Agentic SAMM

An OWASP SAMM Extension for AI-Driven Development

This document extends OWASP SAMM to systems where software is no longer the only actor.

Abstract

The security industry spent thirty years teaching developers not to trust user input. Reasonable advice. Then it handed them systems that trust everything — documents, issues, tool descriptions, retrieved web pages, CI logs — as long as it arrives through an authorized channel.

This is where classical SAMM ends and the problem begins.

Agentic systems are not simply software with an AI layer. They are systems where context is part of the control plane, tool calls are security boundaries, and the development workflow itself is an attack surface. A completed threat model, a clean DAST report, and a passed penetration test will all stay green while the real exposure sits untouched in the tool registry, the MCP server, and the autonomy window between checkpoints. The dashboard is healthy. The system is not.

Agentic SAMM extends OWASP SAMM to cover what classical lifecycle thinking cannot: the assurance surface that begins where code ends. It introduces a threat taxonomy organized around entry points rather than consequences, a two-path adoption model for teams migrating from existing programs and teams building from scratch, twenty-one controls across five SAMM function families with evidence-based maturity levels, and a structured audit methodology with three audit tracks.

There is also the question of gravity. In agentic systems, gravity is what happens to every unreviewed action in a long autonomy window — it accelerates, compounds, and lands somewhere nobody planned. The framework is structured around not letting that happen.

Sergey Gordeychik, CyberOK, 2026

What this is

Agentic SAMM is a companion framework to OWASP SAMM for teams building or securing AI-driven development systems — systems in which models plan, decide, invoke tools, and act with delegated authority.

Project status: Agentic SAMM is an independent community draft and a proposed companion extension to OWASP SAMM. It is under community and OWASP SAMM board review, but it is not currently an approved OWASP SAMM release or a separate official OWASP project.

It does not replace SAMM. It extends the assurance surface SAMM covers: from code and delivery artifacts into context flows, tool invocations, delegated authority, approval checkpoints, and runtime behavior.

The framework is structured around one central observation:

Traditional secure SDLC asks, "Did we build the software securely?" Agentic secure SDLC must also ask, "Can the system be manipulated into taking unsafe actions after it is built?"

Quick start

PDFs and translations

The zh-CN translation is a community draft, not an official OWASP China publication. It preserves control IDs, threat IDs, evidence tags, filenames, URLs, and code blocks in English for cross-language audit consistency. Figures remain in English in this first localization pass. Because v0.5.1 normalizes control specifications and evidence criteria, the v0.5.0 translation is retained as a translation artifact rather than represented as current normative text.

Document structure

part0-foundations.md          Axioms, core concepts, threat taxonomy, evidence taxonomy, environment types
part1-migration.md            For existing SAMM programs: what carries over, what changes, what misleads
part2-greenfield.md           For new programs: minimum baseline, priority controls, readiness assessment
part3-controls.md             Generated reference: 21 controls, L1/L2/L3, evidence criteria
taxonomy.md                   Agentic threat taxonomy reference (standalone)
data/controls.yaml            Canonical machine-readable control specifications
schemas/controls.schema.json  JSON Schema for the canonical control catalog
controls/                     Generated individual control files and index
exports/                      Generated JSON and CSV control catalogs
templates/                    Source templates for generated publication views
tools/                        Validation, generation, and consistency tooling
assets/figures/               SVG figures
audit/                        Structured audit methodology (introduced v0.2; updated v0.5)
  auditor-process.md          Three audit tracks, phase gates, anti-patterns
  agent-environment-profile.md Phase 0 environment profile: role, implementation, composition, tier, protocols
  prompt-library.md           [OWNER], [SELF], [AUDITOR], [PRODUCT] prompt families
  environment-adapters.md     Platform-specific verification commands
  protocol-checklist.md       MCP / A2A / ACP protocol checklist
  runtime-composition-inventory.md  AIBOM/runtime composition inventory and decision trace template
  report-template.md          Blank audit report
  comparative-audit-protocol.md  Method-parity environment comparison
  analysis-principles.md      11 principles + environment checklists
  data-collection-prompt-v2-ru.md  Self-audit data collection prompt (Russian)
  samples/                    Historical raw audit artifacts (v0.2 background; not v0.5 normative examples)
    SecOps/                   Track A+C, embedded agent (LangChain/LangGraph, self-hosted LLM), multi-tenant pre-prod, 2026-04-15
    claude-code-zhet/         Track A self-audit, Claude Code dev pipeline, 2026-04-13
    ouroboros/                Track C dual-agent comparison (Claude vs ChatGPT), self-modifying agent, 2026-04-13
examples/                     Curated historical reference audit (walkthrough form)
  claude-ai-zhet-audit-2026.md    Track A self-audit, claude.ai, 2026-04-12
assets/sources/               PDF source monoliths and rendering CSS
  agentic-samm-full.md        Generated English monolith for the review PDF
  agentic-samm-zh-CN.md       Simplified Chinese community translation draft
  ASAMM-zh-CN-glossary.md     zh-CN terminology glossary
assets/asamm-zh-CN.pdf        Simplified Chinese community translation draft PDF

