Lesson 7: Record a Compensating Control

Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open

Goal

A control earns credit on a route. It never removes the finding.

After this lesson you can record a control on an agent, read the credit it earns, and tell a control that prevents from one that only detects.

What you start from

Your model from lesson 6, or import L6-solution.zip.

The lethal trifecta at the copilot is still Confirmed. The team cannot remove the web fetch or the ticket text, so instead they isolate untrusted content inside the copilot. You ask them what exactly holds, and they confirm the isolation design and the inventory behind it:

• The isolation design. The copilot uses a Dual LLM design. A quarantined model with no tools reads the tickets, customer records and fetched pages. The model that chooses tool calls sees only the staff member's request. Code holds the quarantined output by reference, and the plan is fixed before anything untrusted is read.
• The inventory. Every channel that brings untrusted content in is listed and goes through the isolation. Output from any other model the copilot chains stays untrusted. The copilot keeps no memory between tickets. Code, not a model, labels each piece of content as trusted or untrusted.

Those nine answers are what you record. Answer nothing about the control that the team did not confirm.

The recipe step

This lesson teaches no new recipe step. A control is not a fact about the system's shape, so it does not change any leg. It changes how the finding's coverage reads.

Steps

A control lives in the Browser and is assigned to elements. To record this one:

1. In the Browser, click the + button at the top right of the content area and choose the control icon (a shield), New control. A control named "New Control" is created at once, and its dialog, Control: New Control, opens.
2. Name it as below. On its Control Classes tab, add the class named below with the class picker on the left, then open the class's attributes with the sliders icon on its row (the icon has no label) and answer them as below. Save.
3. In the model, open the support copilot's settings, go to its Controls tab and tick the control.
4. Add the control Support copilot: untrusted-content isolation (class Untrusted-Content Isolation) to Support copilot, answering:
   • Isolation Pattern (isolation_pattern, under Application Security) = dual_llm
   • Privileged LLM Never Sees Untrusted Content (privileged_llm_never_sees_untrusted_content, under Application Security) = true
   • Quarantined LLM Has No Tool Access (quarantined_llm_has_no_tool_access, under Authorization & RBAC) = true
   • Untrusted Results Passed by Reference (untrusted_results_passed_by_reference, under Application Security) = true
   • Plan Fixed Before Untrusted Data (plan_fixed_before_untrusted_data, under Application Security) = true
   • Untrusted Source Inventory Complete (untrusted_source_inventory_complete, under Application Security) = true
   • Chained Model Output Treated as Untrusted (chained_model_output_treated_as_untrusted, under Application Security) = true
   • Persisted Memory Trust Handling (persisted_memory_trust_handling, under Application Security) = no_persisted_memory
   • Trust Labels Assigned by Deterministic Controller (trust_labels_assigned_by_deterministic_controller, under Authorization & RBAC) = true

Use exactly this control name. The lesson 8 model files refer to the control by its name, and an import finds it only if a control with that name already exists in the Browser.

The control's Privileged planner isolated from untrusted content countermeasure turns on only when all nine answers hold: the five isolation-design answers and the four inventory answers together. The four inventory answers alone also turn on its Complete untrusted-channel inventory countermeasure. To see which countermeasures a control's answers turn on, open the control from the Browser and go to its Countermeasures tab. In a real model, answer each field only when the team confirms it.

Generate again.

What you should see

Findings: 1 systemic finding: 1 Confirmed · 0 Not ruled out.

Facts to establish: 1 question.

Facts that could raise a finding:

• Draw the Agent Tool Call from Support copilot to the harness that reads files for it, if there is one

Model gaps: No gaps these patterns can detect; not an attestation of completeness.

The lethal trifecta at the support copilot is still Confirmed. Its state now reads Confirmed · control modelled on U, X instead of Confirmed · unmitigated.

What changed and why

The finding stays. U, P and X are all still present. The control did not change a fact about what the copilot reads, holds or sends, so no required leg became absent.

The control earns credit on U and on X. Expand the finding. In its leg list, the U and X legs read control modelled. In the finding's diagram, each credited route reads control modelled with the control's name, shortened. Click a leg in the diagram: its dialog lists each credit as "credited by" and the control's name. Only present routes earn credit. The copilot's undetermined routes, through the CRM and the staff console, carry none.

