From bfb791c1a01b601ca5c999e41db8e6543cf5d1b0 Mon Sep 17 00:00:00 2001 From: dzeusking-dev Date: Thu, 3 Sep 2026 22:02:54 +0200 Subject: [PATCH 1/3] fix(agentic-ai): move Static and dynamic analysis of AI generated code to level 3 in the dimension table --- ARCHITECTURE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 779dbf4..76d7794 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -174,9 +174,9 @@ development and the security of AI-based features: | Verification | Human review of AI generated plans | 2 | | Verification | Validation of AI-suggested dependencies | 2 | | Verification | Self-verification of AI generated changes | 2 | -| Verification | Static and dynamic analysis of AI generated code | 2 | | Verification | Human review of AI generated code | 3 | | Verification | Security test generation with AI | 3 | +| Verification | Static and dynamic analysis of AI generated code | 3 | | Verification | No verification bypass for AI generated code | 3 | | Verification | Continuous detection of compromised AI components | 4 | | Verification | Drift detection for agent instructions and guardrails | 5 | From 053175a04ac0bf4339f53e9beaf69a61d731aec2 Mon Sep 17 00:00:00 2001 From: dzeusking-dev Date: Thu, 3 Sep 2026 22:07:11 +0200 Subject: [PATCH 2/3] fix(agentic-ai): update stale dependsOn comments and description cross-reference to canonical titles --- src/assets/YAML/default/AgenticAI/Guidance.yaml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/assets/YAML/default/AgenticAI/Guidance.yaml b/src/assets/YAML/default/AgenticAI/Guidance.yaml index e164c59..2da5649 100644 --- a/src/assets/YAML/default/AgenticAI/Guidance.yaml +++ b/src/assets/YAML/default/AgenticAI/Guidance.yaml @@ -65,7 +65,7 @@ Agentic AI: The rules are to be dynamically imported during the correct spec-driven development phase. dependsOn: - - 51ebc877-c4fd-4b50-9305-320152242ddf # Basic secure coding rules for AI assistants + - 51ebc877-c4fd-4b50-9305-320152242ddf # Static load of security rules - 923a2a23-d63b-421c-926a-191d1dd5f570 # Spec-driven development assessment: | - Show the rule sets for the languages and frameworks. @@ -688,8 +688,8 @@ Agentic AI: requirements from the specification are carried through plan, implementation and review steps. dependsOn: - - 51ebc877-c4fd-4b50-9305-320152242ddf # Basic secure coding rules for AI assistants - - 1caad69c-316c-422a-a56b-04ad6f6cc306 # Security requirements for AI-assisted development + - 51ebc877-c4fd-4b50-9305-320152242ddf # Static load of security rules + - 1caad69c-316c-422a-a56b-04ad6f6cc306 # Threat modeling rule - 923a2a23-d63b-421c-926a-191d1dd5f570 # Spec-driven development - 364123db-b41c-431a-94a0-dfd8236b2daa # Instructed load of security rules assessment: | @@ -731,8 +731,7 @@ Agentic AI: as poisoning targets; model output as an injection vector. The subject here is the product: applications that contain AI components. Passing security requirements into AI-*assisted* implementation of arbitrary - features is covered by _Security requirements for AI-assisted - development_. + features is covered by the _Threat modeling rule_ activity. A data-centric approach works well for the AI delta: follow the data (prompts, retrieved documents, tool results, training and evaluation From 71bd9be6ff4ceb124529f65e4f1695280408dcad Mon Sep 17 00:00:00 2001 From: dzeusking-dev Date: Thu, 3 Sep 2026 22:09:14 +0200 Subject: [PATCH 3/3] fix(agentic-ai): raise Static and dynamic analysis of AI generated code to level 3 and fix stale dependsOn comment --- src/assets/YAML/default/AgenticAI/Verification.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/AgenticAI/Verification.yaml b/src/assets/YAML/default/AgenticAI/Verification.yaml index d7d86fb..f85e3ab 100644 --- a/src/assets/YAML/default/AgenticAI/Verification.yaml +++ b/src/assets/YAML/default/AgenticAI/Verification.yaml @@ -246,7 +246,7 @@ Agentic AI: injection payloads). Review generated tests like any other AI-generated code and run them in the delivery pipeline. dependsOn: - - 1caad69c-316c-422a-a56b-04ad6f6cc306 # Security requirements for AI-assisted development + - 1caad69c-316c-422a-a56b-04ad6f6cc306 # Threat modeling rule - d6bc0b7f-fd98-49fe-b66c-7c5fa70452c6 # Human review of AI generated code assessment: | - Show security test cases generated from acceptance criteria or threat models and their human review. @@ -362,7 +362,7 @@ Agentic AI: time: 2 resources: 2 usefulness: 4 - level: 2 + level: 3 tags: - ai - verification