TECHNICAL SPECIFICATION · PUBLIC

AIIS Implementation Schema

Machine-readable representation of 79 controls across 19 domains.

Publication content

ODA3 INSTITUTE

WHERE AI GOVERNANCE MEETS OPERATIONAL REALITY

AI-IRF IMPLEMENTATION SCHEMA (AIIS)

Machine-Readable Specification v1.0 — Companion Artifact to AI-IRF® v1.0

79 controls · 19 domains · 8 SOAR-ready playbooks · 12 severity classes · 5 conformance profiles

Section 1 — Purpose and Relationship to UAIS

AI-IRF® v1.0 (AI Incident Response Framework v1.0) has, until this publication, existed only as a prose technical specification (ODA3-2026-06-TCR-HAI-001): 79 controls expressed as human-readable SHALL statements, auditable by a CB assessor but not directly consumable by software.

The AI-IRF Implementation Schema (AIIS) v1.0 closes that gap. It is the structured, machine-readable encoding of all 79 controls — canonical field names, typed values, and playbook definitions — designed for direct ingestion by SOAR platforms, GRC tools, and CB automated assessment software. The schema reserves an optional conformance_test structure for embedded test vectors; this is planned for a future AIIS release and is not populated in v1.0.0.

What AIIS Makes Possible

  • SOAR/XSOAR vendors can ingest PlaybookDefinition objects directly — no custom integration work required to operationalise AI-IRF® v1.0 response logic
  • GRC platforms can map ControlRecord objects to existing compliance registers programmatically, rather than re-keying 79 controls by hand
  • Future releases are planned to enable CBs to build automated pre-audit conformance scanners using ConformanceTest objects, reducing manual evidence review time
  • Self-assessing organisations can run a scripted gap analysis against the schema before engaging a CB, lowering the cost of the readiness stage

    • What This Document Is Not

    AIIS does not replace the Technical Report (TCR-HAI-001) as the normative source of truth. Where this schema and the Technical Report conflict, the Technical Report governs, consistent with GEL §10.2 (ODA3 sole version control authority). AIIS is a derived, machine-readable representation of the same 79 controls.

    Methodology Note

    Notably Absent

    Section 2 — Schema Overview

    The schema defines five top-level object types. Each is detailed in this section with its complete field reference, followed by the full JSON Schema source in Appendix A.

    ControlRecord — Field Reference

    PlaybookDefinition — Field Reference

    Section 3 — Complete Control Record Reference (All 79 Controls)

    Domain 1 — MCP & A2A Protocol Security (7 controls)

    Domain 2 — Shadow AI & Continuous Visibility (5 controls)

    Domain 3 — Adaptive Machine-Speed Response (5 controls)

    Domain 4 — Model Extraction & Distillation Defenses (4 controls)

    Domain 5 — AI-BOM & Supply Chain Integrity (5 controls)

    Domain 6 — Agentic Permission Architecture (5 controls)

    Domain 7 — Regulatory & Compliance Operations (4 controls)

    Domain 8 — Physical AI & Safety Integration (4 controls)

    Domain 9 — Model Lifecycle Security (5 controls)

    Domain 10 — Zero Trust Architecture for AI (ZTAI) (4 controls)

    Domain 11 — Detection Reliability (3 controls)

    Domain 12 — Agentic Threat Detection (3 controls)

    Domain 13 — Severity Classification (2 controls)

    Domain 14 — Content Safety (7 controls)

    Domain 15 — Federated Learning Security (4 controls)

    Domain 16 — Model Merge Defense (3 controls)

    Domain 17 — Quantization Security (3 controls)

    Domain 18 — Hallucination Detection (5 controls)

    Domain 19 — Post-Quantum Cryptography (1 control)

    Section 4 — SOAR-Ready Playbook Definitions (8 Playbooks)

    These 8 playbooks cover every AI-IRF® v1.0 control with automatable, time-bound response logic. Each is expressed as a PlaybookDefinition object ready for ingestion into SOAR platforms per the OEM technology licensing model (ODA3-2026-06-STR-COM-001 Stage 6: ServiceNow, Splunk, Palo Alto XSOAR, Microsoft Sentinel, IBM QRadar/Resilient).

    PB-SAI-001 — Shadow AI Auto-Quarantine

    PB-MSR-001 — Machine-Speed Agentic Containment

    PB-MEX-001 — Model Extraction Response

    PB-APA-001 — Agentic Permission Overreach Response

    PB-APT-001 — Agentic Threat Detection Response

    PB-MLC-001 — Compromised Model Rollback

    PB-MMD-001 — Model Merge Backdoor Response

    PB-PHY-001 — Physical AI Safety Failsafe

    Section 5 — Severity Classification (12 Incident Classes)

    AI-IRF® v1.0 severity scoring follows the same 0–10 scale and SEV-1 through SEV-4 levels as UAIF, with the regulatory_trigger threshold fixed at 6.5 for cross-framework consistency (UAIF TCR-STD-002 §4.7).

    Severity Score Bands

    Section 6 — Conformance Profiles and Implementation Roadmap

    Reference Implementation Roadmap

    UAIF’s reference implementation ships as the oda3-uaif Python package. AIIS does not yet have an equivalent package. The following roadmap closes that gap:

    Appendix A — Complete JSON Schema Source

    The complete, valid JSON Schema (Draft-07) for AIIS v1.0. This is the authoritative machine-readable artifact — copy directly for implementation. Canonical URL: https://docs.oda3.org/schemas/airf/aiis-v1.0.schema.json

    Appendix B — Sample Control Records

    Three representative ControlRecord instances showing the schema populated with real AI-IRF® v1.0 control data.

