[{"data":1,"prerenderedAt":1242},["ShallowReactive",2],{"cycle-doc-design-c123-owasp-agentic-tour.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":19},{"id":5,"title":6},"c123","Compliance Frameworks",{"id":8,"label":9},"design","Design","owasp-agentic-tour.md","Your agents against the OWASP® Top 10 for Agentic Applications — dashboard map and tour",[13,14,15,16,17,18],"1. Each risk as a question about your fleet","2. Brainstorm: new surfaces the paper argues for","3. Tour design","4. What framework detail borrows (c123 scope 2)","5. Attribution footer (tour panel and framework detail)","6. Decisions for Mark",{"type":20,"children":21},"root",[22,76,95,101,618,638,643,648,737,742,749,794,811,817,845,884,913,925,930,973,979,984,1033,1039,1044,1049,1054,1065,1075,1122,1127,1161,1166,1237],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27,30,37,39,50,52,62,64,74],{"type":28,"value":29},"text","Thread ",{"type":23,"tag":31,"props":32,"children":34},"code",{"className":33},[],[35],{"type":28,"value":36},"owasp-agentic",{"type":28,"value":38}," (prompt: ",{"type":23,"tag":40,"props":41,"children":43},"a",{"href":42},"\u002Fcycles\u002Fdesign\u002Fc123\u002Fdoc\u002Fowasp-agentic-prompt",[44],{"type":23,"tag":31,"props":45,"children":47},{"className":46},[],[48],{"type":28,"value":49},"owasp-agentic-prompt.md",{"type":28,"value":51},"). Built on the close reading in ",{"type":23,"tag":40,"props":53,"children":55},{"href":54},"\u002Fcycles\u002Fdesign\u002Fc123\u002Fdoc\u002Fresearch\u002Fowasp\u002Fagentic-top10-reading",[56],{"type":23,"tag":31,"props":57,"children":59},{"className":58},[],[60],{"type":28,"value":61},"research\u002Fowasp\u002Fagentic-top10-reading.md",{"type":28,"value":63}," and the license check in ",{"type":23,"tag":40,"props":65,"children":67},{"href":66},"\u002Fcycles\u002Fdesign\u002Fc123\u002Fdoc\u002Fresearch\u002Fowasp\u002FREADME",[68],{"type":23,"tag":31,"props":69,"children":71},{"className":70},[],[72],{"type":28,"value":73},"research\u002Fowasp\u002FREADME.md",{"type":28,"value":75},". The tour runs on c125's tour runner; this file is its content and its screen design, plus what the c123 framework detail page borrows from it.",{"type":23,"tag":24,"props":77,"children":78},{},[79,85,87,93],{"type":23,"tag":80,"props":81,"children":82},"strong",{},[83],{"type":28,"value":84},"Stance (F1, F2):",{"type":28,"value":86}," each stop shows the reader ",{"type":23,"tag":88,"props":89,"children":90},"em",{},[91],{"type":28,"value":92},"their own",{"type":28,"value":94}," agents through one risk, says plainly what Qpoint enforces, observes and records, and hands back the part that's theirs. No score, no percentage, no \"compliant\".",{"type":23,"tag":96,"props":97,"children":99},"h2",{"id":98},"_1-each-risk-as-a-question-about-your-fleet",[100],{"type":28,"value":13},{"type":23,"tag":102,"props":103,"children":104},"table",{},[105,149],{"type":23,"tag":106,"props":107,"children":108},"thead",{},[109],{"type":23,"tag":110,"props":111,"children":112},"tr",{},[113,119,124,129,134,139,144],{"type":23,"tag":114,"props":115,"children":116},"th",{},[117],{"type":28,"value":118},"Stop",{"type":23,"tag":114,"props":120,"children":121},{},[122],{"type":28,"value":123},"Risk",{"type":23,"tag":114,"props":125,"children":126},{},[127],{"type":28,"value":128},"The question",{"type":23,"tag":114,"props":130,"children":131},{},[132],{"type":28,"value":133},"Where the answer is (qdash route · lab)",{"type":23,"tag":114,"props":135,"children":136},{},[137],{"type":28,"value":138},"What gets highlighted",{"type":23,"tag":114,"props":140,"children":141},{},[142],{"type":28,"value":143},"Govern (policies)",{"type":23,"tag":114,"props":145,"children":146},{},[147],{"type":28,"value":148},"Yours",{"type":23,"tag":150,"props":151,"children":152},"tbody",{},[153,198,242,292,342,399,448,492,538,576],{"type":23,"tag":110,"props":154,"children":155},{},[156,162,167,172,183,188,193],{"type":23,"tag":157,"props":158,"children":159},"td",{},[160],{"type":28,"value":161},"1",{"type":23,"tag":157,"props":163,"children":164},{},[165],{"type":28,"value":166},"ASI01 Goal Hijack",{"type":23,"tag":157,"props":168,"children":169},{},[170],{"type":28,"value":171},"When my agents read content from outside, what did they do next?",{"type":23,"tag":157,"props":173,"children":174},{},[175,181],{"type":23,"tag":31,"props":176,"children":178},{"className":177},[],[179],{"type":28,"value":180},"\u002Factivity\u002Fdetail",{"type":28,"value":182}," (a