Appendix B — Quick-Reference: ASI Risk to ACS Control (Condensed)

Complete Mapping Table

(See Section 5 for the full explanation of each mapping.)

Risk-to-Hook Quick Reference

ASI01 — Agent Goal Hijack

Primary ACS Controls:

• User Message hook
• Knowledge Retrieval hook
• Guardian Agent policy

Hook Numbers: #4, #6

ASI02 — Tool Misuse & Exploitation

Primary ACS Controls:

• Tool Call Request hook

Hook Numbers: #2

ASI03 — Agent Identity & Privilege Abuse

Primary ACS Controls:

• Tier 3 enterprise classifiers
• Trace identity fields
• Emerging identity workstream

Hook Numbers: All hooks (for identity tracking)

ASI04 — Agentic Supply Chain Vulnerabilities

Primary ACS Controls:

• Inspect / dynamic AgBOM
• MCP Outbound hook

Hook Numbers: #9

ASI05 — Unexpected Code Execution

Primary ACS Controls:

• Tool Call Request hook (for code-exec/OS tools)
• Tier 3 classifiers

Hook Numbers: #2

ASI06 — Memory & Context Poisoning

Primary ACS Controls:

• Memory Context Retrieval hook
• Memory Store hook
• Knowledge Retrieval hook

Hook Numbers: #5, #6, #7

ASI07 — Insecure Inter-Agent Communication

Primary ACS Controls:

• A2A hooks

Hook Numbers: #11-15

ASI08 — Cascading Failures

Primary ACS Controls:

• Trace (OpenTelemetry/OCSF)
• A2A hooks

Hook Numbers: #11-15

ASI09 — Human-Agent Trust Exploitation

Primary ACS Controls:

• Agent Response hook

Hook Numbers: #8

ASI10 — Rogue Agents

Primary ACS Controls:

• Full Instrument + Trace + Inspect stack

Hook Numbers: All hooks

Hook-to-Risk Quick Reference

Hook #1 — Agent Trigger

Addresses:

• Prevents unauthorized agent activation
• Relevant to: ASI10 (Rogue Agents)

Hook #2 — Tool Call Request

Addresses:

• ASI02 (Tool Misuse)
• ASI05 (Unexpected Code Execution)

Hook #3 — Tool Call Result

Addresses:

• Tool result poisoning
• Relevant to: ASI02, ASI05

Hook #4 — User Message

Addresses:

• ASI01 (Agent Goal Hijack)
• Input filtering and injection prevention

Hook #5 — Memory Context Retrieval

Addresses:

• ASI06 (Memory & Context Poisoning)
• Prevents poisoned memory from being used

Hook #6 — Knowledge Retrieval

Addresses:

• ASI01 (Agent Goal Hijack)
• ASI06 (Memory & Context Poisoning)
• Knowledge source poisoning

Hook #7 — Memory Store

Addresses:

• ASI06 (Memory & Context Poisoning)
• Prevents poisoning of memory

Hook #8 — Agent Response

Addresses:

• ASI09 (Human-Agent Trust Exploitation)
• Output filtering and manipulation detection

Hook #9 — MCP Outbound

Addresses:

• ASI04 (Agentic Supply Chain Vulnerabilities)
• MCP server allow-listing

Hook #10 — MCP Inbound

Addresses:

• ASI04 (Agentic Supply Chain Vulnerabilities)
• MCP payload screening

Hooks #11-15 — A2A Hooks

Addresses:

• ASI07 (Insecure Inter-Agent Communication)
• ASI08 (Cascading Failures)
• Inter-agent authentication and authorization

Implementation Priority by Risk

Critical Risks (Address First)

• ASI01 — Agent Goal Hijack (high impact, common attack vector)
• ASI02 — Tool Misuse (high impact, tool-heavy agents)
• ASI06 — Memory Poisoning (high impact, persistent agents)

High Priority (Address Second)

• ASI04 — Supply Chain Vulnerabilities (growing concern with MCP adoption)
• ASI05 — Unexpected Code Execution (high impact for coding agents)
• ASI09 — Human-Agent Trust Exploitation (high social engineering risk)

Medium Priority (Address Third)

• ASI03 — Identity & Privilege Abuse (important for multi-tenant systems)
• ASI07 — Insecure Inter-Agent Communication (important for multi-agent systems)
• ASI08 — Cascading Failures (important for complex agent workflows)

Lower Priority (Address Last)

• ASI10 — Rogue Agents (broad risk, addressed by comprehensive implementation)

Quick Decision Matrix

If Your Agent… → Prioritize These Hooks

• Uses tools extensively → #2, #3 (Tool Call Request/Result)
• Has long-term memory → #5, #7 (Memory hooks)
• Uses RAG/knowledge bases → #6 (Knowledge Retrieval)
• Connects to MCP servers → #9, #10 (MCP hooks)
• Delegates to other agents → #11-15 (A2A hooks)
• Interacts with humans → #4, #8 (User Message/Agent Response)
• Runs autonomously → #1 (Agent Trigger)
• Handles sensitive data → All hooks + Tier 3 classifiers

Key Takeaways

1. ASI01 → User Message + Knowledge hooks
2. ASI02 → Tool Call Request
3. ASI03 → Tier 3 + Trace identity
4. ASI04 → AgBOM + MCP Outbound
5. ASI05 → Tool Call Request
6. ASI06 → Memory + Knowledge hooks
7. ASI07 → A2A hooks
8. ASI08 → Trace + A2A hooks
9. ASI09 → Agent Response hook
10. ASI10 → Full stack

Next Steps

• Overview — return to the main ACS guide