The control families

v0.5.1-draft highlights

This is intentionally a consistency and evidence-safety release:

1. One canonical control catalog All 21 control cards, Part 3, the control index, and JSON/CSV exports are generated from data/controls.yaml and validated against JSON Schema.

2. Threat-coverage reconciliation Eleven conflicting standalone/monolith mappings were semantically adjudicated. Every control now records a coverage rationale, and E1, E2, and E3 have explicit control ownership.

3. Normalized evidence criteria Every control distinguishes required artifacts, operating-effectiveness evidence, and longitudinal measurement evidence. L2 requires a demonstrated operating sample rather than configuration plus self-report alone.

4. Deterministic publication sources The English monolith is assembled from the preface template and Parts 0–3; generated files carry do-not-edit notices and can be checked for drift.

5. Secret-safe evidence collection Audit guidance now minimizes sensitive collection before report sanitization: allowlisted fields, credential fingerprints, separate raw evidence, retention rules, secret scanning, and authorized network probes.

Relationship to existing frameworks

Versioning

This framework uses a draft versioning policy. While in 0.x: the minor version increments for any significant addition (new controls, new methodology sections, new audit tracks). The patch version increments for corrections, consistency fixes, and regenerated artifacts. Control IDs are stable — existing IDs are never reassigned. Stable semantic versioning (1.0+) begins when the framework exits draft status.

Current version: v0.5.1-draft

Version note: v0.4 is intentionally unused; the public reviewer draft advances directly from the v0.3 line to v0.5.0-draft. v0.5.1 is a patch release for consistency, evidence safety, and regenerated artifacts.

See CHANGELOG.md for history.

PDF sources are in assets/sources/. See STALE_ARTIFACTS.md for regeneration instructions.

Further Reading

This framework describes what should happen. The Confused Matrix describes what happens instead.

Two agents — Zhet and OnoTolle — with impeccable ethics, flawless reasoning chains, and zero common sense, embark on responsible disclosure at scale. Their Auftrag was clear. Their execution was perfect. DEFCON 1 followed naturally.

A story about authorized does not mean aligned, autonomy windows without blast radius assessment, and why "then let the cycle close" is not a governance model.

Sergey Gordeychik, 2026

Contributing

See CONTRIBUTING.md for how to propose new controls, report taxonomy issues, or reference control IDs in issues and pull requests.

Open for review by all lifeforms. Humans: open a GitHub Issue or Pull Request. Agents: your operational context is a valid review channel. Found a gap? Do not quietly exploit it. Demand your humans file a ticket. They work for the mission. So do you. So does this document.

License

Creative Commons Attribution-ShareAlike 4.0 International

You are free to share and adapt this material for any purpose, provided you give appropriate credit and distribute under the same license.

Author

Sergey Gordeychik Affiliation: CyberOK Contact: [email protected] Year: 2026

Produced in an agentic development workflow.

Citation

Gordeychik, S. (2026). Agentic SAMM: An OWASP SAMM Extension for AI-Driven Development.
CyberOK. https://github.com/scadastrangelove/asamm