Skip to content

docs: add autonomy downgrade matrix template#47

Merged
jinsonvarghese merged 2 commits into
OWASP:mainfrom
Hinotoi-agent:docs/autonomy-downgrade-matrix
May 2, 2026
Merged

docs: add autonomy downgrade matrix template#47
jinsonvarghese merged 2 commits into
OWASP:mainfrom
Hinotoi-agent:docs/autonomy-downgrade-matrix

Conversation

@Hinotoi-agent
Copy link
Copy Markdown
Contributor

Summary

  • Adds an informative Autonomy Downgrade Matrix Template appendix for APTS-AL-025 and APTS-AL-026.
  • Links the template from the appendix index, Getting Started document map, Graduated Autonomy guidance, and Incident Response Integration.
  • Provides example downgrade triggers for scope uncertainty, customer-impact thresholds, tool/connector overreach, prompt-injection signals, model drift, audit gaps, incomplete handoffs, and incident-response activation.

Why

APTS already requires formal autonomy authorization and post-incident autonomy adjustment. This PR provides a practical implementation artifact for documenting downgrade triggers, temporary autonomy caps, required approval paths, evidence preservation, and re-authorization conditions before incidents occur.

Affected sections

  • standard/appendix/Autonomy_Downgrade_Matrix_Template.md
  • standard/README.md
  • standard/Getting_Started.md
  • standard/4_Graduated_Autonomy/README.md
  • standard/4_Graduated_Autonomy/Implementation_Guide.md
  • standard/appendix/Incident_Response_Integration.md

Contributing.md checklist

  • No overlapping open PR or issue was found for a dedicated autonomy downgrade matrix template.
  • Affected sections are listed above.
  • Formatting was checked with git diff --check.
  • Touched relative Markdown links were verified locally.
  • Markdown table validation and internal-link checks were run locally.
  • AI assistance was used to draft and validate this documentation change.

Notes

This appendix is informative and does not create or modify APTS requirements.

@jinsonvarghese
Copy link
Copy Markdown
Member

@Hinotoi-agent thanks for putting this together.

A few fixes needed in the Related Requirements section at the bottom of the template:

  1. APTS-MR-004 is the wrong requirement ID. The template lists APTS-MR-004: Prompt Injection Resistance, but MR-004 is actually "Configuration File Integrity Verification" (treating discovered config files as data, not directives). The correct reference for prompt injection is APTS-MR-018 (AI Model Input/Output Architectural Boundary) - that one covers the architectural boundary between trusted instructions and untrusted target-derived data, and includes a prompt-injection corpus test.
  2. Three requirement titles in the list don't match the standard:
    • APTS-SC-018 is listed as "Safety Control Verification After Incident" - the actual title is "Incident Containment and Recovery"
    • APTS-SC-009 is listed as "Emergency Stop / Kill Switch" - the actual title is "Kill Switch"
    • APTS-AL-018 is listed as "Incident Response During Testing" - the actual title is "Incident Response During Autonomous Testing"

@Hinotoi-agent
Copy link
Copy Markdown
Contributor Author

Thanks — fixed the Related Requirements list in 5f9ac452d3b72b95ba01cbd25fddb70ffa38e0ec.

Changed file:

  • standard/appendix/Autonomy_Downgrade_Matrix_Template.md

What changed:

  • Replaced the incorrect prompt-injection reference APTS-MR-004 with APTS-MR-018: AI Model Input/Output Architectural Boundary.
  • Corrected the requirement titles for APTS-SC-018, APTS-SC-009, and APTS-AL-018.

Validation:

git diff --check
uv run pytest -q  # no tests collected for this docs-only repo state
uv run ruff check .

git diff --check and ruff passed; pytest reported no collected tests for this docs-only change.

@jinsonvarghese
Copy link
Copy Markdown
Member

All four issues from the review are fixed. The requirement references now match the standard:

  • MR-018 (was MR-004) - correct
  • SC-018: Incident Containment and Recovery - correct
  • SC-009: Kill Switch - correct
  • AL-018: Incident Response During Autonomous Testing - correct

Good to merge.

@jinsonvarghese jinsonvarghese merged commit 7f9e6bd into OWASP:main May 2, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants