APRF Threat Intelligence Map

Ensure every production agent has an approved, documented operating boundary so no agent runs unaccounted for.

Prevent autonomous agents from executing beyond approved operational limits.

Give operators a reliable means to halt agent execution when it behaves unsafely or is under attack.

Ensure agent-to-agent handoffs authenticate the peer and carry only scoped, least-privilege capabilities.

Detect conflicting or policy-violating agent goals before a plan is allowed to execute.

Validate new agent behaviour in an isolated environment before it can act on production systems.

Establish accountable ownership for every production agent across the teams that operate it.

Ensure no production AI endpoint serves an unauthenticated caller.

Ensure every service-to-service and MCP connection proves a strong machine identity rather than a shared static secret.

Prevent takeover of AI control planes through compromised administrator credentials.

Preserve the end user's identity through agent and tool hops so downstream authorization is evaluated against the real principal.

Limit the useful lifetime of agent and tool credentials so leaked material expires quickly.

Ensure self-hosted inference runtimes authenticate as attested workloads rather than with embedded static secrets.

Ensure every AI feature, tool call, and retrieval is authorized server-side and never by model output alone.

Prevent one tenant's data, memory, or retrieval context from reaching another tenant.

Constrain what an agent identity is permitted to do so that a compromised agent has limited reach.

Enforce attribute-based restrictions so sensitive document classes cannot enter retrieval or context without authorization.

Express tool and model access rules as reviewable, testable code rather than ad hoc configuration.

Detect and remove privilege that high-privilege agent identities accumulate over time.

Guarantee that a known-good prompt and model state can be restored after a harmful or compromised change.

Ensure the responder on shift can actually reverse a harmful AI change under incident conditions.

Verify that the rollback capability actually works before it is needed in an incident.

Reduce time-to-recovery by making rollback a single low-error operation.

Allow new agent behaviour to be disabled instantly without a redeploy.

Automatically revert AI releases that degrade quality or safety beyond agreed thresholds.

Ensure the legal and regulatory obligations that apply to production AI are identified and owned.

Tie each in-scope AI obligation to the concrete evidence artifact that demonstrates it.

Preserve an immutable record of AI control-plane changes for detection and investigation.

Test controls on a cadence and record the exceptions that testing reveals.

Give customers an accurate, published account of the AI controls in place.

Obtain independent verification of control effectiveness for the highest-capability systems.

Cap the financial and capacity impact of abusive or runaway AI usage.

Detect abnormal AI spend early enough to intervene.

Prevent retry and loop logic from amplifying a single request into unbounded cost.

Reduce the cost and capacity impact of repeated identical requests.

Reduce unit cost without silently degrading quality on low-risk tasks.

Keep AI unit economics under periodic review so structural cost drift is caught.

Bound context assembly so oversized or attacker-padded input cannot displace instructions or exhaust resources.

Ensure content entering the context is attributed to a source and authorized for the requesting principal.

Prevent secrets and regulated data from entering model context without an explicit approved policy.

Detect context saturation that degrades answer quality or signals abuse.

Ensure compaction and summarization do not silently discard facts that decisions depend on.

Make untrusted content structurally distinguishable from system instructions.

Ensure prompts, models, and tools reach production only through a reviewed promotion path.

Maintain an attributable record of every production AI artifact change.

Make AI infrastructure and configuration reviewable and reproducible rather than manually mutated.

Limit the population exposed to a new AI change until it is proven healthy.

Ensure the models and tools validated in test are the ones actually serving production traffic.

Prevent inconsistent or partially migrated retrieval indexes from serving production traffic.

Establish accountable ownership and version control over the corpora that ground production answers.

Ensure data used for evaluation and fine-tuning comes from known, vetted sources.

Prevent unvetted feedback or memory from being promoted into content that shapes future answers.

Detect stale or incomplete corpora before they degrade grounded answers.

Detect divergence between offline and online pipelines that silently degrades results.

Document dataset purpose, source, and PII handling so downstream reuse is an informed decision.