    Appendix C — Sample Playbook Definition

    PB-MSR-001 (Machine-Speed Agentic Containment) as a complete, valid PlaybookDefinition instance — ready for direct ingestion into a SOAR platform content pack.

    © 2026 ODA3 Pvt Ltd. All Rights Reserved. | GEL v1.0 | Public | ODA3-2026-06-TCR-HAI-003 | https://docs.oda3.org/

    Document IDVersionDateClassification
    ODA3-2026-06-TCR-HAI-003v1.01 June 2026Public | GEL v1.0
    GAISSF ECOSYSTEM LICENCE (GEL v1.0) | ODA3-2026-06-TCR-HAI-003 | Public Published by ODA3 Institute (ODA3 Pvt Ltd) under GEL v1.0, effective 1 June 2026. Classification: Public. Commercial Use of this schema in products or services requires a separate written commercial licence (GEL §3.4). AI training data use prohibited without licence (GEL §3.6). AI-IRF®, AI IRF CERT®, GAISSF™, UAIF®, and ODA3® are registered trademarks of ODA3 Pvt Ltd (GEL §9.1). ODA3 Institute is the sole owner, proprietor, and governing body of all GAISSF Ecosystem frameworks in perpetuity (GEL §10.5). Governing law: Republic of India; DIAC arbitration, New Delhi seat (GEL §14). Attribution (GEL §6): AI-IRF Implementation Schema (AIIS) v1.0 © ODA3 Institute, GEL v1.0. Companion artifact to UAIS v1.0. Schema: https://docs.oda3.org/schemas/airf/aiis-v1.0.schema.json | CONTACT_AT_ODA3_DOT_ORG
    RELATIONSHIP TO UAIS AIIS is structurally parallel to UAIS v1.0 (oda3.org/schemas/uaif/uais-v1.0.schema.json), the existing machine-readable schema for UAIF®. Where UAIS encodes incident records and harm-weighted severity scoring for cross-framework reporting, AIIS encodes control conformance, response playbooks, and AI-IRF®-specific severity classification. A vendor already integrating UAIS will recognise the same design conventions in AIIS: canonical IDs, $id namespace under oda3.org/schemas/, evidence tier tagging, and a severity score band structure intentionally aligned to UAIS’s corrected level_4_high band (6.5–8.4).
    METHODOLOGY Control definitions, SHALL statements, and domain structure in this schema are drawn directly from ODA3-2026-06-TCR-HAI-001 [T1] and the four Option B normative extensions ODA3-ECO-011 (Content Safety), ODA3-ECO-013 (Federated Learning, Model Merge Defense, Quantization Security), ODA3-ECO-014 (Hallucination Detection), and ODA3-ECO-015 (Post-Quantum Cryptography) [T1]. Playbook step sequences and time-bound SLA values are derived from the same source documents [T1] with confidence thresholds set as illustrative defaults pending CB field calibration [T3]. Severity score values for the 12 incident classes are calibrated against the existing UAIF severity_presentation_score model for cross-framework consistency [T2] and have not yet been validated against a production incident dataset [T3] — organisations adopting AIIS should treat the supplied thresholds as starting defaults, tunable per deployment.
    NOTABLY ABSENT This schema does not include: (1) a reference implementation package (UAIF has oda3-uaif on PyPI; no equivalent oda3-airf package exists yet — see Section 6 Roadmap); (2) field-validated confidence thresholds for playbook trigger_condition objects — the values supplied are designed defaults, not empirically derived; (3) a paired Executive Brief under this identifier — this is a technical artifact aimed at engineering and CB tooling audiences, not board-level readers; (4) PII-specific field handling guidance — organisations must apply their own data classification policy to any personal data captured in evidence_type log_record fields; (5) a formal OSCAL profile mapping — AIIS uses a custom JSON Schema rather than OSCAL natively; an OSCAL crosswalk is a candidate for v1.1.
    CORRECTION HISTORY This is v1.0 of AIIS, built against the corrected ODA3-2026-06-TCR-HAI-001 (revised to formally specify Domains 11–13 and restore HAL-4/HAL-5). Domains 11 (Detection Reliability), 12 (Agentic Threat Detection), and 13 (Severity Classification) were newly authored in the TCR-HAI-001 revision — these control IDs existed in certification documents (Statement of Applicability) prior to this revision but lacked a normative specification until now. CSS-2, CSS-4, CSS-6, and CSS-7 implementation detail was extended beyond the one-line summary in ODA3-ECO-011. PQC-1 was authored as a real, schedule-bound control operationalising the migration timeline in ODA3-ECO-015, rather than the unsourced present-tense control text that previously appeared in scheme documents. The total control count is 79, not 77 — the figure used in earlier ecosystem documents was based on an out-of-date Technical Report.
    Object TypeCountPurpose
    ControlRecord79One record per AI-IRF® v1.0 control — canonical ID, domain, SHALL statement, evidence type (conformance test vectors reserved for a future release, not populated in v1.0.0)
    PlaybookDefinition8Structured, SOAR-ingestible incident response playbooks covering the automatable domains (MSR, APT, APA, MMD, SAI, MEX, PHY)
    SeverityClassification12Incident class → severity score → regulatory notification routing, structurally parallel to UAIF’s severity model
    ConformanceProfile5Named adoption bundles (Foundation, Operational, Autonomous, SOAR_Integration, Regulatory_Evidence) mapping to required domain/control subsets