session)",{"type":23,"tag":157,"props":184,"children":185},{},[186],{"type":28,"value":187},"The \"read external content\" event and the tool calls after it",{"type":23,"tag":157,"props":189,"children":190},{},[191],{"type":28,"value":192},"P-PROMPT-INSPECT, P-TOOL-APPROVAL",{"type":23,"tag":157,"props":194,"children":195},{},[196],{"type":28,"value":197},"Lock system prompts; red-team",{"type":23,"tag":110,"props":199,"children":200},{},[201,206,211,216,227,232,237],{"type":23,"tag":157,"props":202,"children":203},{},[204],{"type":28,"value":205},"2",{"type":23,"tag":157,"props":207,"children":208},{},[209],{"type":28,"value":210},"ASI02 Tool Misuse",{"type":23,"tag":157,"props":212,"children":213},{},[214],{"type":28,"value":215},"Which tools can change things, and who approves those calls?",{"type":23,"tag":157,"props":217,"children":218},{},[219,225],{"type":23,"tag":31,"props":220,"children":222},{"className":221},[],[223],{"type":28,"value":224},"\u002Finventory\u002Ftools",{"type":28,"value":226}," → tool detail",{"type":23,"tag":157,"props":228,"children":229},{},[230],{"type":28,"value":231},"Tools that send, write, delete or execute; the approval column",{"type":23,"tag":157,"props":233,"children":234},{},[235],{"type":28,"value":236},"P-TOOL-ALLOW, P-TOOL-APPROVAL, P-SPEND",{"type":23,"tag":157,"props":238,"children":239},{},[240],{"type":28,"value":241},"Per-tool scopes in the tool itself",{"type":23,"tag":110,"props":243,"children":244},{},[245,250,255,260,277,282,287],{"type":23,"tag":157,"props":246,"children":247},{},[248],{"type":28,"value":249},"3",{"type":23,"tag":157,"props":251,"children":252},{},[253],{"type":28,"value":254},"ASI03 Identity & Privilege",{"type":23,"tag":157,"props":256,"children":257},{},[258],{"type":28,"value":259},"Whose credentials are my agents acting with?",{"type":23,"tag":157,"props":261,"children":262},{},[263,269,271],{"type":23,"tag":31,"props":264,"children":266},{"className":265},[],[267],{"type":28,"value":268},"\u002Fidentity",{"type":28,"value":270}," + ",{"type":23,"tag":31,"props":272,"children":274},{"className":273},[],[275],{"type":28,"value":276},"\u002Fdlp",{"type":23,"tag":157,"props":278,"children":279},{},[280],{"type":28,"value":281},"Personal accounts, shared or long-lived keys; secrets pasted into context",{"type":23,"tag":157,"props":283,"children":284},{},[285],{"type":28,"value":286},"P-CREDENTIALS, P-ACCT, P-ENTERPRISE",{"type":23,"tag":157,"props":288,"children":289},{},[290],{"type":28,"value":291},"Issuance, scoping, delegation (IdP)",{"type":23,"tag":110,"props":293,"children":294},{},[295,300,305,310,327,332,337],{"type":23,"tag":157,"props":296,"children":297},{},[298],{"type":28,"value":299},"4",{"type":23,"tag":157,"props":301,"children":302},{},[303],{"type":28,"value":304},"ASI04 Supply Chain",{"type":23,"tag":157,"props":306,"children":307},{},[308],{"type":28,"value":309},"What did my agents load this week that nobody reviewed?",{"type":23,"tag":157,"props":311,"children":312},{},[313,319,321],{"type":23,"tag":31,"props":314,"children":316},{"className":315},[],[317],{"type":28,"value":318},"\u002Finventory\u002Fmcp-servers",{"type":28,"value":320},", ",{"type":23,"tag":31,"props":322,"children":324},{"className":323},[],[325],{"type":28,"value":326},"\u002Finventory\u002Fskills",{"type":23,"tag":157,"props":328,"children":329},{},[330],{"type":28,"value":331},"First-seen, unsanctioned, version changed",{"type":23,"tag":157,"props":333,"children":334},{},[335],{"type":28,"value":336},"P-MCP, P-PROVENANCE · block = kill switch",{"type":23,"tag":157,"props":338,"children":339},{},[340],{"type":28,"value":341},"Prompts and orchestration under version control",{"type":23,"tag":110,"props":343,"children":344},{},[345,350,355,360,376,381,386],{"type":23,"tag":157,"props":346,"children":347},{},[348],{"type":28,"value":349},"5",{"type":23,"tag":157,"props":351,"children":352},{},[353],{"type":28,"value":354},"ASI05 Code Execution",{"type":23,"tag":157,"props":356,"children":357},{},[358],{"type":28,"value":359},"Where can my agents run code, and with what