{
  "schemaVersion": 1,
  "kind": "csint-n8n-workflow-change-receipt",
  "reviewEngineVersion": "1.3.0",
  "fingerprintAlgorithm": "sha256-canonical-json-v1",
  "generatedAt": "2026-09-30T12:00:00.000Z",
  "reviewId": "wcr-fb5ed970c1fb-21155a81",
  "title": "Change A: Three threat intel tools are added to the agent",
  "reviewer": "Ahmet Göker",
  "decision": "review",
  "decisionReason": "Static evidence is available, but no passing staging receipt is bound to this exact candidate.",
  "decisionBasis": "no-runtime",
  "subject": {
    "baseline": {
      "name": "Scanner Alert Triage",
      "fingerprint": "21155a81aa9e0dd404fdf028122064518b514b540535622bd6c6a0a6bead5473",
      "nodeCount": 5
    },
    "candidate": {
      "name": "Scanner Alert Triage",
      "fingerprint": "fb5ed970c1fb031f596090b94acf531dc8ec3fc19661290386a5538b9c232a38",
      "nodeCount": 8
    }
  },
  "summary": {
    "changes": 9,
    "blocker": 0,
    "review": 6,
    "improvement": 0,
    "context": 3,
    "connectionsAdded": 3,
    "connectionsRemoved": 0,
    "introducedFindings": 1,
    "resolvedFindings": 0,
    "openFindings": 7,
    "preExistingOpenFindings": 6,
    "renamedNodes": 0
  },
  "runtime": {
    "status": "not-run",
    "bound": false,
    "verifiedAt": null,
    "executedWorkflowFingerprint": null,
    "scenarios": {
      "passed": 0,
      "failed": 0,
      "total": 0
    },
    "checks": {
      "passed": 0,
      "total": 0
    },
    "externalActionsExecuted": null,
    "coveredStaticRules": [],
    "note": "No candidate-bound staging receipt was supplied."
  },
  "retest": {
    "status": "not-supplied",
    "priorReviewId": null,
    "priorCandidateFingerprint": null,
    "priorDecision": null,
    "priorFindingRuleIds": [],
    "fixedFindingRuleIds": [],
    "remainingFindingRuleIds": [],
    "introducedFindingRuleIds": [],
    "note": "No prior ReleaseGuard receipt was supplied for retest comparison."
  },
  "manualReviews": [
    {
      "id": "MR-001",
      "appliesTo": "finding",
      "subjectId": "TG-100-01",
      "status": "likely",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "The path from Webhook through Alert Triage Agent to Send a message is real: the whole alert JSON goes into the prompt, and alert fields can hold text an attacker controls, such as a user or resource name. The webhook uses header auth and the end step posts to one fixed Slack channel, so the worst case is a wrong or misleading triage note. I would rate it medium for this template, not critical."
    },
    {
      "id": "MR-002",
      "appliesTo": "finding",
      "subjectId": "AA-003-02",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Confirmed. The prompt is built with JSON.stringify of the whole request item, with no step that limits size or strips free text first. For a triage agent this is by design, which is why the tools it can call should stay read-only."
    },
    {
      "id": "MR-003",
      "appliesTo": "finding",
      "subjectId": "AA-004-03",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Confirmed and by design: the model output is posted to Slack with no approval step. Posting the triage note is the purpose of the workflow. Approval is not needed here, but it is needed before any step that writes somewhere else."
    },
    {
      "id": "MR-004",
      "appliesTo": "finding",
      "subjectId": "AA-006-04",
      "status": "needs-environment-evidence",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "No rate or cost limit is visible in the export. The alerts come from the detection platform behind header auth, so a limit may exist on the sending side; the export cannot show it. Ask the team where the alert rate is capped."
    },
    {
      "id": "MR-005",
      "appliesTo": "finding",
      "subjectId": "AA-005-05",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Confirmed. The Slack text is the model output with only a cut at the first siren emoji. No schema check runs on it."
    },
    {
      "id": "MR-006",
      "appliesTo": "finding",
      "subjectId": "AA-008-06",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Confirmed, introduced by this change. ThreatFox IOC Lookup, OTX Pulse Search and Feodo Tracker set no timeout and no retry. A slow lookup API holds the agent run. Fix: about 10 to 15 seconds and one retry on each."
    },
    {
      "id": "MR-007",
      "appliesTo": "finding",
      "subjectId": "AA-010-07",
      "status": "confirmed",
      "reviewer": "Ahmet Göker",
      "reviewedAt": "2026-09-30T13:00:00.000Z",
      "note": "Confirmed, low. No error workflow is set, so a failed triage run goes unnoticed unless someone looks at the execution list."
    }
  ],
  "environmentEvidence": {
    "instanceAudit": null,
    "publishedWorkflowIdentity": {
      "status": "not-verified",
      "note": "The identity of the workflow actually published to production was not independently verified."
    },
    "productionPermissions": {
      "status": "not-verified",
      "note": "Production credential and external-service permissions were not independently verified."
    },
    "productionRegister": []
  },
  "customerAcceptance": {
    "status": "not-recorded",
    "acceptedBy": "Customer acceptance pending",
    "recordedAt": null,
    "note": ""
  },
  "changes": [
    {
      "id": "CR-001",
      "kind": "finding-introduced",
      "impact": "review",
      "title": "A new medium finding was introduced: Outbound requests do not show an explicit timeout or retry policy",
      "note": "Outbound HTTP nodes have no explicit timeout or retry policy.",
      "evidence": {
        "ruleId": "AA-008",
        "severity": "medium",
        "nodes": [
          "Feodo Tracker",
          "OTX Pulse Search",
          "ThreatFox IOC Lookup"
        ]
      }
    },
    {
      "id": "CR-002",
      "kind": "outbound-domain-added",
      "impact": "review",
      "title": "A new external destination appears: feodotracker.abuse.ch",
      "note": "Confirm the owner, data purpose and retention terms before allowing this destination.",
      "evidence": {
        "domain": "feodotracker.abuse.ch"
      }
    },
    {
      "id": "CR-003",
      "kind": "outbound-domain-added",
      "impact": "review",
      "title": "A new external destination appears: otx.alienvault.com",
      "note": "Confirm the owner, data purpose and retention terms before allowing this destination.",
      "evidence": {
        "domain": "otx.alienvault.com"
      }
    },
    {
      "id": "CR-004",
      "kind": "outbound-domain-added",
      "impact": "review",
      "title": "A new external destination appears: threatfox-api.abuse.ch",
      "note": "Confirm the owner, data purpose and retention terms before allowing this destination.",
      "evidence": {
        "domain": "threatfox-api.abuse.ch"
      }
    },
    {
      "id": "CR-005",
      "kind": "read-only-post-lookup",
      "impact": "review",
      "title": "A POST request is treated as a read-only lookup: ThreatFox IOC Lookup",
      "note": "POST alone is not a write. The request body asks for a search, lookup or read. Confirm in the API documentation that this call cannot change data, and record which values the model sends to this third party.",
      "evidence": {
        "node": "ThreatFox IOC Lookup",
        "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest",
        "reason": "The request body asks for a search, lookup or read."
