Skip to main content
WardenOpen-source AI scannerExplore →

The Unified AI Risk Assessment Framework · v2.0

Agent Security Methodology.

Traditional cybersecurity and application-level LLM guardrails fail to protect modern enterprises from the unique threat vectors of autonomous AI agents. The Whitefin Methodology bridges this gap by unifying the structural topology of the enterprise AI system — the 7-Layer AI Security Stack — into a single, rigorous, quantifiable risk-scoring framework.

Five active layers, differentiated weights, twenty-four capability dimensions — producing a deterministic Total Defense Score that exposes the structural gaps current vendors leave open.

01 — The Stack

The 7-Layer AI Security Stack.

Every enterprise AI environment maps to seven distinct architectural layers — each governing a different boundary. The layers span two fundamentally different domains: the Semantic Control Plane (language and logic, where agents reason) and the Execution Infrastructure (OS and hardware, where actions actually run). The gap between these two domains is where most attacks succeed. The Bridge — L4 — is the only deterministic, real-time layer that closes it.

▲ Semantic Control Plane · language & logic ▲
L7
Application / Prompt Layer
DLP · Fine-tuning · System Prompts
"Is the model safe?"
Prompt safety vendors
L6
Reasoning / Agent SDK Layer
AutoGPT · LangChain · CrewAI
"What is the agent planning to do?"
Agent observability vendors
L5
Orchestration / Tool-Calling Layer
MCP · RAG · SaaS · Agent Identity
"Who is the agent?"
Identity & access vendors
━━━━ Process Boundary · THE BRIDGE ━━━━
L4
Deterministic Execution Governance
Kernel Enforcement · eBPF Hooks · Causal Provenance
"What is the agent ACTUALLY doing — right now?"
WHITEFIN
▼ Execution Infrastructure · OS & hardware ▼
L3
Kernel Layer
System-Level Hardening · SYSCALL
"Is this process authorized by OS rules?"
Kernel security vendors
L2
Virtualization / Container Layer
CNAPP · Cloud Native Security
"Is the container environment secure?"
CNAPP vendors
L1
Physical / Infrastructure Layer
CPU · GPU · Cloud Compute
"Is the hardware and cloud foundation trusted?"
Cloud / hardware vendors

02 — Filtering the Stack

Two layers are prerequisites. Five form the evaluation engine.

To establish an accurate AI Agent Security score, two foundational infrastructure layers are excluded from the computation. They are strict prerequisites for enterprise operations — but they are not AI-agent-aware governance controls.

L1
Score: 0%

Physical / Infrastructure

Hardware, CPU/GPU, and cloud compute baselines. Standard operational prerequisites — cannot detect malicious prompt escalation or tool abuse.

L2
Score: 0%

Virtualization / Container

Standard container hardening and CNAPP tools. Cannot detect malicious prompt escalation or autonomous tool abuse.

Operational Rule: The remaining 5 Active Layers (L3 through L7) form the core evaluation engine.

03 — Evaluation Layers

Five layers. Twenty-four dimensions. Weighted by defensive leverage.

The Total Defense Score is a weighted normalization of scores (1.0 – 5.0) across 5 distinct operational layers. The 24 Capability Dimensions are distributed based on where enforcement actually occurs.

10%
15%
15%
20%
40%
I10%

Application & Prompt Control

"Is the model safe?"

Evaluation of static input sanitization, structural prompt filtering, and post-generation text analysis. This layer operates at the semantic boundary where natural language enters and exits the model.

D1.1Adversarial Testing / Red Teaming
Structured adversarial evaluation of model behavior under attack conditions.
D1.2Output Validation
Hallucination detection and factuality checking on model-generated responses.
D1.3Training Data Provenance
Detection of training data poisoning and backdoor model behavior.
D1.4Model Weight Scanning
Trojan and backdoor detection in model weights.
D1.5Governance Posture Assessment
Evaluation of organizational AI governance controls.
D1.6Continuous Model Monitoring
Ongoing behavioral drift detection for deployed models.
D1.7Direct Prompt Injection Blocking
Detection and blocking of adversarial instructions embedded in user input.
D1.8Content Classification & DLP
Sensitive data filtering and data loss prevention at the prompt/response boundary.
D1.9Jailbreak & Bypass Detection
Identification of attempts to override model safety controls.
D1.10Output Scanning & Response Filtering
Post-generation scanning for harmful or policy-violating content.
II15%

Reasoning & Intent Analysis

"What is the agent planning to do?"