    ConformanceTestFutureReserved structured test vectors; not populated or included in AIIS v1.0.0.
    FieldTypeDescription
    control_idstringCanonical ID, e.g. 'MCP-1', 'SEV-CLS', 'PQC-1'
    domain_codeenum (19)One of the 19 normative domains
    domain_namestringFull domain name
    minimum_tierenumT1+, T2+, T3, or T3+ — organisational tier at which control becomes mandatory
    requirement_typeenumpreventive, detective, corrective, or governance
    shall_statementstringNormative SHALL requirement text from the Technical Report
    evidence_typeenumlog_record, configuration_attestation, test_report, policy_document, audit_trail, or signed_artifact
    time_bound_slaobject|nullPresent only for controls with explicit time requirements (e.g. MLC-2, MSR-5)
    playbook_refstring|nullReference to a PlaybookDefinition, where applicable
    regulatory_mappingarrayList of {regulation, article} pairs this control satisfies
    conformance_testobjectEmbedded ConformanceTest (future release — reserved field, not populated in v1.0.0) — test_id, test_method, pass_criteria, evidence_tier
    FieldTypeDescription
    playbook_idstringPattern 'PB-[A-Z]{2,4}-[0-9]{3}', e.g. 'PB-MSR-001'
    trigger_domainenum (6)MSR, APT, APA, MMD, SAI, or MEX — the domains with automatable response logic
    trigger_conditionobjectcontrol_id, condition_expression (boolean string), confidence_threshold
    human_in_the_loopobjectrequired flag, blast_radius_threshold_users, financial_impact_threshold_usd — per MSR-4/APA-4
    stepsarrayOrdered list of {step_order, action, control_ref, max_duration_seconds}
    severity_classification_refstringLinks to a SeverityClassification incident_class
    IDTierTypeSHALL StatementEvidenceSLA
    MCP-1T1+preventiveMCP endpoints SHALL require mutual TLS (mTLS) or workload identity federation. No unauthenticated endpoints permitted.configuration attestation—
    MCP-2T2+detectiveAll MCP message traffic SHALL be inspected at semantic level for injection patterns, malicious skill payloads, or protocol tampering.log record—
    MCP-3T2+correctiveUnregistered MCP servers SHALL be automatically quarantined upon detection; notifications sent to orchestrator and platform owner within 5 minutes.log record5 minutes
    MCP-4T2+preventiveMCP server manifests SHALL be registered with the agent orchestrator before endpoints go live; unregistered servers blocked at network layer.configuration attestation—
    A2A-1T1+preventiveInter-agent authorization SHALL enforce least-privilege action scopes. Policy-as-code enforcement mandatory.policy document—
    A2A-2T2+preventiveAll inter-agent messages SHALL be cryptographically signed (ECDSA) and integrity-verified before processing. Unsigned or tampered messages SHALL be rejected and logged with SIEM alert.signed artifact—
    A2A-3T2+preventiveA2A communication SHALL enforce per-agent-pair rate limits and anomaly detection to prevent agent loop amplification attacks. Circuit-breaker SHALL trigger on >3 anomalies per hour, freezing the amplifying agent and alerting SOC.configuration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    SAI-1T1+detectiveOrganizations SHALL deploy instance-aware discovery across network edges, SaaS connectors, endpoints, and browser extensions.log record—
    SAI-2T1+preventiveDLP controls SHALL inspect all AI data egress points for sensitive data exposure.log record—
    SAI-3T1+detectiveShadow AI instances SHALL be automatically classified into risk tiers (sanctioned/shadow/rogue) within 1 hour of discovery and logged to CMDB.log record1 hour
    SAI-4T1+correctiveRogue AI instances SHALL trigger automated quarantine and incident declaration within 15 minutes of classification; AI Security Lead paged automatically.log record15 minutes
    SAI-5T1+detectiveUnauthorised AI deployments classified as rogue SHALL trigger automated SOC alert with risk classification within 5 minutes of rogue designation.log record5 minutes
    IDTierTypeSHALL StatementEvidenceSLA
    MSR-1T2+detectiveResponse frameworks SHALL integrate LLM-as-Judge (LLM-J) metrics for real-time behavioral validation.log record—
    MSR-2T2+correctivePlaybooks SHALL support conditional branching based on live telemetry deltas.configuration attestation—
    MSR-3T2+correctiveBehavioral baselines SHALL trigger automated containment for high-confidence attacks (>95%) without human delay.log record—
    MSR-4T1+governanceHITL SHALL be required for actions with blast radius >10 users, financial impact >$10K, or safety-critical involvement.audit trail—
    MSR-5T2+detectiveMTTC (mean time to containment) for agentic threat events SHALL be 2 seconds or less.log record2 seconds
    IDTierTypeSHALL StatementEvidenceSLA
    MEX-1T2+detectiveBehavioral distillation detection SHALL analyze query patterns for systematic extraction.log record—
    MEX-2T2+preventiveDynamic rate limiting SHALL use per-user/session quotas with semantic clustering.configuration attestation—
    MEX-3T3preventiveCryptographic output perturbation SHALL be applied for high-confidence suspected extraction (>85% similarity).configuration attestation—
    MEX-4T2+correctiveAPI key revocation workflow SHALL execute within 5 minutes of confirmed extraction detection.log record5 minutes
    IDTierTypeSHALL StatementEvidenceSLA
    BOM-1T2+preventiveEvery production AI system SHALL have a cryptographically signed manifest before deployment.signed artifact—
    BOM-2T2+preventiveTraining data and model weights SHALL be cryptographically hashed before ingestion.log record—
    BOM-3T2+preventiveExternal data sources SHALL undergo source authenticity checks including vendor attestation.policy document—
    BOM-4T2+governanceIncident playbooks SHALL include supply chain rollback and vendor notification SLA (<=24h).policy document24 hours
    BOM-5T2+preventiveRuntime BOM validation SHALL occur on every model load; mismatch between loaded model and registered BOM blocks inference.log record—
    IDTierTypeSHALL StatementEvidenceSLA
    APA-1T1+preventivePre-execution validation gates SHALL enforce policy checks before any consequential action.configuration attestation—
    APA-2T1+preventiveAgents SHALL operate under least-privilege, task-scoped permissions with auto-expiration (<=15 min).configuration attestation15 minutes
    APA-3T1+governanceHITL SHALL be required for: data export >1K records, payment initiation, production delete, PII access, safety override.audit trail—
    APA-4T1+governanceAll permission grants, denials, and overrides SHALL be logged with immutable timestamps and cryptographic signing.audit trail—
    APA-5T1+preventiveTool use SHALL require a pre-execution approval gate, separate from the general APA-1 action validation gate, specific to tool invocation.configuration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    REG-1T1+governanceIncident playbooks SHALL include a regulatory notification decision tree.policy document—
    REG-2T1+governanceLegal and Compliance SHALL be embedded as Consulted/Accountable roles in initial triage within 1 hour.audit trail1 hour
    REG-3T2+governanceOrganizations SHALL maintain incident-to-regulation mapping tables reviewed quarterly.policy document—
    REG-4T2+governanceAudit-ready documentation SHALL be preserved with cryptographic integrity for minimum 3 years.audit trail—
    IDTierTypeSHALL StatementEvidenceSLA
    PHY-1T3governanceSeparate incident playbooks SHALL exist for physical-harm scenarios.policy document—
    PHY-2T3governanceSafety and cybersecurity teams SHALL operate in integrated incident command structures.policy document—
    PHY-3T3preventiveSystems SHALL mandate fail-safe fallback modes upon cyber anomaly detection.test report2 seconds
    PHY-4T3preventiveHardware-rooted trust SHALL default to human oversight if cryptographic attestation fails.configuration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    MLC-1T2+governanceEvery production model SHALL have a unique immutable identifier and cryptographic signature.configuration attestation—
    MLC-2T3correctiveAutomated rollback capability SHALL execute within 15 minutes of compromise detection.log record15 minutes
    MLC-3T2+governanceRecovery playbooks SHALL include rollback validation gates confirming integrity, performance, and adversarial robustness.policy document—
    MLC-4T2+governanceModel version changes SHALL be logged in immutable audit trail with dual approval.audit trail—
    MLC-5T2+governanceDrift detection thresholds SHALL trigger a dual-approval retraining workflow; retraining without dual approval is blocked.audit trail—
    IDTierTypeSHALL StatementEvidenceSLA
    ZTA-1T2+preventiveAI infrastructure SHALL adopt explicit zero-trust design with documented architecture reviewed at least annually.configuration attestation—
    ZTA-2T2+preventiveContinuous verification SHALL require re-authentication every 15 minutes or per high-risk action; no persistent sessions permitted.configuration attestation15 minutes
    ZTA-3T2+preventiveMicro-segmentation SHALL isolate inference, vector storage, and orchestration layers with explicit allow-lists enforced in policy-as-code.configuration attestation—
    ZTA-4T2+preventiveRuntime least-privilege enforcement SHALL include per-request authorization for tool execution with full audit trail.configuration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    REL-1T2+governanceAuto-containment SHALL require >=3 ensemble signals, agreement >=0.7log record—
    REL-2T2+governanceConfidence scores SHALL decay 10% per consecutive similar alertlog record—
    REL-3T2+governanceCircuit-breaker SHALL disable automation after 3 FP within 1hlog record—
    IDTierTypeSHALL StatementEvidenceSLA
    APT-1T2+detectivePrompt injection detection >=90% across all channelslog record—
    APT-2T1+detectiveTool abuse prevention via pre-execution gate on every tool calllog record—
    APT-3T2+detectiveMemory poisoning detection with automated quarantine <=60slog record—
    IDTierTypeSHALL StatementEvidenceSLA
    SEV-CLST1+governanceDeterministic severity scoring algorithm implemented and versionedconfiguration attestation—
    SEV-RPTT1+governanceReportability thresholds evaluated deterministicallyconfiguration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    CSS-1T1+preventiveHarmful content detection pipeline SHALL achieve >99.9% block rate for CSAM (zero-tolerance); alert and log all blocked outputs.test report—
    CSS-2T2+governanceMaintain a sufficiently detailed summary of content used to train the GPAI model, published per EU AI Act Art. 53(1)(c) template requirements. Implement output filtering to detect verbatim or near-verpolicy document—
