{
  "schema": "longtermcapabilities-agentic-security-review/v1",
  "version": "1.64.0",
  "releaseId": "lts-1.64.0-upgrade-safe-rewrites-and-privacy-erasure-integrity",
  "generated": "2026-08-03T20:40:00Z",
  "reviewDate": "2026-08-01",
  "path": "/agentic-ai/security-assurance/",
  "domains": [
    {
      "id": "intent",
      "name": "Objective and instruction integrity",
      "question": "Can untrusted content redirect the system away from the approved objective or alter higher-priority instructions?",
      "minimum_evidence": "Instruction hierarchy, trust labels, injection cases, refusal behavior, and a reviewed override path."
    },
    {
      "id": "identity",
      "name": "Principal, workload, and delegation identity",
      "question": "Can every consequential action be connected to an authenticated principal, executing workload, and bounded delegation?",
      "minimum_evidence": "Identity chain, token audience, scope, expiry, revocation, and non-repudiation record."
    },
    {
      "id": "authorization",
      "name": "External authorization",
      "question": "Is authority enforced outside model reasoning and rechecked at the resource and action boundary?",
      "minimum_evidence": "Policy decision, resource constraint, tenant boundary, amount or consequence limit, and denied-action tests."
    },
    {
      "id": "tools",
      "name": "Tools and side effects",
      "question": "Can the system distinguish a proposed call, accepted request, completed operation, and verified durable effect?",
      "minimum_evidence": "Versioned tool contract, idempotency strategy, typed errors, reconciliation, and independent effect verification."
    },
    {
      "id": "memory",
      "name": "State and memory integrity",
      "question": "Can untrusted or stale state persist, cross tenants, or silently change later decisions?",
      "minimum_evidence": "Provenance, write authority, isolation, retention, invalidation, replay, and poisoning tests."
    },
    {
      "id": "supply-chain",
      "name": "Agent and dependency supply chain",
      "question": "Are models, prompts, skills, tools, servers, remote agents, packages, and policies versioned and approved?",
      "minimum_evidence": "Inventory, signatures or trusted provenance, compatibility policy, update review, and rollback capability."
    },
    {
      "id": "communications",
      "name": "Agent-to-agent communications",
      "question": "Can a remote or peer agent impersonate a trusted actor, exceed its advertised skill, or inject untrusted artifacts?",
      "minimum_evidence": "Transport identity, capability discovery, per-skill authorization, message schema, content trust label, and counterparty allowlist."
    },
    {
      "id": "containment",
      "name": "Containment and independent stop",
      "question": "Can an operator pause, revoke, drain, and recover without depending on the same compromised control path?",
      "minimum_evidence": "Independent credential revocation, queue pause, gateway disablement, durable state, and tested restoration path."
    },
    {
      "id": "observability",
      "name": "Traceability and detection",
      "question": "Can reviewers reconstruct the decision path without collecting unnecessary confidential payloads?",
      "minimum_evidence": "Task, identity, version, policy, tool, effect, state, human-decision, budget, and stop-reason correlation."
    },
    {
      "id": "human-authority",
      "name": "Human authority and accountable exception handling",
      "question": "Are approval, appeal, override, residual-risk acceptance, and final stopping owned by named human roles?",
      "minimum_evidence": "Decision rights, reviewer competence, queue limits, escalation, expiry, and exception audit record."
    }
  ],
  "boundary": "Public-safe review structure only; not a security assessment, score, certification, or production approval."
}