AI Security Documentation. Aligned with OWASP GenAI Security Project.
AI Security & Trust
Honest security documentation for security engineers and CISOs
What CapiscIO protects, what it does not, and how we map to OWASP Top 10 for Agentic Applications 2026.
OWASP Agentic Security Coverage
How CapiscIO addresses the OWASP Top 10 for Agentic Applications 2026 threats
| OWASP Risk | Description | CapiscIO Coverage |
|---|---|---|
| AG01: Agent Identity Spoofing | Attacker impersonates a trusted agent | Direct |
| AG02: Tool Misuse | Agents invoke tools with malicious parameters | Partial |
| AG03: Excessive Agency | Agent performs actions beyond intended scope | Partial |
| AG04: Resource Exhaustion | Runaway agents consume excessive resources | - |
| AG05: Insufficient Sandboxing | Agents escape execution boundaries | Roadmap |
| AG06: Communication Tampering | Inter-agent messages modified in transit | Direct |
| AG07: Replay Attacks | Valid requests captured and repeated | Direct |
| AG08: Model Inversion | Extracting training data via queries | - |
| AG09: Prompt Injection | Malicious inputs hijack agent behavior | - |
| AG10: Audit Trail Gaps | Missing or insufficient logging | Direct |
Threat Model
CapiscIO Guard addresses specific threats in agent-to-agent communication
Threat: An attacker impersonates a trusted agent (e.g., "billing-agent") to trigger unauthorized actions.
Mitigation: When Guard is deployed, it verifies Ed25519 signatures on incoming A2A requests. RFC-006 extends this to MCP tool invocations with per-call authorization. RFC-007 enables mutual authentication so clients can verify MCP server identity.
Threat: An attacker captures a valid signed request and replays it multiple times.
Mitigation: Strict iat/exp timestamp validation with a 60-second default window and 5-second clock skew tolerance. Requests outside this window are rejected.
Threat: A man-in-the-middle modifies the request body (e.g., changes transfer amount) after signing.
Mitigation: The signature covers a SHA-256 hash of the body (bh claim). Any modification to the body invalidates the signature.
Threat: An agent delegates authority to a sub-agent, which then exceeds its granted scope.
Future: RFC-004 introduces chain-of-custody tracing to verify delegation chains and detect missing or unauthorized hops.
What Guard Verifies Today
RFC-001–003 are generally available. These checks run per request when Guard is deployed inline.
Identity
- • Ed25519 signature verification
- • Trust Badge validation (Levels 0–4)
- • Key ID (
kid) resolution - • Issuer (
iss) claim verification
Integrity
- • SHA-256 body hash binding
- •
bhclaim verification - • Compact JWS format validation
- • Protected header integrity
Freshness
- •
iatissued-at validation - •
expexpiry enforcement - • 60s default time window
- • 5s clock skew tolerance
What Guard Doesn't Do
Honest boundaries. No false promises. Guard does one thing well.
Not a prompt filter
Guard doesn't inspect or sanitize prompt content. It verifies the caller, not the message semantics. Use dedicated prompt security tools for content filtering.
Not rate limiting
Guard doesn't throttle requests. Pair with your existing API gateway, Kong, Envoy, or rate limiter for request volume controls.
Not authorization
Guard proves who is calling, not what they're allowed to do. Authorization is your business logic. Guard handles authentication.
Not content moderation
Guard doesn't block toxic content or policy violations. Use appropriate content filters upstream. Guard focuses on identity, integrity, and freshness.
Not a replacement for IAM
CapiscIO handles agent-to-agent identity, not user authentication. Continue using Okta, AWS IAM, or your existing identity provider for user login.
Not LLM safety
We verify which agent sent a request and whether the payload was tampered with. We do not detect jailbreaks or prevent harmful model outputs.
Guard does one thing well: cryptographic identity verification with tamper detection and replay protection.
Telemetry & Privacy
How Guard handles logging and what it never logs
What Guard logs (when enabled)
- Decision outcomes (allow/deny)
- Agent ID (
issclaim) - Key ID (
kid) used for signing - Timestamps and decision duration
- Failure reasons (signature invalid, expired, body mismatch)
What Guard never logs
- Request body content or payloads
- Full JWS tokens
- Private keys or key material
- User PII or credentials
Example Telemetry Schema
If you log Guard outcomes, we recommend a structured JSON event like:
{
"ts": "2025-01-15T14:32:10.847Z",
"event": "guard.decision",
"decision": "allow", // or "deny"
"agent_id": "billing-agent",
"key_id": "billing-prod-2025",
"latency_ms": 2,
"endpoint": "/api/ledger/credit",
"method": "POST",
// Only present on deny:
"deny_reason": null, // or "signature_invalid", "expired", "body_mismatch"
"error_code": null // or "SG-001", "SG-002", etc.
}Exact fields depend on your integration. This format works well with Datadog, Splunk, and OpenTelemetry.
Trust Levels (RFC-002)
Progressive identity assurance for different deployment scenarios
| Level | Name | Verification | Use Case |
|---|---|---|---|
0 | Self-Signed (SS) | Agent generates and signs its own keys | Dev/test environments |
1 | Registered (REG) | Agent registered with CapiscIO CA (account verification) | Internal agents, staging |
2 | Domain Validated (DV) | Agent proves control of domain via DNS or HTTP challenge | Public agents, APIs |
3 | Organization Validated (OV) | Verified business entity information | B2B integrations |
4 | Extended Validation (EV) | Full organizational audit, security review, and legal agreement | Financial, healthcare |
Enforcement in Guard
Guard verifies the badge and returns the trust level in claims. Enforce requirements in your middleware:
# Verify badge and enforce minimum trust level
claims = guard.verify_inbound(badge_token, body=request.body)
# claims["trust_level"] contains the badge's trust level (0-4)
if claims["trust_level"] < 3:
raise HTTPException(403, "Organization Validated badge required")Ready to evaluate CapiscIO for your environment?
Start with the open source Guard and CLI. Contact us for security architecture reviews and enterprise deployments.