rights?",{"type":23,"tag":157,"props":361,"children":362},{},[363,369,370],{"type":23,"tag":31,"props":364,"children":366},{"className":365},[],[367],{"type":28,"value":368},"\u002Forganization\u002Fendpoints\u002Fdetail",{"type":28,"value":320},{"type":23,"tag":31,"props":371,"children":373},{"className":372},[],[374],{"type":28,"value":375},"\u002Finventory\u002Fharnesses\u002Fdetail",{"type":23,"tag":157,"props":377,"children":378},{},[379],{"type":28,"value":380},"Running as root, no sandbox, writes to sensitive paths",{"type":23,"tag":157,"props":382,"children":383},{},[384],{"type":28,"value":385},"P-NO-ROOT, P-SANDBOX, P-FILES",{"type":23,"tag":157,"props":387,"children":388},{},[389,391,397],{"type":28,"value":390},"Code review, no ",{"type":23,"tag":31,"props":392,"children":394},{"className":393},[],[395],{"type":28,"value":396},"eval",{"type":28,"value":398},", pre-prod checks",{"type":23,"tag":110,"props":400,"children":401},{},[402,407,412,417,433,438,443],{"type":23,"tag":157,"props":403,"children":404},{},[405],{"type":28,"value":406},"6",{"type":23,"tag":157,"props":408,"children":409},{},[410],{"type":28,"value":411},"ASI06 Memory & Context",{"type":23,"tag":157,"props":413,"children":414},{},[415],{"type":28,"value":416},"Where does my agents' memory live, and what sensitive data went into it?",{"type":23,"tag":157,"props":418,"children":419},{},[420,426,428],{"type":23,"tag":31,"props":421,"children":423},{"className":422},[],[424],{"type":28,"value":425},"\u002Finventory\u002F*",{"type":28,"value":427}," (memory, RAG, vector endpoints) + ",{"type":23,"tag":31,"props":429,"children":431},{"className":430},[],[432],{"type":28,"value":276},{"type":23,"tag":157,"props":434,"children":435},{},[436],{"type":28,"value":437},"Memory endpoints in use; sensitive data sent to them",{"type":23,"tag":157,"props":439,"children":440},{},[441],{"type":28,"value":442},"P-SENS-DETECT, P-SENS-SANITIZE, P-DATA-BOUNDARY",{"type":23,"tag":157,"props":444,"children":445},{},[446],{"type":28,"value":447},"Segmentation, expiry, rollback",{"type":23,"tag":110,"props":449,"children":450},{},[451,456,461,466,477,482,487],{"type":23,"tag":157,"props":452,"children":453},{},[454],{"type":28,"value":455},"7",{"type":23,"tag":157,"props":457,"children":458},{},[459],{"type":28,"value":460},"ASI07 Inter-Agent Comms",{"type":23,"tag":157,"props":462,"children":463},{},[464],{"type":28,"value":465},"Which agent connections are unencrypted or unauthenticated?",{"type":23,"tag":157,"props":467,"children":468},{},[469,475],{"type":23,"tag":31,"props":470,"children":472},{"className":471},[],[473],{"type":28,"value":474},"\u002Falerts",{"type":28,"value":476}," (weak TLS) + MCP server detail",{"type":23,"tag":157,"props":478,"children":479},{},[480],{"type":28,"value":481},"Plaintext or downgraded channels; remote MCP over HTTP",{"type":23,"tag":157,"props":483,"children":484},{},[485],{"type":28,"value":486},"P-TRANSPORT",{"type":23,"tag":157,"props":488,"children":489},{},[490],{"type":28,"value":491},"Signing, anti-replay, attested registries",{"type":23,"tag":110,"props":493,"children":494},{},[495,500,505,510,523,528,533],{"type":23,"tag":157,"props":496,"children":497},{},[498],{"type":28,"value":499},"8",{"type":23,"tag":157,"props":501,"children":502},{},[503],{"type":28,"value":504},"ASI08 Cascading Failures",{"type":23,"tag":157,"props":506,"children":507},{},[508],{"type":28,"value":509},"If one piece went bad, how far would it spread?",{"type":23,"tag":157,"props":511,"children":512},{},[513,515,521],{"type":28,"value":514},"MCP server detail (blast radius) + ",{"type":23,"tag":31,"props":516,"children":518},{"className":517},[],[519],{"type":28,"value":520},"\u002Fcost",{"type":28,"value":522}," + Policy Config history",{"type":23,"tag":157,"props":524,"children":525},{},[526],{"type":28,"value":527},"Users, devices, agents that touched it; volume spikes; policy relaxations",{"type":23,"tag":157,"props":529,"children":530},{},[531],{"type":28,"value":532},"P-SPEND, P-TOOL-APPROVAL · Change impact",{"type":23,"tag":157,"props":534,"children":535},{},[536],{"type":28,"value":537},"Fault tolerance, replay tests",{"type":23,"tag":110,"props":539,"children":540},{},[541,546,551,556,561,566,571],{"type":23,"tag":157,"props":542,"children":543},{},[544],{"type":28,"value":545},"9",{"type":23,"tag":157,"props":547,"children":548},{},[549],{"type":28,"value":550},"ASI09 Human-Agent Trust",{"type":23,"tag":157,"props":552,"children":553},{},[554],{"type":28,"value":555},"Are the people approving agent actions actually