From 8a7b7c0c2322c927199df89460b6e40989252ce2 Mon Sep 17 00:00:00 2001 From: Adam Lin Date: Mon, 24 Aug 2026 16:39:18 +0800 Subject: [PATCH] fix(ai-agent): complete the ATR category mapping and repair its target reference Two defects in the artifact merged in #428, found while building the follow-on catalogs. The target reference does not resolve. `target-reference.reference-id` and the matching entry in `metadata.mapping-references` both say `ATR-AI-AGENT-CAP`, but the capability catalog's `metadata.id` is `ATR-AI-AGENT-CAPABILITY-CATALOG`. Per the `#MappingReference` doc comment, when `url` is absent the id is the referenced artifact's `metadata.id`, so as merged this mapping points at nothing. Both occurrences now use the real id. The mapping is a category short. ATR's `rules/` directory on main carries ten detection categories; this document maps nine. `model-security` was added upstream after #428 merged and never got an entry, so the artifact silently under-reports its own coverage. Added, with the honest caveat: only the behaviour-extraction rules in that category relate to a capability this catalog models, and the rationale says so rather than reaching for an adjacent one. The capabilities the rest of the category needs are a separate proposal. Also drops the word "nine" from the description. Not changed to "ten": a count in prose goes stale the next time upstream adds a category, which is exactly how this one became wrong. Verified: TestSchemaValidation passes, and every capability id referenced by the mapping now resolves against the capability catalog. Signed-off-by: Adam Lin --- ...tr-categories-to-capabilities-mapping.yaml | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/examples/ai-agent/atr-categories-to-capabilities-mapping.yaml b/examples/ai-agent/atr-categories-to-capabilities-mapping.yaml index 98e0c4f8..9b55687b 100644 --- a/examples/ai-agent/atr-categories-to-capabilities-mapping.yaml +++ b/examples/ai-agent/atr-categories-to-capabilities-mapping.yaml @@ -7,7 +7,7 @@ metadata: description: > Maps Agent Threat Rules (ATR) detection rule categories to the AI agent capabilities that create the opportunity for each category of threat. - The source artifact is the ATR rule corpus, grouped by its nine detection + The source artifact is the ATR rule corpus, grouped by its detection categories; the target artifact is the AI Agent Capability Catalog. Relationships are expressed as relates-to following the convention that external cross-references are refined by downstream consumers in their @@ -30,7 +30,7 @@ metadata: Open MIT detection standard for AI agent threats. Rules are grouped into detection categories under rules/; the reference-ids below are those category identifiers. - - id: ATR-AI-AGENT-CAP + - id: ATR-AI-AGENT-CAPABILITY-CATALOG title: AI Agent Capability Catalog version: "0.1.0" description: > @@ -41,7 +41,7 @@ source-reference: reference-id: ATR entry-type: Control target-reference: - reference-id: ATR-AI-AGENT-CAP + reference-id: ATR-AI-AGENT-CAPABILITY-CATALOG entry-type: Capability remarks: > Each source entry-id is an ATR rule category. Targets are capability ids in @@ -205,3 +205,17 @@ mappings: over-privileged skills, which can only execute because the agent loads and runs third-party skills and plugins with its own privileges. + + - id: MAP-model-security + source: model-security + relationship: relates-to + targets: + - entry-id: CAP-MODEL-INFERENCE + strength: 6 + confidence-level: Medium + rationale: > + Behaviour-extraction rules detect systematic probing of decision + boundaries and system prompts, which depends on the agent exposing + model inference to callers. The remaining rules in this category + address the model supply chain, which this capability catalog does + not yet model.