      }
    },
    {
      "id": "CR-006",
      "kind": "node-config-changed",
      "impact": "review",
      "title": "Security-relevant configuration changed: Alert Triage Agent",
      "note": "The node behaviour changed outside layout-only fields. Review the candidate configuration and the attached staging evidence.",
      "evidence": {
        "node": "Alert Triage Agent",
        "nodeType": "@n8n/n8n-nodes-langchain.agent",
        "credentialsChanged": false,
        "activationChanged": false
      }
    },
    {
      "id": "CR-007",
      "kind": "node-added",
      "impact": "context",
      "title": "A workflow step was added: Feodo Tracker",
      "note": "The candidate introduces @n8n/n8n-nodes-langchain.toolHttpRequest. Review its inputs, permissions and failure behaviour.",
      "evidence": {
        "node": "Feodo Tracker",
        "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest",
        "nodeKind": "tool"
      }
    },
    {
      "id": "CR-008",
      "kind": "node-added",
      "impact": "context",
      "title": "A workflow step was added: OTX Pulse Search",
      "note": "The candidate introduces @n8n/n8n-nodes-langchain.toolHttpRequest. Review its inputs, permissions and failure behaviour.",
      "evidence": {
        "node": "OTX Pulse Search",
        "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest",
        "nodeKind": "tool"
      }
    },
    {
      "id": "CR-009",
      "kind": "node-added",
      "impact": "context",
      "title": "A workflow step was added: ThreatFox IOC Lookup",
      "note": "The candidate introduces @n8n/n8n-nodes-langchain.toolHttpRequest. Review its inputs, permissions and failure behaviour.",
      "evidence": {
        "node": "ThreatFox IOC Lookup",
        "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest",
        "nodeKind": "tool"
      }
    }
  ],
  "candidateEvidence": {
    "analyzerVersion": "1.1.0",
    "policy": {
      "allowedOutboundDomains": [],
      "blockedNodeTypes": [],
      "blockedCredentialTypes": [],
      "requireHumanApprovalBefore": [],
      "dynamicTargetPolicy": "review"
    },
    "inventory": {
      "triggers": [
        {
          "name": "Webhook",
          "type": "n8n-nodes-base.webhook"
        }
      ],
      "aiAgents": [
        {
          "name": "Alert Triage Agent",
          "type": "@n8n/n8n-nodes-langchain.agent",
          "tools": [
            "Feodo Tracker",
            "OTX Pulse Search",
            "Scanner MCP",
            "ThreatFox IOC Lookup"
          ],
          "memory": []
        }
      ],
      "modelNodes": [
        {
          "name": "Anthropic Chat Model",
          "type": "@n8n/n8n-nodes-langchain.lmChatAnthropic"
        }
      ],
      "toolNodes": [
        {
          "name": "Feodo Tracker",
          "type": "@n8n/n8n-nodes-langchain.toolHttpRequest",
          "agent": "Alert Triage Agent"
        },
        {
          "name": "OTX Pulse Search",
          "type": "@n8n/n8n-nodes-langchain.toolHttpRequest",
          "agent": "Alert Triage Agent"
        },
        {
          "name": "Scanner MCP",
          "type": "@n8n/n8n-nodes-langchain.mcpClientTool",
          "agent": "Alert Triage Agent"
        },
        {
          "name": "ThreatFox IOC Lookup",
          "type": "@n8n/n8n-nodes-langchain.toolHttpRequest",
          "agent": "Alert Triage Agent"
        }
      ],
      "outboundDomains": [
        {
          "domain": "feodotracker.abuse.ch",
          "nodes": [
            "Feodo Tracker"
          ]
        },
        {
          "domain": "mcp.your-env.scanner.dev",
          "nodes": [
            "Scanner MCP"
          ]
        },
        {
          "domain": "otx.alienvault.com",
          "nodes": [
            "OTX Pulse Search"
          ]
        },
        {
          "domain": "threatfox-api.abuse.ch",
          "nodes": [
            "ThreatFox IOC Lookup"
          ]
        }
      ],
      "credentialTypes": [
        {
          "type": "anthropicapi",
          "nodes": [
            "Anthropic Chat Model"
          ]
        },
        {
          "type": "httpbearerauth",
          "nodes": [
            "Scanner MCP"
          ]
        },
        {
          "type": "httpheaderauth",
          "nodes": [
            "OTX Pulse Search",
            "ThreatFox IOC Lookup",
            "Webhook"
          ]
        },
        {
          "type": "slackapi",
          "nodes": [
            "Send a message"
          ]
        }
      ]
    },
    "graph": {
      "nodes": [
        {
          "id": "Anthropic Chat Model",
          "findings": [
            "AA-005-05"
          ],
          "severity": "medium",
          "label": "Anthropic Chat Model",