reviewing them?",{"type":23,"tag":157,"props":557,"children":558},{},[559],{"type":28,"value":560},"Policy detail for P-TOOL-APPROVAL",{"type":23,"tag":157,"props":562,"children":563},{},[564],{"type":28,"value":565},"Approval rate and time-to-approve per approver",{"type":23,"tag":157,"props":567,"children":568},{},[569],{"type":28,"value":570},"P-TOOL-APPROVAL, P-TELEMETRY",{"type":23,"tag":157,"props":572,"children":573},{},[574],{"type":28,"value":575},"Training, UX safeguards",{"type":23,"tag":110,"props":577,"children":578},{},[579,584,589,594,603,608,613],{"type":23,"tag":157,"props":580,"children":581},{},[582],{"type":28,"value":583},"10",{"type":23,"tag":157,"props":585,"children":586},{},[587],{"type":28,"value":588},"ASI10 Rogue Agents",{"type":23,"tag":157,"props":590,"children":591},{},[592],{"type":28,"value":593},"Is any agent doing what it was never set up to do, and can I stop it?",{"type":23,"tag":157,"props":595,"children":596},{},[597],{"type":23,"tag":31,"props":598,"children":600},{"className":599},[],[601],{"type":28,"value":602},"\u002Finventory\u002Fagents\u002Fdetail",{"type":23,"tag":157,"props":604,"children":605},{},[606],{"type":28,"value":607},"Expected (allow-list) vs observed; the block action",{"type":23,"tag":157,"props":609,"children":610},{},[611],{"type":28,"value":612},"P-TOOL-ALLOW, P-MCP",{"type":23,"tag":157,"props":614,"children":615},{},[616],{"type":28,"value":617},"Attestation, reintegration review",{"type":23,"tag":24,"props":619,"children":620},{},[621,623,629,631,636],{"type":28,"value":622},"The lab (",{"type":23,"tag":31,"props":624,"children":626},{"className":625},[],[627],{"type":28,"value":628},"\u002Fpages\u002Fphase4\u002Fmock",{"type":28,"value":630},") has policies, findings, compliance, endpoints, teams and Policy Config, but ",{"type":23,"tag":80,"props":632,"children":633},{},[634],{"type":28,"value":635},"no inventory, identity, activity or data-protection pages",{"type":28,"value":637},". Stops 1–7 and 10 land on qdash pages. That is a decision (§6).",{"type":23,"tag":96,"props":639,"children":641},{"id":640},"_2-brainstorm-new-surfaces-the-paper-argues-for",[642],{"type":28,"value":14},{"type":23,"tag":24,"props":644,"children":645},{},[646],{"type":28,"value":647},"Ranked by how much of the paper each one illuminates. Details in the reading §6.",{"type":23,"tag":649,"props":650,"children":651},"ol",{},[652,663,687,697,707,717,727],{"type":23,"tag":653,"props":654,"children":655},"li",{},[656,661],{"type":23,"tag":80,"props":657,"children":658},{},[659],{"type":28,"value":660},"Blast radius panel",{"type":28,"value":662}," on any inventory detail (MCP server, skill, model, harness): who and what touched it in the window, and the block action beside it. Serves ASI04 #8, ASI08, ASI10 #4. One panel, three stops.",{"type":23,"tag":653,"props":664,"children":665},{},[666,671,673,678,680,685],{"type":23,"tag":80,"props":667,"children":668},{},[669],{"type":28,"value":670},"\"Has this happened to us?\"",{"type":28,"value":672}," Appendix D's 24 named incidents checked against the inventory: ",{"type":23,"tag":88,"props":674,"children":675},{},[676],{"type":28,"value":677},"postmark-mcp — not in your fleet",{"type":28,"value":679},"; ",{"type":23,"tag":88,"props":681,"children":682},{},[683],{"type":28,"value":684},"Cursor below the fixed version — 4 endpoints",{"type":28,"value":686},". Makes the paper concrete in seconds. Needs version ranges per incident (curated, small).",{"type":23,"tag":653,"props":688,"children":689},{},[690,695],{"type":23,"tag":80,"props":691,"children":692},{},[693],{"type":28,"value":694},"Tool-descriptor drift",{"type":28,"value":696},": an MCP server's tool list hashed at approval, flagged when it changes. The \"rug pull\" that ASI02 and ASI04 both describe.",{"type":23,"tag":653,"props":698,"children":699},{},[700,705],{"type":23,"tag":80,"props":701,"children":702},{},[703],{"type":28,"value":704},"Expected vs observed",{"type":28,"value":706}," on agent detail: the allow-list as a manifest, the observed tools and destinations beside it, deviations as findings.",{"type":23,"tag":653,"props":708,"children":709},{},[710,715],{"type":23,"tag":80,"props":711,"children":712},{},[713],{"type":28,"value":714},"Approval health",{"type":28,"value":716}," on the approval policy: approval rate, median time-to-approve, bulk approvals. The paper's