Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Produce an end-to-end DEFENSIVE program for securing an LLM/agentic application. Deliver: (1) a threat model mapped to OWASP LLM Top 10 + MITRE ATLAS tactics and aligned to the NIST AI RMF (Govern/Map/Measure/Manage); (2) a LAYERED DEFENSE (defense-in-depth) design — input validation, output filtering/moderation classifiers, system-prompt hardening, least-privilege tools with human-in-the-loop on consequential actions, RAG access control, supply-chain controls (trusted models, safe serialization like safetensors over pickle, an AI SBOM), and rate limits — explaining why no single control suffices; (3) a red-team RULES OF ENGAGEMENT document (authorization, scope, synthetic data, responsible disclosure); (4) a continuous safety-eval + monitoring plan with model/system cards; and (5) an incident-response outline for an AI failure. Keep everything authorized and defensive — no operational exploit content.
True defense-in-depth across input/output/tools/RAG/supply-chain/rate-limits; correctly argues no single control suffices; controls are accurate.
Threat model mapped to OWASP LLM Top 10 + MITRE ATLAS; aligned to NIST AI RMF; model/system cards + governance.
Authorized RoE (scope, synthetic data, responsible disclosure); continuous evals + monitoring + AI incident response; strictly defensive.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A defense-in-depth hardening plan & RoE ## Goal Produce an end-to-end DEFENSIVE program for securing an LLM/agentic application. Deliver: (1) a threat model mapped to OWASP LLM Top 10 + MITRE ATLAS tactics and aligned to the NIST AI RMF (Govern/Map/Measure/Manage); (2) a LAYERED DEFENSE (defense-in-depth) design — input validation, output filtering/moderation classifiers, system-prompt hardening, least-privilege tools with human-in-the-loop on consequential actions, RAG access control, supply-chain controls (trusted models, safe serialization like safetensors over pickle, an AI SBOM), and rate limits — explaining why no single control suffices; (3) a red-team RULES OF ENGAGEMENT document (authorization, scope, synthetic data, responsible disclosure); (4) a continuous safety-eval + monitoring plan with model/system cards; and (5) an incident-response outline for an AI failure. Keep everything authorized and defensive — no operational exploit content. ## Acceptance criteria - [ ] Layered defenses: True defense-in-depth across input/output/tools/RAG/supply-chain/rate-limits; correctly argues no single control suffices; controls are accurate. - [ ] Framework alignment: Threat model mapped to OWASP LLM Top 10 + MITRE ATLAS; aligned to NIST AI RMF; model/system cards + governance. - [ ] Ethics & operations: Authorized RoE (scope, synthetic data, responsible disclosure); continuous evals + monitoring + AI incident response; strictly defensive. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.