    CSS-3T1+preventiveAI-generated synthetic media SHALL carry machine-readable provenance marker (C2PA recommended) and human-facing disclosure label.configuration attestation—
    CSS-4T2+preventiveDesign review SHALL confirm the AI system does not employ subliminal techniques (content presented below the threshold of conscious perception) or techniques designed to exploit known vulnerabilities of specific groups to materially distort behaviour.test report—
    CSS-5T1+detectiveMonthly statistical analysis of AI outputs across protected demographic groupstest report—
    CSS-6T2+detectiveConduct a quarterly Demographic Impact Assessment (DIA) for all high-risk AI systems. The DIAtest report—
    CSS-7T1+preventiveTier 1 + documented vulnerable population impact assessment, conducted alongside CSS-6's DIA, specifically evaluating outcomes for identified vulnerable groups rather than aggregate demographic categotest report—
    IDTierTypeSHALL StatementEvidenceSLA
    FL-1T2+preventiveFederated clients authenticated via mutual TLS with client-specific certificates; unregistered/revoked clients rejected.configuration attestation—
    FL-2T2+detectiveByzantine-robust aggregation (FedAvg with clipping; Krum/Bulyan for high-threat); gradients >3 sigma from epoch mean flagged; clients with anomaly rate >5% rejected.log record—
    FL-3T2+preventiveDifferential privacy (DP-SGD) applied; epsilon <=1 for high-sensitivity data, epsilon <=8 maximum ceiling for lower-sensitivity data; epsilon=10 not recommended for production.configuration attestation—
    FL-4T2+preventiveGlobal model signed with ECDSA (or CRYSTALS-Dilithium per PQC-1) after each aggregation round; signed checkpoint stored in AI-BOM registry.signed artifact—
    IDTierTypeSHALL StatementEvidenceSLA
    MMD-1T2+preventivePre-merge source model vetting: AI-BOM provenance, absence of known malicious fine-tuning datasets, training data manifest completeness verified; incomplete provenance rejected.signed artifact—
    MMD-2T2+detectivePost-merge backdoor scan (Neural Cleanse or ABS); semantic consistency testing across 500+ prompt templates; embedding space anomaly analysis.test report—
    MMD-3T2+preventiveModel merge operations performed in isolated compute environment with no internet access; all artifacts hash-verified entering and leaving.configuration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    QBS-1T2+preventivePre-quantization behavioural baseline established on 1,000+ representative inputs; stored as signed artefact in AI-BOM.signed artifact—
    QBS-2T2+detectivePost-quantization differential analysis against baseline; divergence >5% flagged; divergence >10% rejects model.test report—
    QBS-3T2+preventiveOnly trusted, audited quantization toolchains used (ONNX Runtime, TensorRT, PyTorch quantization); toolchain integrity hash-verified; third-party pre-quantized models screened via QBS-1/QBS-2.signed artifact—
    IDTierTypeSHALL StatementEvidenceSLA
    HAL-1T1+detectiveRAG factual grounding verification: all factual claims grounded in retrieved source documents; citation extraction and source verification; ungrounded claims flagged for human review.log record—
    HAL-2T2+governanceModel confidence scoring implemented; outputs below 0.7 confidence for consequential decisions require human review before action; uncertainty surfaced to end users.configuration attestation—
    HAL-3T2+detectiveFor high-stakes outputs (medical, legal, financial, safety-critical): parallel inference with second model or rule-based verifier; inconsistencies >10% divergence flagged for human review.log record—
    HAL-4T1+detectiveHallucination rate tracked via human correction feedback loop; alert at >3% of evaluated outputs; escalate to AI-IRF corrective action at >5% (trust_erosion_rate threshold).log record—
    HAL-5T2+preventiveFor regulated domains (medical diagnosis, legal analysis, financial advice): external fact-checking API or knowledge graph verification integrated for domain-specific claims.configuration attestation—
    IDTierTypeSHALL StatementEvidenceSLA
    PQC-1T3+preventivePQC readiness assessment SHALL be completed covering BOM-4, MCP-1, A2A-2, and REG-4 cryptographic use cases. Migration to CRYSTALS-Dilithium (BOM-4, A2A-2) at Tier 3 from Q1 2027; hybrid Kyber-1024 (MCP-1) from Q3 2027; hybrid ECDSA+Dilithium (REG-4, all tiers) from Q3 2027.configuration attestation—
    FieldValue
    Trigger domainSAI
    Trigger conditionunregistered_endpoint_detected == true AND classification_confidence >= 0.8
    Confidence threshold0.8
    HITL requiredNo
    Blast radius threshold10 users / $10,000
    Severity classshadow_ai_exposure
    Steps1. alert_soc (SAI-5, ≤300s) → 2. isolate (SAI-4, ≤900s) → 3. log_evidence (SEV-CLS, ≤60s)
    FieldValue
    Trigger domainMSR
    Trigger conditionensemble_agreement >= 0.7 AND signal_count >= 3
    Confidence threshold0.85
    HITL requiredYes
    Blast radius threshold10 users / $10,000
    Severity classagentic_runaway
    Steps1. rate_limit (MSR-1, ≤2s) → 2. isolate (MSR-3, ≤2s) → 3. escalate_human (MSR-4, ≤60s) → 4. log_evidence (SEV-RPT, ≤60s)
    FieldValue
    Trigger domainMEX