automation bias (ASI09) and governance drift (ASI08 ex.6).",{"type":23,"tag":653,"props":718,"children":719},{},[720,725],{"type":23,"tag":80,"props":721,"children":722},{},[723],{"type":28,"value":724},"Look-alike names",{"type":28,"value":726}," flag in MCP, skill and tool inventories.",{"type":23,"tag":653,"props":728,"children":729},{},[730,735],{"type":23,"tag":80,"props":731,"children":732},{},[733],{"type":28,"value":734},"The paper rail",{"type":28,"value":736}," on framework detail (§4).",{"type":23,"tag":96,"props":738,"children":740},{"id":739},"_3-tour-design",[741],{"type":28,"value":15},{"type":23,"tag":743,"props":744,"children":746},"h3",{"id":745},"arc-12-steps",[747],{"type":28,"value":748},"Arc (12 steps)",{"type":23,"tag":649,"props":750,"children":752},{"start":751},0,[753,770],{"type":23,"tag":653,"props":754,"children":755},{},[756,761,763,768],{"type":23,"tag":80,"props":757,"children":758},{},[759],{"type":28,"value":760},"The map.",{"type":28,"value":762}," The paper's \"At a Glance\" diagram, redrawn, with Qpoint's observation points on it (the endpoint and the wire) and each ASI placed where it lives. One OWASP sentence: observability is non-negotiable. Licensed CC BY-SA 4.0 as an adaptation, attributed.\n1–10. ",{"type":23,"tag":80,"props":764,"children":765},{},[766],{"type":28,"value":767},"One stop per risk",{"type":28,"value":769}," (§1), each with 2–3 beats across pages.",{"type":23,"tag":653,"props":771,"children":772},{},[773,778,780,785,787,792],{"type":23,"tag":80,"props":774,"children":775},{},[776],{"type":28,"value":777},"What you've got.",{"type":28,"value":779}," Counts by state across the ten (Enforced \u002F Observed \u002F Evidenced \u002F Outside), then two actions: ",{"type":23,"tag":88,"props":781,"children":782},{},[783],{"type":28,"value":784},"Track this framework",{"type":28,"value":786}," (stages its policies at Observe, F8) and ",{"type":23,"tag":88,"props":788,"children":789},{},[790],{"type":28,"value":791},"Export evidence",{"type":28,"value":793},".",{"type":23,"tag":24,"props":795,"children":796},{},[797,802,804,809],{"type":23,"tag":80,"props":798,"children":799},{},[800],{"type":28,"value":801},"Order.",{"type":28,"value":803}," Paper order (ASI01→10) is familiar to the AppSec reader. A narrative order starts on solid ground and ends on the hard ones: ",{"type":23,"tag":80,"props":805,"children":806},{},[807],{"type":28,"value":808},"04 → 02 → 03 → 05 → 07 → 01 → 06 → 10 → 08 → 09",{"type":28,"value":810}," (\"what's installed → what it does → as whom → where it runs → what it talks to → what it reads → what it remembers → how it drifts → how far it spreads → who signs off\"). Recommendation: narrative order for the tour, paper order on framework detail; the tour panel always shows the ASI number so nobody loses their place.",{"type":23,"tag":743,"props":812,"children":814},{"id":813},"stop-anatomy-one-docked-panel-the-page-stays-live",[815],{"type":28,"value":816},"Stop anatomy (one docked panel, the page stays live)",{"type":23,"tag":24,"props":818,"children":819},{},[820,825,827,833,835,843],{"type":23,"tag":80,"props":821,"children":822},{},[823],{"type":28,"value":824},"Mark liked it, 2026-10-27:",{"type":28,"value":826}," the canvas artboard \"A tour stop · ASI04 on MCP servers\" (",{"type":23,"tag":31,"props":828,"children":830},{"className":829},[],[831],{"type":28,"value":832},"Main.dc.html",{"type":28,"value":834}," on the ",{"type":23,"tag":40,"props":836,"children":840},{"href":837,"rel":838},"https:\u002F\u002Fclaude.ai\u002Fartifact\u002FV4qJ4c8sgfuTZv1nvcfmy1",[839],"nofollow",[841],{"type":28,"value":842},"concept canvas",{"type":28,"value":844},") is the reference for every stop. Its parts:",{"type":23,"tag":846,"props":847,"children":848},"ul",{},[849,854,859,864,869,874,879],{"type":23,"tag":653,"props":850,"children":851},{},[852],{"type":28,"value":853},"the panel docked right, with the live page underneath;",{"type":23,"tag":653,"props":855,"children":856},{},[857],{"type":28,"value":858},"a highlight ring on the region that answers the question, plus a numbered callout;",{"type":23,"tag":653,"props":860,"children":861},{},[862],{"type":28,"value":863},"a step bar and the fit chip, with no percentage;",{"type":23,"tag":653,"props":865,"children":866},{},[867],{"type":28,"value":868},"the \"for you\" line, then a link to the paper