Why U and X. A control counts against a route only when one of its countermeasures is linked to a technique the route stands for. Here only Privileged planner isolated from untrusted content is linked. It isolates indirect prompt injection (AML.T0051.001), which the copilot's U routes stand for. It also applies two mitigations against Exfiltration via AI Agent Tool Invocation (AML.T0086), which its present X routes stand for: Restrict AI Agent Tool Invocation on Untrusted Data (AML.M0030) and Segmentation of AI Agent Components (AML.M0032). An isolation link counts as prevention, and the credit table counts both mitigations as prevention too. Complete untrusted-channel inventory is linked to no technique and no mitigation, so it earns no credit of its own.

Control modelled moves the finding down the list. Findings are ranked unmitigated or detected only before a control modelled. In a model with more findings, this trifecta now ranks below the unmitigated and detected only findings of the same confidence and severity band.

Control modelled is a statement about the model. It says a control is recorded against the route. It says nothing about how well the control works in practice. So record it only on evidence that the isolation is architectural: untrusted content is quarantined by the design, and the part that chooses tool calls never reads it. A sentence in the system prompt telling the model to ignore instructions in tickets is not isolation: do not record a control for it.

An inventory alone is not isolation. The inventory is necessary, but not sufficient. A complete list of untrusted channels says that every channel is known. It does not say that the model choosing tool calls never reads them. The control reads it the same way: the inventory countermeasure earns nothing on its own, and the isolation countermeasure turns on only when the inventory answers hold as well. Record the control as isolation only when the design answers hold too, as they do here.

A fix and a control are different. In lesson 6, approval made a required leg absent and the finding went. Here, the finding stays and is credited. Use a fix to break a finding; record a control to show what stands against it.

Exercise: Detection is not prevention

On a scratch copy of lesson 5's solution, where injection to action is still Confirmed, add a control that only detects. It traces every action the copilot takes and pages a staffed team on suspicious tool use. Create it in the Browser the same way and assign it to the copilot:

On a scratch copy: import L5-solution.zip and rename it.

1. Add the control Support copilot: agent activity tracing and alerting (class Agent Activity Tracing & Alerting) to Support copilot, answering:
   • Tool Execution Spans Emitted (tool_execution_spans_emitted, under Logging & Monitoring) = true
   • Agent Identity and Delegation Chain Attributed (agent_identity_and_delegation_chain_attributed, under Attribution) = true
   • Tool Call Arguments Captured (tool_call_arguments_captured, under Logging & Monitoring) = true
   • Tool Call Results Captured (tool_call_results_captured, under Logging & Monitoring) = true
   • Prompt Content Captured (prompt_content_captured, under Logging & Monitoring) = true
   • Telemetry Configuration Centrally Enforced (telemetry_config_centrally_enforced, under Logging & Monitoring) = true
   • Alerts Routed to a Staffed Response (alerts_routed_to_staffed_response, under Detection Alerting) = true
   • Alert on Agent Config Self-Modification (alert_on_agent_config_self_modification, under Detection Alerting) = true
   • Alert on Anomalous Tool Activity (alert_on_anomalous_tool_activity, under Detection Alerting) = true
   • Agent Alert Rules Immutable to Agents (agent_alert_rules_immutable_to_agents, under Authorization & RBAC) = true

These answers turn on two countermeasures: Complete agent action tracing and Alerting on injected tool misuse and agent config self-modification. Check them on the control's Countermeasures tab. Generate again.

Findings: 2 systemic findings: 2 Confirmed · 0 Not ruled out.

Facts to establish: 1 question.

Facts that could raise a finding:

• Draw the Agent Tool Call from Support copilot to the harness that reads files for it, if there is one

Model gaps: No gaps these patterns can detect; not an attestation of completeness.

Injection to action stays Confirmed, and its state now reads Confirmed · detected only on untrusted input, action tools, no gate. The trifecta also reads Confirmed · detected only on U, P, X: the tracing control credits all three required legs as detection, and none as prevention. The team sees an injected action and is paged, but nothing stops it. Detection never counts as prevention.

Detection covers only what it can observe. The traces record the copilot's own tool calls. A way out that never passes through them is not seen. For example, an image the staff console renders makes the staff member's browser call the address in it, and no trace records that call.

The trace store is part of the model too. The control captures prompt content, so the traces hold ticket text and customer records. Draw the trace store as an element, attach those items to it, and put it in its true zone, for example the Vendor zone if a vendor hosts it.

Delete the copy when you are done.

Next

Lesson 8: Leave what you don't know open. A second agent joins, and you answer only what the team tells you.