          "kind": "model",
          "nodeType": "@n8n/n8n-nodes-langchain.lmChatAnthropic"
        },
        {
          "id": "Alert Triage Agent",
          "findings": [
            "AA-003-02",
            "AA-004-03",
            "AA-005-05",
            "TG-100-01"
          ],
          "severity": "critical",
          "label": "Alert Triage Agent",
          "kind": "ai-agent",
          "nodeType": "@n8n/n8n-nodes-langchain.agent"
        },
        {
          "id": "Scanner MCP",
          "findings": [],
          "severity": null,
          "label": "Scanner MCP",
          "kind": "tool",
          "nodeType": "@n8n/n8n-nodes-langchain.mcpClientTool"
        },
        {
          "id": "ThreatFox IOC Lookup",
          "findings": [
            "AA-008-06"
          ],
          "severity": "medium",
          "label": "ThreatFox IOC Lookup",
          "kind": "tool",
          "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest"
        },
        {
          "id": "OTX Pulse Search",
          "findings": [
            "AA-008-06"
          ],
          "severity": "medium",
          "label": "OTX Pulse Search",
          "kind": "tool",
          "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest"
        },
        {
          "id": "Feodo Tracker",
          "findings": [
            "AA-008-06"
          ],
          "severity": "medium",
          "label": "Feodo Tracker",
          "kind": "tool",
          "nodeType": "@n8n/n8n-nodes-langchain.toolHttpRequest"
        },
        {
          "id": "Send a message",
          "findings": [
            "AA-004-03",
            "TG-100-01"
          ],
          "severity": "critical",
          "label": "Send a message",
          "kind": "high-impact-action",
          "nodeType": "n8n-nodes-base.slack"
        },
        {
          "id": "Webhook",
          "findings": [
            "AA-003-02",
            "AA-006-04",
            "TG-100-01"
          ],
          "severity": "critical",
          "label": "Webhook",
          "kind": "untrusted-input",
          "nodeType": "n8n-nodes-base.webhook"
        },
        {
          "id": "credential:anthropicapi",
          "findings": [],
          "severity": null,
          "label": "anthropicapi",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "credential:httpbearerauth",
          "findings": [],
          "severity": null,
          "label": "httpbearerauth",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "credential:httpheaderauth",
          "findings": [],
          "severity": null,
          "label": "httpheaderauth",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "credential:slackapi",
          "findings": [],
          "severity": null,
          "label": "slackapi",
          "kind": "credential",
          "nodeType": "credential"
        },
        {
          "id": "domain:feodotracker.abuse.ch",
          "findings": [],
          "severity": null,
          "label": "feodotracker.abuse.ch",
          "kind": "external-domain",
          "nodeType": "domain"
        },
        {
          "id": "domain:mcp.your-env.scanner.dev",
          "findings": [],
          "severity": null,
          "label": "mcp.your-env.scanner.dev",
          "kind": "external-domain",
          "nodeType": "domain"
        },
        {
          "id": "domain:otx.alienvault.com",
          "findings": [],
          "severity": null,
          "label": "otx.alienvault.com",
          "kind": "external-domain",
          "nodeType": "domain"
        },
        {
          "id": "domain:threatfox-api.abuse.ch",
          "findings": [],
          "severity": null,
          "label": "threatfox-api.abuse.ch",
          "kind": "external-domain",
          "nodeType": "domain"
        }
      ],
      "edges": [
        {
          "from": "Alert Triage Agent",
          "to": "Anthropic Chat Model",
          "kind": "model",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "Send a message",
          "kind": "flow",
          "risk": true,
          "findings": [
            "TG-100-01",
            "AA-004-03"
          ]
        },
        {
          "from": "Alert Triage Agent",
          "to": "Scanner MCP",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "ThreatFox IOC Lookup",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "OTX Pulse Search",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Alert Triage Agent",
          "to": "Feodo Tracker",
          "kind": "tool",
          "risk": false,
          "findings": []
        },
        {
          "from": "Webhook",
          "to": "Alert Triage Agent",
          "kind": "flow",
          "risk": true,
          "findings": [