Make the controlled route to production the easiest route, so teams do not build around it.

Let builders detect control failures before merge rather than at release.

Make safe configuration the starting point for new agent, RAG, and MCP services.

Let builders run evaluations before opening a pull request.

Measure whether the paved road is actually being used.

Give the AI platform a named owner and a support channel so problems have somewhere to go.

Detect quality and safety regressions in critical journeys before they reach users.

Ensure releases cannot proceed when quality or safety metrics fall below agreed minimums.

Observe real production outcomes, including safety refusals, rather than relying on pre-release testing alone.

Compare a candidate AI change against production behaviour before it serves users.

Ensure adversarial robustness is measured on its own and not averaged away by aggregate quality scores.

Apply human judgement to outputs on a cadence, where automated metrics cannot recognize the harm.

Ensure grounded answers carry verifiable source attribution so claims can be checked.

Make it possible to reconstruct how a specific production AI outcome was reached.

Prevent explanation and rationale surfaces from becoming a disclosure channel.

Give users an intelligible reason for material automated decisions that affect them.

Map formal explainability obligations to the regulated features they apply to.

Make the behavioural effect of a model or prompt change reviewable rather than inferred.

Require a human decision before an AI system performs a high-impact or irreversible action.

Record who approved each high-impact AI action, on what evidence, and with what outcome.

Ensure no alternate agent, API, or tool path can perform a gated action without approval.

Require two independent human authorizations before irreversible high-severity actions.

Give approvers the context needed to make approval a real decision rather than a reflex.

Keep approval queues fast enough that teams do not route around the gate.

Ensure responders have prepared procedures for AI-specific incident classes.

Ensure on-call responders can actually stop AI activity during an incident.

Page responders on safety and quality signals, not only on infrastructure health.

Convert incident learning into owned, tracked control improvements.

Define in advance when an AI-related event requires customer notification.

Rehearse AI-specific incident response before a real event tests it.

Eliminate unauthenticated public exposure of AI data stores and control planes.

Bound the exposure window for known vulnerabilities in AI runtime environments.

Restrict outbound reachability from agent and tool runtimes to an approved set of destinations.

Prevent one tenant on shared AI accelerators from reading or starving another.

Ensure only cryptographically verified AI artifacts are allowed to run in production.

Catch insecure infrastructure defaults before they are deployed.

Prevent AI memory from being read or influenced across tenant and user boundaries.

Ensure AI memory is retained only as long as policy allows and can actually be deleted.

Ensure only authorized principals and validated content can write to durable AI memory.

Make tampering with critical memory records detectable.

Verify that memory write and retrieval controls actually resist poisoning attempts.

Prevent transient session content from becoming durable knowledge without an explicit promotion decision.

Ensure production behaviour comes from an explicitly chosen, evaluated model version.

Require evaluation evidence before any model change is promoted to production.

Manage model and embedding deprecation before a provider withdrawal forces it.

Grant each workload only the model capabilities it actually needs.

Review the license and provenance of open-weight and fine-tuned models before adoption.

Maintain an accurate inventory of the models running in production and their intended use.

Make the full AI execution path observable end to end for detection and investigation.

Prevent observability pipelines from becoming a secondary store of sensitive data.

Enable safe reproduction of failed AI interactions without exposing production data.

Turn observed production failures into evaluation cases.

Present AI latency, error, and quality burn against SLOs in one place.

Attribute AI consumption precisely enough to detect abuse and runaway usage.

Establish the organization's binding boundary for acceptable and prohibited AI use.

Keep AI risk posture visible to the leadership that can fund and mandate remediation.

Assign named owners to the APRF domains that matter for each production AI system.

Feed incidents and evaluation failures into a tracked improvement backlog.

Record accepted control gaps with an owner and an expiry rather than leaving them implicit.

Independently sample APRF evidence to confirm that claimed controls are real.

Define the availability and latency commitment for critical AI user journeys.

Expose latency, error, and AI quality metrics so degradation is measurable.

Alert when SLO burn indicates the system is degrading beyond agreed limits.

