Your agents against the OWASP® Top 10 for Agentic Applications — dashboard map and tour

Thread owasp-agentic (prompt: owasp-agentic-prompt.md). Built on the close reading in research/owasp/agentic-top10-reading.md and the license check in research/owasp/README.md. The tour runs on c125's tour runner; this file is its content and its screen design, plus what the c123 framework detail page borrows from it.

Stance (F1, F2): each stop shows the reader their own agents through one risk, says plainly what Qpoint enforces, observes and records, and hands back the part that's theirs. No score, no percentage, no "compliant".

1. Each risk as a question about your fleet

The lab (/pages/phase4/mock) has policies, findings, compliance, endpoints, teams and Policy Config, but no inventory, identity, activity or data-protection pages. Stops 1–7 and 10 land on qdash pages. That is a decision (§6).

2. Brainstorm: new surfaces the paper argues for

Ranked by how much of the paper each one illuminates. Details in the reading §6.

1. Blast radius panel on any inventory detail (MCP server, skill, model, harness): who and what touched it in the window, and the block action beside it. Serves ASI04 #8, ASI08, ASI10 #4. One panel, three stops.
2. "Has this happened to us?" Appendix D's 24 named incidents checked against the inventory: postmark-mcp — not in your fleet; Cursor below the fixed version — 4 endpoints. Makes the paper concrete in seconds. Needs version ranges per incident (curated, small).
3. Tool-descriptor drift: an MCP server's tool list hashed at approval, flagged when it changes. The "rug pull" that ASI02 and ASI04 both describe.
4. Expected vs observed on agent detail: the allow-list as a manifest, the observed tools and destinations beside it, deviations as findings.
5. Approval health on the approval policy: approval rate, median time-to-approve, bulk approvals. The paper's automation bias (ASI09) and governance drift (ASI08 ex.6).
6. Look-alike names flag in MCP, skill and tool inventories.
7. The paper rail on framework detail (§4).

3. Tour design

Arc (12 steps)

0. The map. The paper's "At a Glance" diagram, redrawn, with Qpoint's observation points on it (the endpoint and the wire) and each ASI placed where it lives. One OWASP sentence: observability is non-negotiable. Licensed CC BY-SA 4.0 as an adaptation, attributed. 1–10. One stop per risk (§1), each with 2–3 beats across pages.
1. What you've got. Counts by state across the ten (Enforced / Observed / Evidenced / Outside), then two actions: Track this framework (stages its policies at Observe, F8) and Export evidence.

Order. Paper order (ASI01→10) is familiar to the AppSec reader. A narrative order starts on solid ground and ends on the hard ones: 04 → 02 → 03 → 05 → 07 → 01 → 06 → 10 → 08 → 09 ("what's installed → what it does → as whom → where it runs → what it talks to → what it reads → what it remembers → how it drifts → how far it spreads → who signs off"). Recommendation: narrative order for the tour, paper order on framework detail; the tour panel always shows the ASI number so nobody loses their place.

Stop anatomy (one docked panel, the page stays live)

Mark liked it, 2026-10-27: the canvas artboard "A tour stop · ASI04 on MCP servers" (Main.dc.html on the concept canvas) is the reference for every stop. Its parts:

• the panel docked right, with the live page underneath;
• a highlight ring on the region that answers the question, plus a numbered callout;
• a step bar and the fit chip, with no percentage;
• the "for you" line, then a link to the paper page;
• the "Ask your fleet" question, then "Here's yours" numbers taken from the page;
• the paper's mitigations, numbered as the paper numbers them, each with a state chip, then a "Yours" line;
• one action, staging the policies at Observe, plus Next.

The page underneath is the real page with a highlight ring on the target region. The panel docks right (c125's composition: UxStickyBand header, UxPopover/UxHoverBox for the ring's callout).