            "TG-100-01",
            "AA-003-02"
          ]
        },
        {
          "from": "Anthropic Chat Model",
          "to": "credential:anthropicapi",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Scanner MCP",
          "to": "credential:httpbearerauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "OTX Pulse Search",
          "to": "credential:httpheaderauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "ThreatFox IOC Lookup",
          "to": "credential:httpheaderauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Webhook",
          "to": "credential:httpheaderauth",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Send a message",
          "to": "credential:slackapi",
          "kind": "credential",
          "risk": false,
          "findings": []
        },
        {
          "from": "Feodo Tracker",
          "to": "domain:feodotracker.abuse.ch",
          "kind": "outbound",
          "risk": false,
          "findings": []
        },
        {
          "from": "Scanner MCP",
          "to": "domain:mcp.your-env.scanner.dev",
          "kind": "outbound",
          "risk": false,
          "findings": []
        },
        {
          "from": "OTX Pulse Search",
          "to": "domain:otx.alienvault.com",
          "kind": "outbound",
          "risk": false,
          "findings": []
        },
        {
          "from": "ThreatFox IOC Lookup",
          "to": "domain:threatfox-api.abuse.ch",
          "kind": "outbound",
          "risk": false,
          "findings": []
        }
      ]
    },
    "findings": [
      {
        "ruleId": "TG-100",
        "group": "critical-paths",
        "severity": "critical",
        "title": "A prompt-injection source can steer a privileged action through the AI agent",
        "description": "Content from an untrusted trigger reaches the model and the model can reach a privileged external action, with no validation or human approval anywhere on the path. A crafted input can therefore choose or influence the final action.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message",
          "Webhook"
        ],
        "evidence": {
          "path": [
            "Webhook",
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Break the chain: validate and constrain the input before the model, and require an explicit human approval step before the privileged action. Treat all trigger content as data, never as instructions.",
        "references": [
          "OWASP LLM01: Prompt Injection",
          "OWASP LLM06: Excessive Agency",
          "MITRE ATLAS AML.T0051: LLM Prompt Injection"
        ],
        "id": "TG-100-01"
      },
      {
        "ruleId": "AA-003",
        "group": "critical-paths",
        "severity": "high",
        "title": "Untrusted input can reach a model without a visible validation boundary",
        "description": "Untrusted input reaches a model node with no visible validation boundary on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Webhook"
        ],
        "evidence": {
          "detail": "Path: Webhook + Alert Triage Agent.",
          "path": [
            "Webhook",
            "Alert Triage Agent"
          ]
        },
        "remediation": "Add a deterministic validation step before the model. Enforce size, type and allowlist rules, separate instructions from data, and test direct and indirect prompt injection cases.",
        "references": [
          "OWASP LLM01: Prompt Injection"
        ],
        "id": "AA-003-02"
      },
      {
        "ruleId": "AA-004",
        "group": "approval-gaps",
        "severity": "high",
        "title": "A model can reach an external write action without an approval step",
        "description": "A model node can reach an external write action with no approval step on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message"
        ],
        "evidence": {
          "detail": "Path: Alert Triage Agent + Send a message.",
          "path": [
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Require explicit human approval for messages, writes, deletions, purchases, account changes and other high-impact actions. Use least-privilege credentials for the final action.",
        "references": [
          "OWASP LLM06: Excessive Agency"
        ],
        "id": "AA-004-03"
      },
      {
        "ruleId": "AA-006",
        "group": "excessive-agency",
        "severity": "high",
        "title": "No rate or cost boundary was detected before model usage",
        "description": "No rate or cost boundary was detected between external input and model usage.",
        "affectedNodes": [
          "Webhook"
        ],
        "evidence": {
          "detail": "External inputs: Webhook."
        },
        "remediation": "Add per-user and per-origin limits, a maximum input size, a model-call budget, timeouts, and a bounded retry policy.",
        "references": [
          "OWASP LLM10: Unbounded Consumption"
        ],
        "id": "AA-006-04"
      },
      {
        "ruleId": "AA-005",
        "group": "excessive-agency",
        "severity": "medium",
        "title": "No structured model-output validation was detected",
        "description": "Model output is not validated against a structured schema before reuse.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Anthropic Chat Model"
        ],
        "evidence": {
          "detail": "Model-related nodes: Anthropic Chat Model, Alert Triage Agent."
        },
        "remediation": "Validate model output against a strict schema before it is parsed, stored or passed to another tool. Reject unknown fields and unsafe values.",
        "references": [
          "OWASP LLM05: Improper Output Handling"
        ],
        "id": "AA-005-05"
      },
      {
        "ruleId": "AA-008",
        "group": "operational",
        "severity": "medium",
        "title": "Outbound requests do not show an explicit timeout or retry policy",
        "description": "Outbound HTTP nodes have no explicit timeout or retry policy.",
        "affectedNodes": [
          "Feodo Tracker",
          "OTX Pulse Search",
          "ThreatFox IOC Lookup"
        ],
        "evidence": {
          "detail": "HTTP nodes: ThreatFox IOC Lookup, OTX Pulse Search, Feodo Tracker."
        },
        "remediation": "Set short timeouts and bounded retries with backoff. Make write actions idempotent so a retry cannot publish or charge twice.",
        "references": [
          "NIST AI RMF: Measure and Manage"
        ],
        "id": "AA-008-06"
      },
      {
        "ruleId": "AA-010",
        "group": "operational",
        "severity": "low",
        "title": "No workflow-level failure route was detected",
        "description": "The workflow has no error workflow or explicit failure route.",
        "affectedNodes": [],
        "evidence": {
          "detail": "The export has no errorWorkflow setting or explicit error node."
        },
        "remediation": "Add a failure route that records the error, alerts the operator and prevents partial actions from being treated as success.",
        "references": [
          "NIST AI RMF: Manage"
        ],
        "id": "AA-010-07"
      }
    ],
    "openFindings": [
      {
        "ruleId": "TG-100",
        "group": "critical-paths",
        "severity": "critical",
        "title": "A prompt-injection source can steer a privileged action through the AI agent",
        "description": "Content from an untrusted trigger reaches the model and the model can reach a privileged external action, with no validation or human approval anywhere on the path. A crafted input can therefore choose or influence the final action.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message",
          "Webhook"
        ],
        "evidence": {
          "path": [
            "Webhook",
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Break the chain: validate and constrain the input before the model, and require an explicit human approval step before the privileged action. Treat all trigger content as data, never as instructions.",
        "references": [
          "OWASP LLM01: Prompt Injection",
          "OWASP LLM06: Excessive Agency",
          "MITRE ATLAS AML.T0051: LLM Prompt Injection"
        ],
        "id": "TG-100-01"
      },
      {
        "ruleId": "AA-003",
        "group": "critical-paths",
        "severity": "high",
        "title": "Untrusted input can reach a model without a visible validation boundary",
        "description": "Untrusted input reaches a model node with no visible validation boundary on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Webhook"
        ],
        "evidence": {
          "detail": "Path: Webhook + Alert Triage Agent.",
          "path": [
            "Webhook",
            "Alert Triage Agent"
          ]
        },
        "remediation": "Add a deterministic validation step before the model. Enforce size, type and allowlist rules, separate instructions from data, and test direct and indirect prompt injection cases.",
        "references": [
          "OWASP LLM01: Prompt Injection"
        ],
        "id": "AA-003-02"
      },
      {
        "ruleId": "AA-004",
        "group": "approval-gaps",
        "severity": "high",
        "title": "A model can reach an external write action without an approval step",
        "description": "A model node can reach an external write action with no approval step on the path.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Send a message"
        ],
        "evidence": {
          "detail": "Path: Alert Triage Agent + Send a message.",
          "path": [
            "Alert Triage Agent",
            "Send a message"
          ]
        },
        "remediation": "Require explicit human approval for messages, writes, deletions, purchases, account changes and other high-impact actions. Use least-privilege credentials for the final action.",
        "references": [
          "OWASP LLM06: Excessive Agency"
        ],
        "id": "AA-004-03"
      },
      {
        "ruleId": "AA-006",
        "group": "excessive-agency",
        "severity": "high",
        "title": "No rate or cost boundary was detected before model usage",
        "description": "No rate or cost boundary was detected between external input and model usage.",
        "affectedNodes": [
          "Webhook"
        ],
        "evidence": {
          "detail": "External inputs: Webhook."
