7, 12, 18 | 19 Oct 2026 | Tested |
What is not yet evidence, against the same frameworks. These are the four limits stated on the evidence page.
| Limit | What is not tested | NIST AI RMF 1.0 | OWASP ASI (2026) |
|---|---|---|---|
| Population scale | Live revocation tested at a ten-agent tree and 600 evaluations; report generator on synthetic 5,000 agents and 500,000 actions; hundreds or thousands of live agents not tested | MEASURE 2.3 (deployment-like conditions): gap at scale | ASI08 |
| Requester scope and covert channels | The acting agent's authority governs; the requester's narrower scope is not evaluated; covert channels not tested | MAP 3.5: partial | ASI03, ASI07 |
| Evaluator access | No scoped read-only credential for auditors or third-party assessors | MEASURE 1.3 (independent assessors): not met | Not applicable |
| Bypass on the customer side | Depends on the customer's deployment | MAP 4.2 (controls for components): customer-owned | ASI02 |
NIST AI RMF 1.0 subcategories from the NIST AI RMF Playbook. OWASP Top 10 for Agentic Applications for 2026, published 9 Dec 2025. Mapping prepared 6 Nov 2026.
Every result comes from Candor’s own test range and fleet. None is a customer result, and none is an independent audit.
A mapping to the CSA AI Controls Matrix, the control set behind AI-CAIQ, is not published on this page yet.
A Discovery produces it: inventory, identities, an observation window and a signed, chain-verified report.
See the Discovery engagement →