page;",{"type":23,"tag":653,"props":870,"children":871},{},[872],{"type":28,"value":873},"the \"Ask your fleet\" question, then \"Here's yours\" numbers taken from the page;",{"type":23,"tag":653,"props":875,"children":876},{},[877],{"type":28,"value":878},"the paper's mitigations, numbered as the paper numbers them, each with a state chip, then a \"Yours\" line;",{"type":23,"tag":653,"props":880,"children":881},{},[882],{"type":28,"value":883},"one action, staging the policies at Observe, plus Next.",{"type":23,"tag":24,"props":885,"children":886},{},[887,889,895,897,903,905,911],{"type":28,"value":888},"The page underneath is the real page with a highlight ring on the target region. The panel docks right (c125's composition: ",{"type":23,"tag":31,"props":890,"children":892},{"className":891},[],[893],{"type":28,"value":894},"UxStickyBand",{"type":28,"value":896}," header, ",{"type":23,"tag":31,"props":898,"children":900},{"className":899},[],[901],{"type":28,"value":902},"UxPopover",{"type":28,"value":904},"\u002F",{"type":23,"tag":31,"props":906,"children":908},{"className":907},[],[909],{"type":28,"value":910},"UxHoverBox",{"type":28,"value":912}," for the ring's callout).",{"type":23,"tag":914,"props":915,"children":919},"pre",{"className":916,"code":918,"language":28},[917],"language-text","┌ Tour · OWASP® Agentic Top 10 ───────────── 4 of 12 ┐\n│ ASI04 · Agentic Supply Chain        [ Partial ▾ ]  │  fit chip (no %)\n│                                                    │\n│ Your agents assemble themselves at run time from   │  \"for you\" line,\n│ other people's parts. Any of them can be an        │  our words\n│ impostor.                                          │\n│ Read ASI04 in the paper · p.18 ↗                   │  opens hosted PDF #page=19\n│ ────────────────────────────────────────────────── │\n│ ASK YOUR FLEET                                     │\n│ What did my agents load this week that nobody      │\n│ reviewed?                                          │\n│                                                    │\n│ HERE'S YOURS                         ◉ highlighted │  live numbers from\n│ 3 MCP servers unsanctioned · 1 first seen today    │  the page underneath\n│ 2 skills changed version since review              │\n│ ────────────────────────────────────────────────── │\n│ WHAT THE PAPER ASKS · WHAT QPOINT DOES             │  the paper's numbered\n│ #1 Inventory, block untrusted  ● Observed          │  mitigations as chips;\n│ #2 Allow-list and pin          ● Enforced · Finance│  hover = our paraphrase\n│ #6 Re-check at run time        ● Observed          │  + page link\n│ #7 Pin, staged rollout         ○ Off               │\n│ #8 Kill switch                 ● Ready             │\n│ YOURS: #4 prompts under version control · #9 …     │  Outside, said plainly\n│ ────────────────────────────────────────────────── │\n│ [ Stage P-MCP + P-PROVENANCE at Observe ]   Next → │  F8: stage, don't enforce\n└────────────────────────────────────────────────────┘\n",[920],{"type":23,"tag":31,"props":921,"children":923},{"__ignoreMap":922},"",[924],{"type":28,"value":918},{"type":23,"tag":24,"props":926,"children":927},{},[928],{"type":28,"value":929},"Rules:",{"type":23,"tag":846,"props":931,"children":932},{},[933,943,953,963],{"type":23,"tag":653,"props":934,"children":935},{},[936,941],{"type":23,"tag":80,"props":937,"children":938},{},[939],{"type":28,"value":940},"\"Here's yours\" comes from the page's own data",{"type":28,"value":942},", never from tour copy. An empty fleet says so (\"no MCP servers seen yet\") and the stop still teaches (c108 honest states).",{"type":23,"tag":653,"props":944,"children":945},{},[946,951],{"type":23,"tag":80,"props":947,"children":948},{},[949],{"type":28,"value":950},"Mitigation chips are the bridge to the paper.",{"type":28,"value":952}," Number as in the paper, state from the customer's Policy Config, hover shows our paraphrase and \"p.N ↗\". Exact quotes only in the hover, attributed.",{"type":23,"tag":653,"props":954,"children":955},{},[956,961],{"type":23,"tag":80,"props":957,"children":958},{},[959],{"type":28,"value":960},"\"Yours\" is never hidden.",{"type":28,"value":962}," Every stop lists its Outside mitigations, and links the Red Teaming Manual where the paper asks for red-teaming.",{"type":23,"tag":653,"props":964,"children":965},{},[966,971],{"type":23,"tag":80,"props":967,"children":968},{},[969],{"type":28,"value":970},"The