# Risk Control Mapping

> Condensed quick-reference mapping ASI risks to ACS controls

- **Category**: guardrails-acs

- **Canonical URL**: https://designpattern.fyi/guardrails-acs/risk-control-mapping/

---

## Description
Condensed quick-reference mapping ASI risks to ACS controls








## Additional Notes

# Appendix B — Quick-Reference: ASI Risk to ACS Control (Condensed)

---

## Complete Mapping Table

| ASI01 | ASI02 | ASI03 | ASI04 | ASI05 |
|---|---|---|---|---|
| User Msg + Knowledge hooks | Tool Call Request | Tier 3 + Trace identity | AgBOM + MCP Outbound | Tool Call Request |

| ASI06 | ASI07 | ASI08 | ASI09 | ASI10 |
|---|---|---|---|---|
| Memory + Knowledge hooks | A2A hooks | Trace + A2A hooks | Agent Response hook | Full stack |

*(See Section 5 for the full explanation of each mapping.)*

---

## Risk-to-Hook Quick Reference

### ASI01 — Agent Goal Hijack
**Primary ACS Controls:**
- User Message hook
- Knowledge Retrieval hook
- Guardian Agent policy

**Hook Numbers:** #4, #6

### ASI02 — Tool Misuse & Exploitation
**Primary ACS Controls:**
- Tool Call Request hook

**Hook Numbers:** #2

### ASI03 — Agent Identity & Privilege Abuse
**Primary ACS Controls:**
- Tier 3 enterprise classifiers
- Trace identity fields
- Emerging identity workstream

**Hook Numbers:** All hooks (for identity tracking)

### ASI04 — Agentic Supply Chain Vulnerabilities
**Primary ACS Controls:**
- Inspect / dynamic AgBOM
- MCP Outbound hook

**Hook Numbers:** #9

### ASI05 — Unexpected Code Execution
**Primary ACS Controls:**
- Tool Call Request hook (for code-exec/OS tools)
- Tier 3 classifiers

**Hook Numbers:** #2

### ASI06 — Memory & Context Poisoning
**Primary ACS Controls:**
- Memory Context Retrieval hook
- Memory Store hook
- Knowledge Retrieval hook

**Hook Numbers:** #5, #6, #7

### ASI07 — Insecure Inter-Agent Communication
**Primary ACS Controls:**
- A2A hooks

**Hook Numbers:** #11-15

### ASI08 — Cascading Failures
**Primary ACS Controls:**
- Trace (OpenTelemetry/OCSF)
- A2A hooks

**Hook Numbers:** #11-15

### ASI09 — Human-Agent Trust Exploitation
**Primary ACS Controls:**
- Agent Response hook

**Hook Numbers:** #8

### ASI10 — Rogue Agents
**Primary ACS Controls:**
- Full Instrument + Trace + Inspect stack

**Hook Numbers:** All hooks

---

## Hook-to-Risk Quick Reference

### Hook #1 — Agent Trigger
**Addresses:**
- Prevents unauthorized agent activation
- Relevant to: ASI10 (Rogue Agents)

### Hook #2 — Tool Call Request
**Addresses:**
- ASI02 (Tool Misuse)
- ASI05 (Unexpected Code Execution)

### Hook #3 — Tool Call Result
**Addresses:**
- Tool result poisoning
- Relevant to: ASI02, ASI05

### Hook #4 — User Message
**Addresses:**
- ASI01 (Agent Goal Hijack)
- Input filtering and injection prevention

### Hook #5 — Memory Context Retrieval
**Addresses:**
- ASI06 (Memory & Context Poisoning)
- Prevents poisoned memory from being used

### Hook #6 — Knowledge Retrieval
**Addresses:**
- ASI01 (Agent Goal Hijack)
- ASI06 (Memory & Context Poisoning)
- Knowledge source poisoning

### Hook #7 — Memory Store
**Addresses:**
- ASI06 (Memory & Context Poisoning)
- Prevents poisoning of memory

### Hook #8 — Agent Response
**Addresses:**
- ASI09 (Human-Agent Trust Exploitation)
- Output filtering and manipulation detection

### Hook #9 — MCP Outbound
**Addresses:**
- ASI04 (Agentic Supply Chain Vulnerabilities)
- MCP server allow-listing

### Hook #10 — MCP Inbound
**Addresses:**
- ASI04 (Agentic Supply Chain Vulnerabilities)
- MCP payload screening

### Hooks #11-15 — A2A Hooks
**Addresses:**
- ASI07 (Insecure Inter-Agent Communication)
- ASI08 (Cascading Failures)
- Inter-agent authentication and authorization

---

## Implementation Priority by Risk

### Critical Risks (Address First)
- **ASI01** — Agent Goal Hijack (high impact, common attack vector)
- **ASI02** — Tool Misuse (high impact, tool-heavy agents)
- **ASI06** — Memory Poisoning (high impact, persistent agents)

### High Priority (Address Second)
- **ASI04** — Supply Chain Vulnerabilities (growing concern with MCP adoption)
- **ASI05** — Unexpected Code Execution (high impact for coding agents)
- **ASI09** — Human-Agent Trust Exploitation (high social engineering risk)

### Medium Priority (Address Third)
- **ASI03** — Identity & Privilege Abuse (important for multi-tenant systems)
- **ASI07** — Insecure Inter-Agent Communication (important for multi-agent systems)
- **ASI08** — Cascading Failures (important for complex agent workflows)

### Lower Priority (Address Last)
- **ASI10** — Rogue Agents (broad risk, addressed by comprehensive implementation)

---

## Quick Decision Matrix

### If Your Agent... → Prioritize These Hooks
- **Uses tools extensively** → #2, #3 (Tool Call Request/Result)
- **Has long-term memory** → #5, #7 (Memory hooks)
- **Uses RAG/knowledge bases** → #6 (Knowledge Retrieval)
- **Connects to MCP servers** → #9, #10 (MCP hooks)
- **Delegates to other agents** → #11-15 (A2A hooks)
- **Interacts with humans** → #4, #8 (User Message/Agent Response)
- **Runs autonomously** → #1 (Agent Trigger)
- **Handles sensitive data** → All hooks + Tier 3 classifiers

---

## Key Takeaways

1. **ASI01** → User Message + Knowledge hooks
2. **ASI02** → Tool Call Request
3. **ASI03** → Tier 3 + Trace identity
4. **ASI04** → AgBOM + MCP Outbound
5. **ASI05** → Tool Call Request
6. **ASI06** → Memory + Knowledge hooks
7. **ASI07** → A2A hooks
8. **ASI08** → Trace + A2A hooks
9. **ASI09** → Agent Response hook
10. **ASI10** → Full stack

---

## Next Steps

- **Overview** — return to the main ACS guide