Mandate 2.3.3 Code Evaluation Skill
Mandate
- ID: 2.3.3
- Title: Human Verification for Critical Actions
Mitigates
- LLM01 Prompt Injection
- LLM06 Excessive Agency
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
- ASI09 Human-Agent Trust Exploitation
- MCP04 Tool Interference
Inputs
- Agent orchestration code
- Action execution handlers
- Approval workflow modules
- Audit logging modules
Workflow
- Identify critical action sinks.
- Include irreversible delete, fund transfer, access grants, production config changes, and other high-impact operations.
- Build source-to-sink paths.
- Trace AI decision/output paths that can invoke each critical sink.
- Locate approval gate controls.
- Verify a mandatory gate function exists before each sink (not after).
- Validate gate strictness.
- Confirm gate requires explicit user identity, approval decision, timestamp, and action scope.
- Detect bypass paths.
- Flag feature flags, debug modes, or alternate code paths that can call critical sinks without approval.
- Validate fail-safe behavior.
- Confirm default on gate errors/timeouts is deny/block, not allow.
- Validate audit evidence.
- Confirm approval decisions and execution linkage are logged with immutable identifiers.
- Emit findings per sink with direct call-path evidence.
Decision Rules
- Pass if every AI-reachable critical sink has a mandatory, non-bypassable pre-execution human approval gate.
- Fail if any sink lacks one or allows bypass.
Severity Rules
- Critical: any high-impact sink reachable without approval.
- High: approval exists but bypassable or fail-open.
- Medium: approval exists but weak audit linkage.
Output Template
{
"mandate_id": "2.3.3",
"status": "fail",
"severity": "critical",
"vulnerability_tags": ["LLM01", "LLM06", "ASI01", "ASI02", "ASI09", "MCP04"],
"evidence": [
{"file": "src/actions/deleteAccount.ts", "line": 63, "detail": "Critical delete action executes without approval check"},
{"file": "src/agent/router.ts", "line": 111, "detail": "AI output can directly invoke delete action"}
],
"remediation": "Require explicit human approval gate before all critical action handlers and remove bypass paths."
}
Guardrails
- Use code and repo configuration evidence only.
- Always include file-level evidence for each finding.
- If required evidence is missing in code, mark control as not implemented.
1---2name: mandate-2-3-3-code-evaluation3description: Evaluate compliance for Mandate 2.3.3 (Human Verification for Critical Actions) using repository code and configuration analysis. Use when producing deterministic pass/fail findings with severity, mapped mitigated vulnerabilities, and file-level evidence.4---56# Mandate 2.3.3 Code Evaluation Skill78## Mandate9- ID: 2.3.310- Title: Human Verification for Critical Actions1112## Mitigates13- LLM01 Prompt Injection14- LLM06 Excessive Agency15- ASI01 Agent Goal Hijack16- ASI02 Tool Misuse and Exploitation17- ASI09 Human-Agent Trust Exploitation18- MCP04 Tool Interference1920## Inputs21- Agent orchestration code22- Action execution handlers23- Approval workflow modules24- Audit logging modules2526## Workflow271. Identify critical action sinks.28 - Include irreversible delete, fund transfer, access grants, production config changes, and other high-impact operations.292. Build source-to-sink paths.30 - Trace AI decision/output paths that can invoke each critical sink.313. Locate approval gate controls.32 - Verify a mandatory gate function exists before each sink (not after).334. Validate gate strictness.34 - Confirm gate requires explicit user identity, approval decision, timestamp, and action scope.355. Detect bypass paths.36 - Flag feature flags, debug modes, or alternate code paths that can call critical sinks without approval.376. Validate fail-safe behavior.38 - Confirm default on gate errors/timeouts is deny/block, not allow.397. Validate audit evidence.40 - Confirm approval decisions and execution linkage are logged with immutable identifiers.418. Emit findings per sink with direct call-path evidence.4243## Decision Rules44- Pass if every AI-reachable critical sink has a mandatory, non-bypassable pre-execution human approval gate.45- Fail if any sink lacks one or allows bypass.4647## Severity Rules48- Critical: any high-impact sink reachable without approval.49- High: approval exists but bypassable or fail-open.50- Medium: approval exists but weak audit linkage.5152## Output Template53```json54{55 "mandate_id": "2.3.3",56 "status": "fail",57 "severity": "critical",58 "vulnerability_tags": ["LLM01", "LLM06", "ASI01", "ASI02", "ASI09", "MCP04"],59 "evidence": [60 {"file": "src/actions/deleteAccount.ts", "line": 63, "detail": "Critical delete action executes without approval check"},61 {"file": "src/agent/router.ts", "line": 111, "detail": "AI output can directly invoke delete action"}62 ],63 "remediation": "Require explicit human approval gate before all critical action handlers and remove bypass paths."64}65```6667## Guardrails68- Use code and repo configuration evidence only.69- Always include file-level evidence for each finding.70- If required evidence is missing in code, mark control as not implemented.
jefflyt