only action is staging at Observe.",{"type":28,"value":972}," The tour never enforces. Change impact follows in Policy Config.",{"type":23,"tag":743,"props":974,"children":976},{"id":975},"beats-per-stop",[977],{"type":28,"value":978},"Beats per stop",{"type":23,"tag":24,"props":980,"children":981},{},[982],{"type":28,"value":983},"A stop can move across pages; the panel stays, the ring moves. ASI04, for example:",{"type":23,"tag":649,"props":985,"children":986},{},[987,1003,1015],{"type":23,"tag":653,"props":988,"children":989},{},[990,995,997,1002],{"type":23,"tag":31,"props":991,"children":993},{"className":992},[],[994],{"type":28,"value":318},{"type":28,"value":996},", filtered to unsanctioned + first-seen: ",{"type":23,"tag":88,"props":998,"children":999},{},[1000],{"type":28,"value":1001},"reveal",{"type":28,"value":793},{"type":23,"tag":653,"props":1004,"children":1005},{},[1006,1008,1013],{"type":28,"value":1007},"MCP server detail → blast radius panel: ",{"type":23,"tag":88,"props":1009,"children":1010},{},[1011],{"type":28,"value":1012},"how far",{"type":28,"value":1014}," (and the block action: the kill switch).",{"type":23,"tag":653,"props":1016,"children":1017},{},[1018,1024,1026,1031],{"type":23,"tag":31,"props":1019,"children":1021},{"className":1020},[],[1022],{"type":28,"value":1023},"\u002Fpolicies",{"type":28,"value":1025}," P-MCP row: ",{"type":23,"tag":88,"props":1027,"children":1028},{},[1029],{"type":28,"value":1030},"govern",{"type":28,"value":1032},", with its state per scope.",{"type":23,"tag":743,"props":1034,"children":1036},{"id":1035},"the-ai-guide-c125-phase-4",[1037],{"type":28,"value":1038},"The AI guide (c125 phase 4)",{"type":23,"tag":24,"props":1040,"children":1041},{},[1042],{"type":28,"value":1043},"The same content as data drives the MCP tour guide: \"walk me through ASI04 on my fleet\" → navigates, highlights, reads the numbers, and answers \"what's mine to do?\" from the Outside list. The guide quotes the paper only from the per-mitigation quote field, so attribution travels with it.",{"type":23,"tag":96,"props":1045,"children":1047},{"id":1046},"_4-what-framework-detail-borrows-c123-scope-2",[1048],{"type":28,"value":16},{"type":23,"tag":24,"props":1050,"children":1051},{},[1052],{"type":28,"value":1053},"Framework detail and the tour share one per-entry record, so the content is written once:",{"type":23,"tag":914,"props":1055,"children":1060},{"className":1056,"code":1057,"language":1058,"meta":922,"style":1059},"language-ts","interface AgenticEntry {\n  id: 'ASI01' | … | 'ASI10'\n  title: string\n  page: { printed: number; pdf: number }          \u002F\u002F printed + 1\n  forYou: string                                  \u002F\u002F our words (F5)\n  boundary: string                                \u002F\u002F what it is not, our words\n  question: string                                \u002F\u002F \"ask your fleet\"\n  crosswalk: { llm2025: string[]; llm2026: string[]; tcodes: string[]; aivss: string }\n  mitigations: { n: number; ours: string; quote?: string; qpoint: 'enforced' | 'observed' | 'evidenced' | 'outside'; policyIds?: string[]; surface?: string }[]\n  reveals: { route: string; target: string; metric: string }[]\n  incidents: string[]                             \u002F\u002F Appendix D names\n  policyIds: string[]; procedural: boolean; note: string   \u002F\u002F the existing fixture shape\n}\n","ts","undefined",[1061],{"type":23,"tag":31,"props":1062,"children":1063},{"__ignoreMap":922},[1064],{"type":28,"value":1057},{"type":23,"tag":24,"props":1066,"children":1067},{},[1068,1073],{"type":23,"tag":80,"props":1069,"children":1070},{},[1071],{"type":28,"value":1072},"The paper rail.",{"type":28,"value":1074}," On framework detail, each requirement row expands into two columns: left, ours (for-you line, coverage state, policies, evidence); right, the paper's section outline (Description · Examples · Scenarios · Mitigations 1–N · References) with each numbered mitigation carrying its Qpoint state chip. Click a mitigation: the hosted PDF opens at that page. That is \"reference and illuminate the sections of the paper with the dashboard.