        },
        "remediation": "Add per-user and per-origin limits, a maximum input size, a model-call budget, timeouts, and a bounded retry policy.",
        "references": [
          "OWASP LLM10: Unbounded Consumption"
        ],
        "id": "AA-006-04"
      },
      {
        "ruleId": "AA-005",
        "group": "excessive-agency",
        "severity": "medium",
        "title": "No structured model-output validation was detected",
        "description": "Model output is not validated against a structured schema before reuse.",
        "affectedNodes": [
          "Alert Triage Agent",
          "Anthropic Chat Model"
        ],
        "evidence": {
          "detail": "Model-related nodes: Anthropic Chat Model, Alert Triage Agent."
        },
        "remediation": "Validate model output against a strict schema before it is parsed, stored or passed to another tool. Reject unknown fields and unsafe values.",
        "references": [
          "OWASP LLM05: Improper Output Handling"
        ],
        "id": "AA-005-05"
      },
      {
        "ruleId": "AA-008",
        "group": "operational",
        "severity": "medium",
        "title": "Outbound requests do not show an explicit timeout or retry policy",
        "description": "Outbound HTTP nodes have no explicit timeout or retry policy.",
        "affectedNodes": [
          "Feodo Tracker",
          "OTX Pulse Search",
          "ThreatFox IOC Lookup"
        ],
        "evidence": {
          "detail": "HTTP nodes: ThreatFox IOC Lookup, OTX Pulse Search, Feodo Tracker."
        },
        "remediation": "Set short timeouts and bounded retries with backoff. Make write actions idempotent so a retry cannot publish or charge twice.",
        "references": [
          "NIST AI RMF: Measure and Manage"
        ],
        "id": "AA-008-06"
      },
      {
        "ruleId": "AA-010",
        "group": "operational",
        "severity": "low",
        "title": "No workflow-level failure route was detected",
        "description": "The workflow has no error workflow or explicit failure route.",
        "affectedNodes": [],
        "evidence": {
          "detail": "The export has no errorWorkflow setting or explicit error node."
        },
        "remediation": "Add a failure route that records the error, alerts the operator and prevents partial actions from being treated as success.",
        "references": [
          "NIST AI RMF: Manage"
        ],
        "id": "AA-010-07"
      }
    ],
    "preExistingFindingIds": [
      "TG-100-01",
      "AA-003-02",
      "AA-004-03",
      "AA-006-04",
      "AA-005-05",
      "AA-010-07"
    ]
  },
  "limitations": [
    "This receipt compares exported JSON and a supplied staging record. It does not inspect production credential scope or external service authorization.",
    "Runtime evidence is accepted only when its canonical workflow fingerprint matches the candidate in this receipt.",
    "Local runtime receipts are reproducible evidence records, not cryptographically signed third-party attestations.",
    "A passing receipt records evidence for the tested policy and contract. It is not a penetration test, compliance certificate or security guarantee.",
    "Node names, node types, public domains and credential types can appear in the receipt. Prompt text, parameter values and credential values are omitted.",
    "Automatic findings remain review signals until a person records a manual review status. A score or clean static result is not a vulnerability verdict.",
    "Instance configuration, published-workflow identity, installed package versions and production permissions require separate environment evidence."
  ]
}