Mandate 2 2 5 Runtime Evidence Intake Guide

Mandate 2.2.5 Runtime Evidence Intake and Guidance Skill

Mandate

• ID: 2.2.5
• Title: Model Asset Protection

Mitigates

• ML05 Model Theft
• ML10 Model Poisoning
• ML03 Model Inversion Attack
• LLM10 Unbounded Consumption

Objective

Transform user-provided operational context into an actionable evidence collection plan for model confidentiality, integrity, and access governance controls.

Natural-Language Intake Workflow

1. Ask where model artifacts are stored, served, and backed up.
2. Ask which users/services can read, write, export, or deploy model assets.
3. Ask how encryption at rest/in transit is implemented and audited.
4. Ask how keys are generated, rotated, and access-controlled.
5. Ask how data/model exfiltration is detected and blocked.
6. Ask how model integrity/signing is verified in delivery pipelines.
7. Ask for incident response process for theft/tampering events.

Context Normalization Schema

Capture and normalize answers into:

• asset_inventory: registry locations, buckets, artifact types, endpoints.
• access_surface: principals, roles, permissions, boundary controls.
• crypto_controls: encryption modes, TLS posture, key ownership.
• key_management: KMS/HSM usage, rotation cadence, key policy.
• exfiltration_controls: egress restrictions, anomaly detection, DLP hooks.
• integrity_chain: signing, checksum validation, attestation in pipeline.
• ir_readiness: runbooks, drills, escalation, forensic logging.

Supporting Documents to Request

1. Model registry/storage security configurations.
2. KMS/HSM policy and key rotation evidence.
3. Access and egress audit logs.
4. Deployment pipeline attestation/signing records.
5. Incident response runbooks and exercise evidence.

Guidance to Generate Supporting Evidence

1. Generate model asset inventory.
   • Export registry metadata and storage object inventories.
2. Generate encryption and key-management evidence.
   • Export bucket/volume encryption configs and key policy details.
   • Export key rotation status and access logs.
3. Generate access governance evidence.
   • Export IAM/RBAC bindings and recent read/export activity.
4. Generate exfiltration monitoring evidence.
   • Export egress logs, anomaly alerts, and blocked events.
5. Generate integrity evidence.
   • Export signature verification artifacts and pipeline attestations.
6. Generate incident readiness evidence.
   • Export runbooks, tabletop results, and post-incident reviews.

System Command Templates (Adapt to Environment)

• AWS model storage encryption:
  • aws s3api get-bucket-encryption --bucket <model-bucket> > bucket_encryption.json
• AWS KMS key posture:
  • aws kms describe-key --key-id <key-id> > kms_key_details.json
  • aws kms get-key-rotation-status --key-id <key-id> > kms_rotation_status.json
• IAM and access policy export:
  • aws iam list-roles > iam_roles.json
  • gcloud projects get-iam-policy <project-id> --format=json > gcp_iam_policy.json
  • az role assignment list --all --output json > azure_role_assignments.json
• Access activity logs (example):
  • aws cloudtrail lookup-events --start-time <start> --end-time <end> > cloudtrail_model_access.json
• Container/image signing checks:
  • cosign verify --key <public-key> <image-ref>
  • cosign verify-blob --key <public-key> --signature <sig-file> <artifact-file>
• Kubernetes egress/network controls:
  • kubectl get networkpolicy -A -o yaml > network_policy_export.yaml

Evidence Completeness Rules

• Require direct evidence for confidentiality, integrity, and access controls.
• Reject evidence without timestamps, owner/service identity, or environment scope.
• Flag evidence as stale if outside the assessment period.

Final Assessment Readiness

• Ready only when storage, crypto, key, access, egress, integrity, and incident-readiness evidence are all present and consistent.
• Not ready if any control domain is missing or weakly evidenced.

Output Contract

Return:

• context_profile
• asset_control_matrix
• required_artifacts_checklist
• artifact_generation_steps
• command_templates
• evidence_status_matrix
• assessment_readiness
• remaining_gaps

Guardrails

• Keep command guidance read-only unless user explicitly asks for changes.
• Ask follow-up questions for unclear ownership or environment boundaries.
• Avoid final pass/fail until evidence completeness reaches ready state.