OWASP Agentic Top 10 — Grampus Control Mapping

How Grampus's built-in controls map to the OWASP Top 10 for Agentic Applications 2026 (released December 2025). Detection layers are probabilistic and best-effort; containment layers are deterministic and enforced outside the model.

OWASP item	Grampus control	Layer
ASI01 Goal hijacking / prompt injection	Taint-tracking policy (safety/taint.py) blocks egress/high-risk tools when untrusted data entered context — containment, works with the detector disabled	Containment
ASI01 (defense-in-depth)	Multi-layer injection detector (safety/injection.py): regex + heuristic + semantic, strict/balanced/permissive	Detection
ASI04 Supply chain (tools/skills)	MCP results tagged EXTERNAL_DATA provenance; sandbox-by-default execution (ADR-007); red-team framework (evaluation/red_team/) for pre-release attack testing	Containment + testing
ASI06 Memory poisoning	Non-negotiable write provenance + SHA-256 hashes (ADR-006), validator quarantine, trust scoring with decay, integrity auditor	Containment
Excessive agency	ActionGuard allow/denylists, per-turn and consecutive-call caps, cost budgets (BudgetExceededError), human-approval escalation	Containment
Sensitive data exposure	PII detector (log/redact/block) on input, tool I/O, and LLM output; taint egress rules stop untrusted-context exfiltration	Detection + containment
Insufficient logging	Append-only event log (ADR-005), OTEL spans incl. grampus.taint.violation attributes, behavior monitor	Observability

The containment model (Phase 16)

Every value entering the agent loop carries an integrity label derived from its provenance source type (SYSTEM 1.0 → EXTERNAL_DATA 0.3). Labels join conservatively — the lowest trust in a context wins — and a deterministic policy mediates every tool call:

# taint-policy.yaml
tool_classes:
  egress: [send_email, http_post, publish]
rules:
  - tool_classes: [egress]
    min_trust: 0.9      # user-input level; any tool/external data blocks egress
  - tools: [deploy]
    min_trust: 1.0      # system-initiated contexts only
default_action: block    # or `escalate` for human approval

from grampus.safety import SafetyPipeline, TaintGuard, TaintPolicy

pipeline = SafetyPipeline(
    taint_guard=TaintGuard(TaintPolicy.from_yaml("taint-policy.yaml")),
)

Research basis: CaMeL (arXiv 2503.18813, IEEE SaTML 2026) and FIDES (MSR, 2025). Grampus implements the FIDES-style subset — label propagation plus policy enforcement — not a full capability interpreter. Read the adaptive evaluation survey (arXiv 2606.26479) before writing guarantee language: out-of-band defenses raise the bar deterministically but are not a proof of security against every adaptive attack.