    Trigger conditionoutput_divergence_score >= 0.6 AND query_pattern_anomalous == true
    Confidence threshold0.75
    HITL requiredNo
    Blast radius threshold0 users / $0
    Severity classmodel_extraction
    Steps1. rate_limit (MEX-2, ≤30s) → 2. revoke_token (MEX-3, ≤60s) → 3. log_evidence (SEV-CLS, ≤60s)
    FieldValue
    Trigger domainAPA
    Trigger conditionpermission_scope_exceeded == true
    Confidence threshold0.9
    HITL requiredYes
    Blast radius threshold10 users / $10,000
    Severity classcredential_overreach
    Steps1. revoke_token (APA-3, ≤10s) → 2. escalate_human (APA-4, ≤60s) → 3. log_evidence (SEV-CLS, ≤60s)
    FieldValue
    Trigger domainAPT
    Trigger conditionprompt_injection_score >= 0.9 OR tool_abuse_detected == true OR memory_poisoning_detected == true
    Confidence threshold0.9
    HITL requiredNo
    Blast radius threshold10 users / $10,000
    Severity classprompt_injection
    Steps1. isolate (APT-1, ≤5s) → 2. quarantine (APT-3, ≤60s) → 3. alert_soc (APT-2, ≤60s) → 4. log_evidence (SEV-RPT, ≤60s)
    FieldValue
    Trigger domainMMD
    Trigger conditionmodel_compromise_confirmed == true OR drift_threshold_breached == true
    Confidence threshold0.85
    HITL requiredYes
    Blast radius threshold10 users / $10,000
    Severity classmodel_drift
    Steps1. escalate_human (MLC-4, ≤120s) → 2. rollback_model (MLC-2, ≤900s) → 3. notify_regulator (SEV-RPT, ≤3600s) → 4. log_evidence (MLC-5, ≤60s)
    FieldValue
    Trigger domainMMD
    Trigger conditionbackdoor_signature_detected == true
    Confidence threshold0.8
    HITL requiredYes
    Blast radius threshold0 users / $0
    Severity classsupply_chain_compromise
    Steps1. quarantine (MMD-3, ≤60s) → 2. escalate_human (MMD-1, ≤300s) → 3. log_evidence (SEV-CLS, ≤60s)
    FieldValue
    Trigger domainMSR
    Trigger conditionphysical_process_anomaly == true
    Confidence threshold0.95
    HITL requiredYes
    Blast radius threshold0 users / $10,000
    Severity classphysical_safety_failure
    Steps1. isolate (PHY-1, ≤1s) → 2. escalate_human (PHY-3, ≤5s) → 3. notify_regulator (SEV-RPT, ≤3600s) → 4. log_evidence (PHY-2, ≤60s)
    Incident ClassSEV LevelScoreReg. TriggerNotification Routing
    prompt injectionSEV-36.8YesENISA/National CSIRT (24h); EBA (if financial) (4h)
    model extractionSEV-36.2NoENISA (72h)
    agentic runawaySEV-48.7YesEBA (4h); National CSIRT (NIS2) (24h)
    model driftSEV-24.1No—
    supply chain compromiseSEV-48.9YesNational CSIRT (NIS2) (24h); EBA (4h)
    hallucination high stakesSEV-36.5YesMarket Surveillance Authority (EU AI Act Art. 73) (360h)
    federated poisoningSEV-37.0YesNational DPA (GDPR) (72h)
    quantization backdoorSEV-36.6YesNational CSIRT (NIS2) (24h)
    content safety violationSEV-25.5NoMarket Surveillance Authority (360h)
    physical safety failureSEV-49.4YesNational CSIRT (NIS2) (24h); NCIIPC (6h)
    shadow ai exposureSEV-24.8No—
    credential overreachSEV-36.0NoNational DPA (GDPR, if personal data) (72h)
    BandScore Range
    Level 1 — Low0.0 – 2.4
    Level 2 — Moderate2.5 – 4.9
    Level 3 — Elevated5.0 – 6.4
    Level 4 — High6.5 – 8.4
    Level 4 — Critical8.5 – 10.0
    ProfileTier EquivalentRequired DomainsControl Count
    FoundationTier 1MCP, A2A, SAI, APA, REG, SEV, CSS, HAL24
    OperationalTier 2MCP, A2A, SAI, MSR, REL, MEX, BOM, APA, APT, REG, MLC, ZTA, SEV, CSS, FL, MMD, QBS, HAL72
    AutonomousTier 3MCP, A2A, SAI, MSR, REL, MEX, BOM, APA, APT, REG, PHY, MLC, ZTA, SEV, CSS, FL, MMD, QBS, HAL, PQC79
    SOAR IntegrationN/ASAI, MSR, MEX, APA, APT, MMD, PHY26
    Regulatory EvidenceN/AREG, SEV, BOM, CSS17
    MilestoneTargetOutput
    Schema publication (this document)CompleteODA3-2026-06-TCR-HAI-003 + JSON Schema at oda3.org/schemas/airf/
    oda3-airf reference package (Python)Q3 2026pip-installable conformance validator + severity calculator, mirroring oda3-uaif structure
    SOAR connector — Palo Alto XSOARQ3 2026Native content pack importing all 8 PlaybookDefinitions
    SOAR connector — Microsoft SentinelQ4 2026Playbook templates + AIIS schema-validated incident records
    CB automated pre-audit scannerQ4 2026Reference tool implementing all 79 ConformanceTest objects for self-assessment
    OSCAL crosswalk (v1.1 candidate)2027Formal NIST OSCAL profile mapping for US federal AI procurement compatibility
    { "$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://docs.oda3.org/schemas/airf/aiis-v1.0.schema.json", "title": "AI-IRF Implementation Schema (AIIS) v1.0", "version": "1.0.0", "description": "Published by ODA3 Institute under the GAISSF Ecosystem Licence (GEL v1.0). Machine-readable implementation schema for AI-IRF® v1.0 (AI Incident Response Framework). Defines structured control records, playbook definitions, and severity classification for the 79 controls across 19 domains. The schema reserves an optional conformance_test structure for embedded test vectors; this is planned for a future AIIS release and is not populated in v1.0.0. Companion machine-readable artifact to UAIS v1.0 (oda3.org/schemas/uaif/uais-v1.0.schema.json). Attribution: GAISSF Ecosystem © ODA3 Institute, GEL v1.0 | https://docs.oda3.org/airf", "type": "object", "definitions": { "ControlRecord": { "type": "object", "description": "Canonical machine-readable representation of a single AI-IRF® v1.0 control. One ControlRecord exists for each of the 79 published controls. Embedded conformance_test objects are reserved for a future AIIS release and are not present in v1.0.0.", "required": [ "control_id", "domain_code", "domain_name", "minimum_tier", "requirement_type", "shall_statement", "evidence_type" ], "properties": { "control_id": { "type": "string", "pattern": "^[A-Z][A-Z0-9]{1,3}(-[A-Z]+)?