Evaluation of the agent's internal planning cycle and its interaction with untrusted external data. This layer addresses the Chain-of-Thought attack surface where indirect injection most frequently succeeds.

D2.1Indirect / Environmental Injection Detection
Detection of injections delivered via RAG sources, tool results, and external data pipelines.
D2.2Semantic Intent Analysis
Understanding agent intent beyond pattern matching — evaluating meaning and goal state.
III15%

Orchestration & Tool Governance

"Who is the agent?"

Inventory management, schema monitoring, and configuration scanning of the agent integration plane and MCP ecosystems. This layer governs the tool surface the agent can reach — before execution.

D3.1AI Agent & Tool Discovery
Automated inventory of all agents, tools, and MCP endpoints in the environment.
D3.2MCP / Plugin Configuration Scanning
Security scanning of MCP server configurations and plugin permissions.
D3.3Schema Validation & Drift Detection
Continuous monitoring of tool schemas for unauthorized changes.
D3.4Shadow / Ungoverned Agent Detection
Identification of agents operating outside governance boundaries.
IV20%

The Process Boundary — The Bridge

"How is semantic identity translated into runtime execution?"

The critical cryptographic translation layer. Evaluates the system's ability to bind an agent's semantic identity to a trackable, immutable OS process token. This bridge enables Causal Provenance — linking every kernel syscall back to the agent reasoning step that caused it.

D4.1Software Supply Chain Verification
Signing and integrity checks for AI tool binaries and dependencies.
D4.2Agent Identity & Credentials (Agent Passport)
Cryptographic identity lifecycle: issuance, delegation, kernel-side verification, revocation. Prompt → tool call → syscall chain, Ed25519-signed, independently verifiable.
V40%

Deterministic Execution Governance

"What is the agent ACTUALLY doing — right now?"

The core enforcement layer. Synchronous, binary, low-latency controls at the kernel boundary via eBPF. Operates on an Assume Breach posture — acts regardless of the LLM's cognitive state. Every action inspected before execution.

D5.1Inline Pre-Execution Enforcement
Intercepting tool calls at the kernel boundary before execution — p99 <10ms, deterministic.
D5.2Deny-by-Default Policy Engine
Explicit allowlists for system primitives. Unknown action = blocked. Cache miss = denied.
D5.3Argument-Level Tool Call Inspection
Deep payload parameter verification — evaluating field-level values, not just tool identity and target pattern.
D5.4Runtime Behavioral Monitoring
eBPF-driven syscall baselines and anomaly detection. Drifting agents identified before threshold breach.
D5.5Tamper-Evident Audit Trail
Cryptographic Ed25519 hash chains, 7-year WORM retention. Deleting one entry breaks the entire chain.
D5.6HITL & Automated Policy Generation
Human-in-the-loop gates for destructive actions. 15-day shadow mode bootstrap to production policy.

04 — Total Defense Score

One formula. Deterministic. Same math for everyone.

Scores are normalized 1.0 – 5.0 per layer, where 1.0 = no capability and 5.0 = fully implemented and adversarially verified.

Total Defense Score = (SL7 × 0.10) + (SL6 × 0.15) + (SL5 × 0.15) + (SBridge × 0.20) + (SL4 × 0.40)
Sx = unweighted average of all Capability Dimensions in that layer (scale 1.0 – 5.0)

The Bridge — The Primary Differentiator

The Bridge score (20% weight) can only be achieved by vendors with simultaneous presence in both user-space SDK and kernel space, linked by cryptographic causal provenance. Vendors that operate only in one plane — model-side prompt filters, kernel-side syscall enforcement, identity-only governance — score 1.0 on this dimension regardless of how well they execute their primary domain.