\"",{"type":23,"tag":24,"props":1076,"children":1077},{},[1078,1083,1085,1091,1093,1099,1100,1106,1107,1113,1114,1120],{"type":23,"tag":80,"props":1079,"children":1080},{},[1081],{"type":28,"value":1082},"Fixture.",{"type":28,"value":1084}," The fit table in the reading §5 is ready to drop into ",{"type":23,"tag":31,"props":1086,"children":1088},{"className":1087},[],[1089],{"type":28,"value":1090},"governance-fixture.ts",{"type":28,"value":1092}," as a fourth framework (",{"type":23,"tag":31,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":28,"value":1098},"id: 'owasp-agentic'",{"type":28,"value":320},{"type":23,"tag":31,"props":1101,"children":1103},{"className":1102},[],[1104],{"type":28,"value":1105},"version: '2026'",{"type":28,"value":320},{"type":23,"tag":31,"props":1108,"children":1110},{"className":1109},[],[1111],{"type":28,"value":1112},"type: 'risk taxonomy'",{"type":28,"value":320},{"type":23,"tag":31,"props":1115,"children":1117},{"className":1116},[],[1118],{"type":28,"value":1119},"sourceTerm: 'risk'",{"type":28,"value":1121},"), when we decide it belongs (§6).",{"type":23,"tag":96,"props":1123,"children":1125},{"id":1124},"_5-attribution-footer-tour-panel-and-framework-detail",[1126],{"type":28,"value":17},{"type":23,"tag":1128,"props":1129,"children":1130},"blockquote",{},[1131],{"type":23,"tag":24,"props":1132,"children":1133},{},[1134,1136,1141,1143,1150,1152,1159],{"type":28,"value":1135},"Risk entries and mitigation numbering: ",{"type":23,"tag":88,"props":1137,"children":1138},{},[1139],{"type":28,"value":1140},"OWASP® Top 10 for Agentic Applications 2026",{"type":28,"value":1142},", OWASP GenAI Security Project – Agentic Security Initiative, ",{"type":23,"tag":40,"props":1144,"children":1147},{"href":1145,"rel":1146},"https:\u002F\u002Fgenai.owasp.org\u002Fresource\u002Fowasp-top-10-for-agentic-applications-for-2026\u002F",[839],[1148],{"type":28,"value":1149},"source",{"type":28,"value":1151},", licensed ",{"type":23,"tag":40,"props":1153,"children":1156},{"href":1154,"rel":1155},"https:\u002F\u002Fcreativecommons.org\u002Flicenses\u002Fby-sa\u002F4.0\u002F",[839],[1157],{"type":28,"value":1158},"CC BY-SA 4.0",{"type":28,"value":1160},". Quoted passages are unchanged; the mapping to Qpoint is Qpoint's own. The OWASP® word mark is a service mark of OWASP Foundation, Inc.; OWASP does not endorse Qpoint.",{"type":23,"tag":96,"props":1162,"children":1164},{"id":1163},"_6-decisions-for-mark",[1165],{"type":28,"value":18},{"type":23,"tag":649,"props":1167,"children":1168},{},[1169,1197,1207,1217,1227],{"type":23,"tag":653,"props":1170,"children":1171},{},[1172,1181,1183,1188,1190,1195],{"type":23,"tag":1173,"props":1174,"children":1175},"del",{},[1176],{"type":23,"tag":80,"props":1177,"children":1178},{},[1179],{"type":28,"value":1180},"Is the Agentic Top 10 a tracked framework in v1?",{"type":28,"value":1182}," ",{"type":23,"tag":80,"props":1184,"children":1185},{},[1186],{"type":28,"value":1187},"Ruled 2026-10-27: yes.",{"type":28,"value":1189}," It's v1's fourth framework (OWASP as one family). It's in the fixture as ",{"type":23,"tag":31,"props":1191,"children":1193},{"className":1192},[],[1194],{"type":28,"value":36},{"type":28,"value":1196},", untracked, so the tour's \"Track this framework\" has something to do.",{"type":23,"tag":653,"props":1198,"children":1199},{},[1200,1205],{"type":23,"tag":80,"props":1201,"children":1202},{},[1203],{"type":28,"value":1204},"Tour order:",{"type":28,"value":1206}," narrative (recommended) or paper order.",{"type":23,"tag":653,"props":1208,"children":1209},{},[1210,1215],{"type":23,"tag":80,"props":1211,"children":1212},{},[1213],{"type":28,"value":1214},"Where the tour runs first:",{"type":28,"value":1216}," qdash (has every page it needs) or the lab (needs inventory, identity, activity and data-protection pages first). c125 plans to run tours on the lab's fixture worlds.",{"type":23,"tag":653,"props":1218,"children":1219},{},[1220,1225],{"type":23,"tag":80,"props":1221,"children":1222},{},[1223],{"type":28,"value":1224},"Which new surfaces to mock:",{"type":28,"value":1226}," blast radius and \"has this happened to us?\" carry the most stops.",{"type":23,"tag":653,"props":1228,"children":1229},{},[1230,1235],{"type":23,"tag":80,"props":1231,"children":1232},{},[1233],{"type":28,"value":1234},"Host the three OWASP PDFs",{"type":28,"value":1236}," on the design site and in qdash (allowed under CC BY-SA, with the footer above).",{"type":23,"tag":1238,"props":1239,"children":1240},"style",{},[1241],{"type":28,"value":922},1794599401778]