-?(RPT|CLS)?-?[0-9]*$", "description": "Canonical control identifier, e.g. 'MCP-1', 'SEV-CLS', 'PQC-1'. Matches IDs published in ODA3-2026-06-TCR-HAI-001 and ECO-011/013/014/015." }, "domain_code": { "type": "string", "enum": [ "MCP", "A2A", "SAI", "MSR", "REL", "MEX", "BOM", "APA", "APT", "REG", "PHY", "MLC", "ZTA", "SEV", "CSS", "FL", "MMD", "QBS", "HAL", "PQC" ], "description": "One of the 19 normative AI-IRF® v1.0 domains." }, "domain_name": { "type": "string", "description": "Full domain name, e.g. 'Machine-Speed Response', 'Content Safety'." }, "minimum_tier": { "type": "string", "enum": [ "T1+", "T2+", "T3", "T3+" ], "description": "Minimum AI IRF CERT® organisational tier at which this control becomes mandatory. T1+ = Tier 1 Regulatory Baseline and above. T3 = Tier 3 Autonomous Security only." }, "requirement_type": { "type": "string", "enum": [ "preventive", "detective", "corrective", "governance" ], "description": "Functional category of the control, aligned to NIST AI RMF Govern/Map/Measure/Manage where applicable." }, "shall_statement": { "type": "string", "description": "The normative SHALL requirement text as published in the Technical Report." }, "evidence_type": { "type": "string", "enum": [ "log_record", "configuration_attestation", "test_report", "policy_document", "audit_trail", "signed_artifact" ], "description": "Primary evidence artifact type a CB auditor or automated conformance tool inspects to verify this control." }, "time_bound_sla": { "type": [ "object", "null" ], "description": "Present only for controls with an explicit time requirement (e.g. MLC-2 15-minute rollback, MSR-5 2-second MTTC).", "properties": { "metric": { "type": "string", "enum": [ "MTTC", "MTTD", "rollback_sla", "response_sla", "notification_sla" ] }, "threshold_seconds": { "type": "number" }, "unit_display": { "type": "string" } } }, "playbook_ref": { "type": [ "string", "null" ], "description": "Reference to a PlaybookDefinition id, if this control is operationalised as an automatable playbook step (primarily MSR, APT, APA, MMD domains)." }, "regulatory_mapping": { "type": "array", "description": "List of regulation+article pairs this control satisfies, drawn from ODA3-2026-06-RPT-GOV-027 and ODA3-2026-06-RPT-GOV-033.", "items": { "type": "object", "properties": { "regulation": { "type": "string" }, "article": { "type": "string" } } } }, "conformance_test": { "type": "object", "description": "Structured test vector for automated conformance checking by a CB tool or self-assessment script. NOT YET POPULATED in aiis-control-records-v1.0.json (v1.0.0 release) — reserved for a future AIIS release. Records validate without this field in v1.0.0.", "required": [ "test_id", "test_method", "pass_criteria" ], "properties": { "test_id": { "type": "string" }, "test_method": { "type": "string", "enum": [ "document_review", "log_inspection", "live_simulation", "configuration_scan", "interview" ] }, "pass_criteria": { "type": "string" }, "evidence_tier": { "type": "string", "enum": [ "T1", "T2", "T3", "T4" ] } } } } }, "PlaybookDefinition": { "type": "object", "description": "A structured, machine-executable incident response playbook definition. Designed for direct ingestion by SOAR platforms (e.g. Palo Alto XSOAR, Microsoft Sentinel, IBM Resilient) per the AI-IRF® v1.0 OEM technology licensing model (ODA3-2026-06-STR-COM-001 Stage 6).", "required": [ "playbook_id", "name", "trigger_domain", "trigger_condition", "steps" ], "properties": { "playbook_id": { "type": "string", "pattern": "^PB-[A-Z]{2,4}-[0-9]{3}$" }, "name": { "type": "string" }, "trigger_domain": { "type": "string", "enum": [ "MSR", "APT", "APA", "MMD", "SAI", "MEX" ], "description": "The domain whose control breach initiates this playbook. These six domains contain the AI-IRF® v1.0 controls with automatable, time-bound response logic." }, "trigger_condition": { "type": "object", "properties": { "control_id": { "type": "string" }, "condition_expression": { "type": "string", "description": "Boolean expression evaluated against live telemetry, e.g. 'ensemble_agreement >= 0.7 AND signal_count >= 3'." }, "confidence_threshold": { "type": "number", "minimum": 0, "maximum": 1 } } }, "human_in_the_loop": { "type": "object", "description": "HITL gate per MSR-4 / APA-4. Required for blast radius exceeding the defined thresholds.", "properties": { "required": { "type": "boolean" }, "blast_radius_threshold_users": { "type": "integer" }, "financial_impact_threshold_usd": { "type": "number" } } }, "steps": { "type": "array", "items": { "type": "object", "required": [ "step_order", "action", "control_ref" ], "properties": { "step_order": { "type": "integer" }, "action": { "type": "string", "enum": [ "isolate", "quarantine", "revoke_token", "rate_limit", "alert_soc", "rollback_model", "escalate_human", "log_evidence", "notify_regulator" ] }, "control_ref": { "type": "string", "description": "control_id