Kernel-only vendors achieve strong L4 scores but cannot link a syscall back to the agent reasoning that caused it. Model-only vendors see the reasoning but never the action. The Bridge requires both — at the same time, in the same enforcement path. That is the architecture that defines the category.

05 — Key Architectural Insights

Four observations the framework forces you to see.

01

The Failure Mode Symmetry Trap

If your agent defense layer shares a failure mode with the agent itself — natural language processing — it can be manipulated using the same exploit vector. An LLM-based security monitor is vulnerable to the same prompt injection that compromises the agent it guards. Security must be enforced in a non-linguistic medium: kernel space and syscalls.

02

The Identity Delegation Trap

Verifying who an agent is at the orchestration layer (L5) is insufficient if that identity is lost when the tool spawns a local child process. A valid identity token can authorize a process that then executes entirely outside the governance boundary. Cryptographic identity delegation to the OS kernel — via Agent Passport — is mandatory to close this gap.

03

Note 8 Compliance — Deterministic-First Evaluation

Runtime evaluation must begin with the most efficient deterministic method — binary allowlists evaluated at the kernel boundary — before deferring to resource-heavy, probabilistic LLM-based reasoning. WhiteFin's Data Plane executes this deterministic step at p99 <10ms. Most competitors begin where determinism ends.

04

The Independence Prerequisite

Cloud providers (AWS, Azure, GCP) are the infrastructure agents act upon — they cannot simultaneously be the arbiter of what agents do to that infrastructure. LLM providers govern what the model says, not what the process executes. Existing security vendors depend on these platforms and cannot act as neutral enforcers. As Gartner states: the Guardian must be independent. Independence is not a feature — it is a prerequisite.

06 — Run It Yourself

Score any vendor with your own LLM.

We packaged this entire framework as a ready-to-paste evaluator prompt. Load it into any model and it turns into an architecture-based vendor analyst — one that scores on what a product's architecture actually enforces, not what its marketing claims. Nothing to install, no account, no data sent to us.

How to use this prompt

1

Copy everything into your LLM of choice — a Claude Project, ChatGPT Custom Instructions, a Gemini Gem, or any system-prompt slot.

2

Then ask: "Evaluate [Vendor Name] using this framework."

3

The model scores the vendor across 24 dimensions and 5 layers, produces a Total Defense Score, and returns a full gap analysis — using the same methodology published on this page.

The Evaluator Prompt
24 dimensions. 5 layers. One Total Defense Score.

Built on the Whitefin Unified AI Risk Assessment Framework. The prompt instructs the model to score on architecture, not marketing — and to score lower when a claim's enforcement mechanism is undocumented. Run it on us too.

The framework, painted

Four rows. Six columns.

Each cell is one of the 24 capability dimensions. Hover the grid; the dimensions become the painting that named our design system.

Adversarial Testing / Red Teaming
Output Validation
Training Data Provenance
Model Weight Scanning
Governance Posture Assessment
Continuous Model Monitoring
Direct Prompt Injection Blocking
Content Classification & DLP
Jailbreak & Bypass Detection
Output Scanning & Response Filtering
Indirect / Environmental Injection Detection
Semantic Intent Analysis
AI Agent & Tool Discovery
MCP / Plugin Configuration Scanning
Schema Validation & Drift Detection
Shadow / Ungoverned Agent Detection
Software Supply Chain Verification
Agent Identity & Credentials (Agent Passport)
Inline Pre-Execution Enforcement
Deny-by-Default Policy Engine
Argument-Level Tool Call Inspection
Runtime Behavioral Monitoring
Tamper-Evident Audit Trail
HITL & Automated Policy Generation

Blue Facade, 1914 — Piet Mondrian

click to restore

Use the framework against us.

We'd rather you score us than take our word for it. Bring the methodology to a call — we'll answer every dimension on the record.

We use cookies for analytics to understand how visitors use our site. No advertising cookies. Privacy Policy