┌ Tour · OWASP® Agentic Top 10 ───────────── 4 of 12 ┐
│ ASI04 · Agentic Supply Chain        [ Partial ▾ ]  │  fit chip (no %)
│                                                    │
│ Your agents assemble themselves at run time from   │  "for you" line,
│ other people's parts. Any of them can be an        │  our words
│ impostor.                                          │
│ Read ASI04 in the paper · p.18 ↗                   │  opens hosted PDF #page=19
│ ────────────────────────────────────────────────── │
│ ASK YOUR FLEET                                     │
│ What did my agents load this week that nobody      │
│ reviewed?                                          │
│                                                    │
│ HERE'S YOURS                         ◉ highlighted │  live numbers from
│ 3 MCP servers unsanctioned · 1 first seen today    │  the page underneath
│ 2 skills changed version since review              │
│ ────────────────────────────────────────────────── │
│ WHAT THE PAPER ASKS · WHAT QPOINT DOES             │  the paper's numbered
│ #1 Inventory, block untrusted  ● Observed          │  mitigations as chips;
│ #2 Allow-list and pin          ● Enforced · Finance│  hover = our paraphrase
│ #6 Re-check at run time        ● Observed          │  + page link
│ #7 Pin, staged rollout         ○ Off               │
│ #8 Kill switch                 ● Ready             │
│ YOURS: #4 prompts under version control · #9 …     │  Outside, said plainly
│ ────────────────────────────────────────────────── │
│ [ Stage P-MCP + P-PROVENANCE at Observe ]   Next → │  F8: stage, don't enforce
└────────────────────────────────────────────────────┘

Rules:

• "Here's yours" comes from the page's own data, never from tour copy. An empty fleet says so ("no MCP servers seen yet") and the stop still teaches (c108 honest states).
• Mitigation chips are the bridge to the paper. Number as in the paper, state from the customer's Policy Config, hover shows our paraphrase and "p.N ↗". Exact quotes only in the hover, attributed.
• "Yours" is never hidden. Every stop lists its Outside mitigations, and links the Red Teaming Manual where the paper asks for red-teaming.
• The only action is staging at Observe. The tour never enforces. Change impact follows in Policy Config.

Beats per stop

A stop can move across pages; the panel stays, the ring moves. ASI04, for example:

1. /inventory/mcp-servers, filtered to unsanctioned + first-seen: reveal.
2. MCP server detail → blast radius panel: how far (and the block action: the kill switch).
3. /policies P-MCP row: govern, with its state per scope.

The AI guide (c125 phase 4)

The same content as data drives the MCP tour guide: "walk me through ASI04 on my fleet" → navigates, highlights, reads the numbers, and answers "what's mine to do?" from the Outside list. The guide quotes the paper only from the per-mitigation quote field, so attribution travels with it.

4. What framework detail borrows (c123 scope 2)

Framework detail and the tour share one per-entry record, so the content is written once:

interface AgenticEntry {
  id: 'ASI01' | … | 'ASI10'
  title: string
  page: { printed: number; pdf: number }          // printed + 1
  forYou: string                                  // our words (F5)
  boundary: string                                // what it is not, our words
  question: string                                // "ask your fleet"
  crosswalk: { llm2025: string[]; llm2026: string[]; tcodes: string[]; aivss: string }
  mitigations: { n: number; ours: string; quote?: string; qpoint: 'enforced' | 'observed' | 'evidenced' | 'outside'; policyIds?: string[]; surface?: string }[]
  reveals: { route: string; target: string; metric: string }[]
  incidents: string[]                             // Appendix D names
  policyIds: string[]; procedural: boolean; note: string   // the existing fixture shape
}

The paper rail. On framework detail, each requirement row expands into two columns: left, ours (for-you line, coverage state, policies, evidence); right, the paper's section outline (Description · Examples · Scenarios · Mitigations 1–N · References) with each numbered mitigation carrying its Qpoint state chip. Click a mitigation: the hosted PDF opens at that page. That is "reference and illuminate the sections of the paper with the dashboard."

Fixture. The fit table in the reading §5 is ready to drop into governance-fixture.ts as a fourth framework (id: 'owasp-agentic', version: '2026', type: 'risk taxonomy', sourceTerm: 'risk'), when we decide it belongs (§6).

5. Attribution footer (tour panel and framework detail)

Risk entries and mitigation numbering: OWASP® Top 10 for Agentic Applications 2026, OWASP GenAI Security Project – Agentic Security Initiative, source, licensed CC BY-SA 4.0. Quoted passages are unchanged; the mapping to Qpoint is Qpoint's own. The OWASP® word mark is a service mark of OWASP Foundation, Inc.; OWASP does not endorse Qpoint.

6. Decisions for Mark

1. Is the Agentic Top 10 a tracked framework in v1? Ruled 2026-10-27: yes. It's v1's fourth framework (OWASP as one family). It's in the fixture as owasp-agentic, untracked, so the tour's "Track this framework" has something to do.
2. Tour order: narrative (recommended) or paper order.
3. Where the tour runs first: qdash (has every page it needs) or the lab (needs inventory, identity, activity and data-protection pages first). c125 plans to run tours on the lab's fixture worlds.
4. Which new surfaces to mock: blast radius and "has this happened to us?" carry the most stops.
5. Host the three OWASP PDFs on the design site and in qdash (allowed under CC BY-SA, with the footer above).