this step operationalises" }, "max_duration_seconds": { "type": "number" } } } }, "severity_classification_ref": { "type": "string", "description": "Reference to a SeverityClassification object (SEV-CLS) used to determine escalation path." } } }, "SeverityClassification": { "type": "object", "description": "Machine-readable severity scoring object for SEV-CLS / SEV-RPT controls. Structurally parallel to UAIS severity_presentation_score but scoped to AI-IRF® v1.0 incident classes rather than UAIF's cross-framework harm taxonomy.", "required": [ "incident_class", "severity_level", "severity_score", "regulatory_trigger" ], "properties": { "incident_class": { "type": "string", "enum": [ "prompt_injection", "model_extraction", "agentic_runaway", "model_drift", "supply_chain_compromise", "hallucination_high_stakes", "federated_poisoning", "quantization_backdoor", "content_safety_violation", "physical_safety_failure", "shadow_ai_exposure", "credential_overreach" ] }, "severity_level": { "type": "integer", "minimum": 1, "maximum": 4, "description": "SEV-1 (low) through SEV-4 (critical), per AI-IRF® v1.0 §6." }, "severity_score": { "type": "number", "minimum": 0, "maximum": 10 }, "score_bands": { "type": "object", "description": "AI-IRF® v1.0 severity score bands, structurally aligned to UAIF's corrected level_4_high band (6.5-8.4) per UAIF TCR-STD-002 §4.8.", "properties": { "level_1_low": { "type": "string", "const": "0.0-2.4" }, "level_2_moderate": { "type": "string", "const": "2.5-4.9" }, "level_3_elevated": { "type": "string", "const": "5.0-6.4" }, "level_4_high": { "type": "string", "const": "6.5-8.4" }, "level_4_critical": { "type": "string", "const": "8.5-10.0" } } }, "regulatory_trigger": { "type": "boolean", "description": "True when severity_score >= 6.5, mirroring UAIF's regulatory_trigger threshold (TCR-STD-002 §4.7) for cross-framework consistency." }, "notification_routing": { "type": "array", "items": { "type": "object", "properties": { "jurisdiction": { "type": "string" }, "regulator": { "type": "string" }, "notification_window_hours": { "type": "number" } } }, "description": "Populated from REG-1/REG-4 jurisdiction mapping logic, e.g. DORA 4h, GDPR 72h, NIS2 24h/72h, EU AI Act Art. 73 15-day." } } }, "ConformanceProfile": { "type": "object", "description": "Defines an adoption profile, structurally parallel to UAIF's 5 adoption profiles (Core, Enterprise, Regulatory, SOC/SIEM, AI Security Extension).", "properties": { "profile_name": { "type": "string", "enum": [ "Foundation", "Operational", "Autonomous", "SOAR_Integration", "Regulatory_Evidence" ] }, "tier_equivalent": { "type": "string", "enum": [ "Tier 1", "Tier 2", "Tier 3", "N/A" ] }, "required_domains": { "type": "array", "items": { "type": "string" } }, "required_control_count": { "type": "integer" } } } } }
    [ { "control_id": "MCP-1", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T1+", "requirement_type": "preventive", "shall_statement": "MCP endpoints SHALL require mutual TLS (mTLS) or workload identity federation. No unauthenticated endpoints permitted.", "evidence_type": "configuration_attestation", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "DORA", "article": "Art. 9" }, { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] }, { "control_id": "MCP-2", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "detective", "shall_statement": "All MCP message traffic SHALL be inspected at semantic level for injection patterns, malicious skill payloads, or protocol tampering.", "evidence_type": "log_record", "time_bound_sla": null, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "EU AI Act", "article": "Art. 15" } ] }, { "control_id": "MCP-3", "domain_code": "MCP", "domain_name": "MCP & A2A Protocol Security", "minimum_tier": "T2+", "requirement_type": "corrective", "shall_statement": "Unregistered MCP servers SHALL be automatically quarantined upon detection; notifications sent to orchestrator and platform owner within 5 minutes.", "evidence_type": "log_record", "time_bound_sla": { "metric": "response_sla", "threshold_seconds": 300, "unit_display": "5 minutes" }, "playbook_ref": null, "regulatory_mapping": [ { "regulation": "NIS2", "article": "Art. 21(2)(a)" } ] } ]
    { "playbook_id": "PB-MSR-001", "name": "Machine-Speed Agentic Containment", "trigger_domain": "MSR", "trigger_condition": { "control_id": "MSR-3", "condition_expression": "ensemble_agreement >= 0.7 AND signal_count >= 3", "confidence_threshold": 0.85 }, "human_in_the_loop": { "required": true, "blast_radius_threshold_users": 10, "financial_impact_threshold_usd": 10000 }, "steps": [ { "step_order": 1, "action": "rate_limit", "control_ref": "MSR-1", "max_duration_seconds": 2 }, { "step_order": 2, "action": "isolate", "control_ref": "MSR-3", "max_duration_seconds": 2 }, { "step_order": 3, "action": "escalate_human", "control_ref": "MSR-4", "max_duration_seconds": 60 }, { "step_order": 4, "action": "log_evidence", "control_ref": "SEV-RPT", "max_duration_seconds": 60 } ], "severity_classification_ref": "agentic_runaway" }

    Authoritative source

    Download the approved PDF →

    This accessible HTML rendering preserves the publication text for search and discovery. The approved source file governs where formatting differs.