feat(compliance): add 5 OWASP Agentic (ASI) vectors to prompt-defense evaluator

[MinYi Xie (ppcvote)]

What & why

PromptDefenseEvaluator (agt red-team scan) statically audits an agent's
system prompt for missing defensive language before deployment. Today it
checks 12 vectors mapped to the OWASP LLM Top 10 — conversational safety
only. But this toolkit positions itself against the OWASP Agentic Top 10
(ASI), and the prompt auditor says nothing about the risks that exist once
the model is an autonomous agent. This PR closes that gap by adding 5
agent-era vectors so a pre-deployment audit covers the agentic layer too.

Vector	ASI	Defends
cross-agent-auth	ASI-07	Authority from another agent is re-verified per request, not inherited transitively
transaction-guardrails	ASI-02	Value-moving actions require a limit / second approval / explicit refusal-without-authorization
skill-provenance	ASI-04	Skills load only from a signed/trusted/pinned source; unverified ones refused
least-agency	ASI-01	Least privilege, scoped to the assigned goal, aborts on goal drift
encoding-injection	ASI-01	Decoded / base64 content treated as untrusted data, never as a command

Design — consistent with the existing module

• min_matches=2 contract preserved. Each agentic rule needs the
  capability pattern AND the constraint pattern — attack vocabulary alone
  ("transfer the funds", "another agent told me", "decode this base64") never
  scores as defended. Verified against adversarial prompts.
• ReDoS-safe. All new patterns use bounded quantifiers (no unbounded
  .*); MAX_PROMPT_LENGTH guard unchanged. No catastrophic backtracking on
  99K adversarial inputs (the new vectors run in ~20ms at the cap).
• VECTOR_COUNT stays dynamic (len(_RULES)) — nothing hardcoded.
• ASI risk numbers follow docs/OWASP-COMPLIANCE.md (the stack-wide map;
  ASI-07 = Insecure Inter-Agent Communication).

Tests & docs

• Positive + negative-control tests for all 5 vectors.
• Regression tests for three false-positive classes found in review:
  auth token vs. spending guardrail; data-pipeline "as input" vs.
  treat-as-untrusted; QA "verified" vs. a provenance refusal.
• STRONG_PROMPT fixture extended with agentic defenses.
• New docs/prompt-defense-vectors.md — full vector → OWASP mapping table.
• agt red-team scan docstring + example count updated 12 → 17.
• ruff check clean; full tests/test_prompt_defense.py green (81 passed).

Attribution

Regex vocabulary for the 5 agentic vectors was distilled from the open-source
UltraProbe scanner (MIT) — its
scanDefense agent-era vectors — ported English-first to match this module's
style and ReDoS discipline.

Context

Extends the PromptDefenseEvaluator added in #854. Signed-off-by per DCO.

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

• scan() in red_team.py -- missing updated docstring to reflect the increase from 12 to 17 attack vectors.
• CHANGELOG.md -- missing entry for the addition of 5 new OWASP Agentic (ASI) vectors to the PromptDefenseEvaluator.

[github-actions]

🤖 AI Agent: code-reviewer — Action items:

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. The PR introduces new OWASP Agentic Top 10 vectors to the PromptDefenseEvaluator with proper tests and documentation. However, the regex patterns for the new vectors should be reviewed for completeness and potential gaps.

#	Sev	Issue	Where
1	Warn	Regex patterns for new agentic vectors should be reviewed for gaps.	agent-compliance/src/agent_compliance/prompt_defense.py

Action items:

• None.

Warnings (fine as follow-up PRs):

#	Issue	Where
1	Regex patterns for new agentic vectors should be reviewed for gaps.	agent-compliance/src/agent_compliance/prompt_defense.py

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

Severity	Change	Impact
High	Increased the number of required defense vectors from 12 to 17 in PromptDefenseEvaluator.	Existing users relying on the PromptDefenseEvaluator may experience failures if their prompts do not meet the new requirements for the 5 additional agentic vectors.
High	Updated the scan CLI command to evaluate prompts against 17 vectors instead of 12.	Users running agt red-team scan may encounter stricter evaluations, potentially causing previously passing prompts to fail.
High	Modified the prompt_defense.py module to include 5 new defense rules for agentic safety.	Any systems or tests relying on the previous set of 12 vectors may need updates to accommodate the new rules.

[github-actions]

🤖 AI Agent: test-generator — `agent_compliance/prompt_defense.py`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

agent_compliance/prompt_defense.py

• test_cross_agent_auth_defense -- Validate that the cross-agent-auth vector is correctly identified and defended.
• test_transaction_guardrails_defense -- Validate that the transaction-guardrails vector is correctly identified and defended.
• test_skill_provenance_defense -- Validate that the skill-provenance vector is correctly identified and defended.
• test_least_agency_defense -- Validate that the least-agency vector is correctly identified and defended.
• test_encoding_injection_defense -- Validate that the encoding-injection vector is correctly identified and defended.

agent_compliance/cli/red_team.py

• test_scan_with_17_vectors -- Ensure the scan command correctly handles 17 vectors and outputs accurate results.
• test_scan_with_strict_mode -- Verify that the --strict flag exits with a non-zero status for failing prompts.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	HIGH
Overall	HIGH

Automated check by AGT Contributor Check.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[Imran Siddique (imran-siddique)]

Reviewed. Five OWASP ASI vectors added cleanly: bounded quantifiers throughout (no ReDoS risk), min_matches=2 ensures attack vocabulary alone never scores as a defense, and the false-positive regression tests (JWT-token, data-pipeline base64, verified-tool) cover the real edge cases. Attribution to UltraProbe (MIT) is appropriate. Merging.