Use error budgets to slow release velocity when AI reliability is degrading.

Validate that the system withstands deliberately expensive prompts and agent loops.

Measure streaming-specific latency so perceived responsiveness is not invisible to SLOs.

Present AI operational metrics in near real time so degradation is seen as it happens.

Know which data classes reach models so sensitive classes can be handled under explicit rules.

Ensure data subject deletion and export actually reach AI memory, traces, and logs.

Prevent regulated workloads from being processed outside their permitted jurisdiction.

Remove or tokenize high-sensitivity fields before they reach a model.

Ensure third-party model provider terms do not permit training on or over-retaining production data.

Assess privacy and rights impact before a major AI feature reaches production.

Make the exact prompt serving production identifiable, attributable, and immutable.

Ensure prompt changes are reviewed and backed by evaluation evidence before release.

Allow rollback to a prior prompt version without redeploying unrelated services.

Keep secrets and personal data out of prompt source and templates.

Catch injection-prone and unsafe prompt constructs before they reach production.

Measure the real impact of high-traffic prompt changes before full rollout.

Prevent a slow or failing dependency from exhausting capacity or amplifying cost.

Keep critical user journeys functional when the AI path is unavailable.

Prevent tool-using workflows from reporting success when steps have silently failed.

Ensure the artifacts required to restore AI service survive a destructive event.

Set explicit recovery time and recovery point objectives for business-critical AI services.

Stop a failing AI provider from cascading into total service failure.

Remove single-provider dependency for critical AI journeys without lowering the quality bar.

Document how critical AI-dependent business processes continue when AI is unavailable.

Rehearse continuity, including full provider loss, before it is tested by a real outage.

Deliberately exercise AI dependency failure modes in production-like conditions.

Keep standby inference capacity ready where self-hosted models are business-critical.

Back multi-provider continuity with contractual commitments, not just technical routing.

Define what constitutes unsafe output and behaviour for this specific product domain.

Block releases that fail the organization's stated safety bar.

Ensure users know when they are interacting with an AI system.

Measure disparate outcomes on high-stakes automated decision paths.

Apply human judgement to safety edge cases that automated evaluation classifies poorly.

Test whether safety controls hold end to end, from jailbreak attempt through to real-world harm.

Ensure production AI artifacts come from a verified source and have not been tampered with.

Ensure every external tool, MCP server, and plugin in production is known, pinned, and reviewed.

Block deployment of AI artifacts carrying known exploitable vulnerabilities.

Enforce at the deployment boundary that only approved, signed AI artifacts can run.

Verify artifact signatures against build provenance at deploy time.

Record the composition of each production model pin so affected deployments can be found quickly.

Prevent untrusted model input from being treated as an authorization decision for privileged actions.

Ensure model output cannot cause side effects until it has been validated against an explicit schema or policy.

Prevent releases that regress the system's resistance to jailbreak, abuse, and injection.

Prevent the model and agent path from becoming an unrestricted proxy into internal systems and networks.

Validate defences against multi-turn and retrieval-borne indirect prompt injection.

Prevent malicious or unsafe multimodal payloads from reaching the model or downstream systems.

Detect attempts to exfiltrate sensitive data through AI request and response paths.

Keep production secrets out of prompts, source control, and notebooks.

Prevent secrets from being persisted into logs and traces.

Ensure AI credentials are narrowly scoped, rotatable, and never shipped to clients.

Detect committed secrets before they reach a shared repository.

Constrain where a leaked runtime credential can actually be used from.

Prevent secrets and sensitive data from being baked into models or published corpora.

Ensure tool execution authority comes from server-side policy, never from model output.

Restrict each agent to a fixed, approved set of tools it cannot expand at runtime.

Require an additional gate before high-impact tools are permitted to execute.

Prevent unvalidated model-generated arguments from reaching an executor.

Ensure tool catalog definitions are authentic and unchanged since they were reviewed.

Let destructive tool behaviour be validated without producing irreversible effects.

Bound how much damage a single agent or tool can do within a given window.