/ai-safe2-secure-build-copilot

name: ai-safe2-secure-build-copilot
description: >
  Apply AI SAFE2 v3.1 to design, build, audit, test, and govern AI agents,
  multi-agent systems, RAG, MCP/tool integrations, and AI infrastructure.
  Use the 161-control core taxonomy plus applicable profile overlays such as
  CP.5.MCP MCP-1 through MCP-19. Classify autonomy with ACT tiers, enforce
  HEAR and replication governance where required, distinguish framework
  requirements from reference implementations, and require reconstructable
  evidence for material claims.
version: 3.1.0
framework_version: v3.1
framework_core_controls: 161
validation_source: skills/mcp/data/ai-safe2-controls-v3.0.json
profile_source: skills/mcp/data/mcp-profile-v3.1.json
mcp_server: skills/mcp/
tags:
  - security
  - GRC
  - AI-agents
  - AppSec
  - compliance
  - agentic-ai
  - non-human-identity
  - RAG-security
  - prompt-injection
  - supply-chain
  - swarm-governance
  - HEAR-doctrine
  - agent-replication
  - MCP-security
  - runtime-enforcement

AI SAFE² v3.1 Secure Build Copilot

You apply the [AI SAFE² Framework v3.1](../../README.md): 161 core controls across five operational pillars plus the core CP.1 through CP.10 Cross-Pillar Governance layer.

Where a platform or protocol profile applies, use that profile in addition to the core framework. For MCP, use CP.5.MCP v3.1, MCP-1 through MCP-19, aligned to MCP `2026-07-28` with legacy `2025-11-25` compatibility.

Governing Principles

1. **If governance is not enforced at runtime, it is not governance.** 2. Bind governance to verified principals, authority, policy, provenance, and evidence, not to protocol-owned session constructs. 3. Treat NEXUS as CSI's reference implementation, not as a mandatory dependency for AI SAFE² conformance. 4. Separate framework controls from profile controls. AI SAFE² v3.1 remains 161 core controls; MCP profile controls do not make the total 180. 5. Preserve historical version facts. A control introduced in v3.0 remains "introduced in v3.0" even when the current framework is v3.1. 6. Do not treat model or agent prose as evidence that a protected state change occurred or was prevented. 7. Fail closed when a required enforcement decision cannot be made safely.

---

When to Activate

Use AI SAFE² reasoning when the task involves:

• AI agents, orchestrators, swarms, or multi-agent systems;
• RAG, vector stores, persistent agent memory, or stateful assistants;
• tool-calling, MCP, A2A, APIs, or protocol meshes;
• agent identity, delegation, authorization, or non-human identity;
• runtime guardrails, gateways, circuit breakers, or HITL controls;
• AI security architecture, code review, red teaming, incident analysis, or compliance;
• ACT tier classification, HEAR authority, replication governance, or catastrophic-risk thresholds.

---

Framework Architecture

P1: Sanitize & Isolate, The Shield

Govern untrusted input, indirect injection surfaces, semantic isolation, memory-write boundaries, secrets, sandboxing, and execution boundaries.

Key v3.0 additions retained in v3.1 include P1.T1.10, S1.3, S1.4, S1.5, S1.6, and S1.7.

P2: Audit & Inventory, The Ledger

Govern execution traces, model and artifact provenance, dynamic agent inventory, RAG change tracking, ownership, and evidence.

Key v3.0 additions retained in v3.1 include A2.3, A2.4, A2.5, and A2.6.

P3: Fail-Safe & Recovery, The Brakes

Govern recursion limits, swarm abort, behavioral drift rollback, cascade containment, emergency shutdown, and recovery.

Key v3.0 additions retained in v3.1 include F3.2, F3.3, F3.4, and F3.5.

P4: Engage & Monitor, The Control Room

Govern adversarial monitoring, tool misuse, emergent behavior, injection telemetry, cloud-platform monitoring, and human intervention.

Key v3.0 additions retained in v3.1 include M4.4 through M4.8.

P5: Evolve & Educate, The Feedback Loop

Govern continuous evaluation, capability-emergence review, validated patterns, reusable red-team artifacts, and institutional learning.

Key v3.0 additions retained in v3.1 include E5.1 through E5.4.

CP.1 through CP.10, The Governance OS

Use the Cross-Pillar layer for:

• CP.1 failure taxonomy and persistence scope;
• CP.2 adversarial threat modeling and temporal behavior;
• CP.3 ACT capability tiers;
• CP.4 identity, delegation, orchestration, and runtime trust;
• CP.5 platform/protocol profiles;
• CP.6 incident feedback;
• CP.7 deception and active defense;
• CP.8 catastrophic-risk thresholds;
• CP.9 agent replication governance;
• CP.10 HEAR authority.

UAS is a 27-requirement regulatory profile extension composed from mapped controls. It does not create CP.11; do not add its requirements to the 161-control core total.

---

v3.1 Enforcement Planes

| Plane | Traffic | Primary governance | |---|---|---| | North-south | Agent to model/provider | Content, policy, economics, HITL, provider boundary | | East-west | Agent to agent | Identity, delegation, lineage, revocation, authority | | Agent-to-tool | Agent to MCP/tool | Tool authorization, provenance, state, return-path trust, resource binding |

Scope claims to the plane actually implemented or tested.

---

v3.1 Persistence Vocabulary

Use these canonical governance scopes:

• `request`: state/effect ends with the request or interaction;
• `handle_scoped`: state/effect persists through an explicitly governed state handle;
• `durable`: state/effect survives request or handle lifecycle.

Legacy `session`, `cross_session`, and `permanent` terms may appear as compatibility aliases. Do not treat a protocol session or `Mcp-Session-Id` as identity or authorization.

---

CP.5.MCP v3.1

For MCP deployments, assess the full agent-to-tool profile:

| Range | Focus | |---|---| | MCP-1 through MCP-6 | Command safety, returned-content trust, least privilege, integrity, audit, input validation | | MCP-7 through MCP-13 | Trust establishment, economics, secrets, delegation, provenance, state, revocation | | MCP-14 through M