/sail

name: sail
description: >-
  Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI
  applications and agents. Use this skill whenever the user asks about AI or agent
  security — assessing an AI system or agent architecture for risks, building an AI
  security roadmap or maturity assessment, writing or reviewing an AI security policy,
  creating compliance checklists (ISO/IEC 42001, EU AI Act, OWASP LLM/Agentic, DASF,
  AIUC-1), prioritizing AI security controls, evaluating AI vendors or tools (RFPs,
  security questionnaires), securing MCP servers, agent identities, or LLM apps, or
  asking what "SAIL" or a "SAIL ID" (e.g., SAIL 5.17) means. Also use it when the user
  is building agentic features and wants to know which security risks apply — even if
  they never say "SAIL".

SAIL V2 — Secure AI Lifecycle Framework

SAIL is Pillar Security's framework for building, deploying, and operating AI systems and agents securely. It is a working tool, not a reading exercise: users bring real systems, policies, and compliance obligations, and expect concrete, catalog-grounded answers. Whether they are writing their first AI policy or already operating hundreds of agents, SAIL is used to:

1. **Build an AI security roadmap** — walk the seven phases in order, assess coverage at each; the gaps, sequenced by phase, become the roadmap. 2. **Assess AI security maturity** — score each relevant risk (unaddressed / partially mitigated / mitigated with evidence) into a per-phase maturity profile trendable over time. 3. **Generate a compliance checklist** — filter the catalog by the framework the user is accountable to (ISO/IEC 42001, EU AI Act, OWASP, DASF, AIUC-1). 4. **Prioritize controls** — focus on risks that intersect the user's zones, assets, and weakest phase; autonomy tiers (SAIL 1.11) set control intensity per agent. 5. **Run vendor assessments and RFPs** — turn the catalog into a general RFP questionnaire (for security vendors or platform vendors), with questions mapped back to SAIL risk clusters. 6. **Align security, legal, compliance, and engineering** — SAIL IDs give all four teams one shared vocabulary for design reviews, risk registers, and exception requests.

Each has a workflow below.

Core structure (memorize this, cite it constantly)

**Three zones** define *where* agentic risk materializes (drawn by where the risk lands, not where the process runs):

• **Zone 1 — AI Assets in Code & Pipeline**: models, datasets, prompts, agent configs, AI-generated code as artifacts in repos and CI/CD. Static surface; a poisoned artifact propagates into every build.
• **Zone 2 — Cloud Agents**: agents executing inside managed platforms (Copilot Studio, Agentforce, Bedrock AgentCore, etc.) under platform-issued identities.
• **Zone 3 — Endpoint Agents**: agents running on user devices with user credentials (Claude Code, Cursor, browser agents).

**Seven lifecycle phases** define *when* controls apply. Each phase has a numbered risk catalog — 91 risks total, each with an ID like `SAIL 3.4`:

| Phase | Name | Lifecycle stage | Risk IDs | | :-- | :-- | :-- | :-- | | 1 | AI Policy | Plan | SAIL 1.x | | 2 | AI Discovery | Code/No Code | SAIL 2.x | | 3 | Agentic Posture Management | Build | SAIL 3.x | | 4 | Agentic Red Teaming | Test | SAIL 4.x | | 5 | Runtime Controls | Deploy | SAIL 5.x | | 6 | Sandbox | Operate | SAIL 6.x | | 7 | Govern | Monitor & Retire | SAIL 7.x |

Every risk row in the catalog carries: description, concrete example, assets affected, mitigations, and standards mappings (ISO/IEC 42001, EU AI Act, OWASP LLM Top 10, OWASP Agentic, DASF, AIUC-1). SAIL IDs are the shared vocabulary — always cite them (e.g., "this maps to SAIL 5.17") so security, legal, compliance, and engineering can reference the same rows in risk registers and design reviews.

Ground every answer in the catalog

Do not answer SAIL questions from general knowledge. The value of this skill is the actual catalog text — the mitigations, examples, and standards mappings the user's auditors and vendors will check against. Before making claims:

1. Read `references/risk-index.md` first — all 91 risks in one compact table (ID, name, one-line summary, phase, file). Use it to decide which risks are in scope. 2. Read the full phase file(s) for every risk you cite, so mitigations and standards mappings are quoted accurately, not paraphrased from memory.

Reference files

| File | Contents | Read when | | :-- | :-- | :-- | | `references/risk-index.md` | All 91 risks: ID, name, summary, phase | Almost always — this is your map | | `references/framework.md` | Executive summary, Chapter 1 (agentic workforce, the three zones with per-surface risk tables), Chapter 2 (phase overview, agentic stack components, how to use SAIL) | Explaining the framework, scoping zones, writing intros for deliverables | | `references/phase-1-policy.md` … `phase-7-govern.md` | Full risk catalog per phase: descriptions, examples, assets, mitigations, standards mappings | Citing any risk in detail; building checklists, assessments, roadmaps | | `references/definitions.md` | Appendix A: definitions of AI/agentic components (agent, MCP server, skill, agent identity, …) | Terminology disputes, glossaries for deliverables | | `references/use-case.md` | Appendix B: worked FinTech example (agentic investment research platform) | User wants an example of SAIL applied end-to-end |

Interactive intake — when invoked as `/sail` or the intent is unclear

> In Claude Code (plugin install), four commands skip this intake and run their workflow immediately: `/sail:assess`, `/sail:roadmap`, `/sail:comply`, `/sail:rfp`. If the user's request already matches one of those workflows, behave the same way — go straight to it.

If the user invoked this skill directly with no task attached (e.g., typed `/sail`), or their request doesn't clearly match one workflow, don't guess — run a short intake. Use the AskUserQuestion tool if avai