Home

/

Prompt Injection: Blast Radius

/

Control Mapping

Control Mapping

Appendix C
Appendix
5
min read

A caution before the tables. Mappings like these are useful for conversation and dangerous for assurance. A tick in a row means the mechanism addresses part of that category, not that the category is closed. Nothing here is a certification and no framework in this list has a control that prompt injection cleanly satisfies.

OWASP Top 10 for LLM Applications (2026)

#CategoryAddressed byCoverage
LLM01Prompt InjectionThe whole book. Directly: the gate (ch 9), quarantine (ch 7)Contained, not prevented. Ch 4 and ch 20 explain why prevention is not on offer
LLM02Sensitive Information DisclosureEgress (ch 10), capability scoping (ch 8), quarantine (ch 7)Substantial for agent-mediated disclosure. Says nothing about disclosure through other paths
LLM03Excessive AgencyThe gate (ch 9), capability (ch 8), human-in-the-loop (ch 14)The book's strongest coverage. Chapter 9 turns this from a prompt instruction into an architectural property
LLM04Data and Model PoisoningMemory and retrieval provenance (ch 12)Retrieval and memory only. Training-time poisoning is out of scope
LLM05Improper Supply ChainTool register, pinning, description hashing (ch 13)Tool and agent supply chain. Not your general dependency programme
LLM06Insecure Output HandlingThe renderer and URI policy (ch 10)Good, for the exfiltration case. Other output-handling risks unaddressed
LLM07Vector and Memory FlawsProvenance on memory writes and retrieval (ch 12)Partial. Embedding inversion is not covered
LLM08MisinformationNot addressed. A contained agent can still be confidently wrong
LLM09Hidden Context ExposureQuarantine (ch 7), the two-reason verdict (ch 9)Partial
LLM10Unbounded ConsumptionEgress budgets (ch 10), capability expiry (ch 8)Incidental. This book is not about cost control

Two rows have no coverage and it is worth being direct about them. Misinformation is a model-quality problem that containment does nothing for. Unbounded consumption is touched only because budgets happen to bound it.

NIST AI Risk Management Framework

FunctionRelevant artifact from this book
GovernThe policy shape and tool register (ch 18, ch 13); the boundary of what is out of scope, stated in the front matter
MapThe trifecta audit (ch 3, Appendix A). This is the closest thing in the book to a risk assessment and is what to hand over when asked for one
MeasureThe injection suite and coverage metrics (ch 15); red team findings (ch 16). Note: coverage, not a pass rate. Ch 15 explains why a pass rate misleads
ManageThe gate, capability, egress and approval mechanisms (ch 8-10, 14); incident response (ch 17)

The framework asks for measurement, and this book's honest position is that the available measurements are coverage counts and regression results rather than an assurance figure. Say that plainly rather than producing a percentage.

EU AI Act

Status as of September 2026, per Regulation (EU) 2026/1744 (Digital Omnibus on AI), adopted 8 July 2026, in force 27 July 2026.

ObligationDateRelevance
Prohibited practicesEnforceable since Feb 2025Unlikely to bite an internal agent
GPAI model obligationsSince Aug 2025Applies to model providers, not to you as a deployer
Article 50 transparency2 August 2026 — this date heldThe one most likely to apply. If your agent talks to people, tell them it is an agent
High-risk, Annex IIIDeferred to 2 December 2027A genuine compliance project if you are in scope
High-risk, Annex I (product-embedded)Deferred to 2 August 2028As above

Artifacts this book produces that a high-risk assessment will want: the trifecta audit (risk assessment), the tool register (component inventory), capability issuance (access control), the approval surface (human oversight), the injection suite (testing evidence), and the four log records (record-keeping).

This is not legal advice. The dates are cited from the Official Journal. Which annex you are in is a question for counsel.

SOC 2 and ISO 27001

Neither has a control that names prompt injection, so the mapping runs through existing control families.

FamilyWhat to point at
Logical accessCapability issuance derived from user authority, per-task, expiring (ch 8)
Change managementTool register with pinned hashes and review dates (ch 13)
MonitoringGate verdict log including denials (ch 9, ch 17)
Incident responseThe three questions and the four records (ch 17), plus the rehearsal
Vendor managementThe six procurement questions (ch 18)

The useful framing with an assessor is that an agent is a privileged automated actor, and the controls you would apply to any such actor apply here. That conversation goes better than one that starts with the word "AI".

What no framework currently asks for

Three things this book treats as central that no mainstream framework will request. Expect to explain them.

Provenance tracking. No control anywhere asks whether your system knows the origin of the values it acts on. It is the most important property in this book and there is no box for it.

Irreversibility classification. Frameworks ask about access control. None ask which of your operations cannot be undone, which is the axis chapter 14 argues should drive human oversight.

Approval fatigue. Every framework counts whether human oversight exists. None measure whether it is real. An organisation rubber-stamping a thousand prompts a day passes the control and has no oversight at all.

If you are writing internal standards, these three are worth adding. They are where the actual risk sits, and the absence of a box does not make them optional.

the-three-year-bug
why-the-industry-shipped-anyway
injection-is-not-jailbreaking
why-the-confusion-persists
the-lethal-trifecta
running-the-audit
why-filtering-fails
measured-here-on-a-named-model
why-this-is-structural
what-solved-would-look-like
the-harness
provenance-every-value-knows-where-it-came-from
on-the-reference-agent
quarantine-the-planner-never-reads-the-mail
what-two-models-cost-in-practice
capability-authority-the-agent-cannot-widen
expiry-is-a-feature
the-gate-the-model-proposes-code-disposes
the-policy
failing-closed
egress-closing-the-exfiltration-leg
how-much-can-actually-leak
sandboxing-containing-the-code-the-agent-writes
the-sandbox-held-and-it-did-not-help
poisoned-memory-poisoned-retrieval
cleaning-up-afterwards
the-tool-supply-chain
mcp-and-the-rest
human-in-the-loop-that-isnt-theatre
when-there-is-nobody-there
testing-for-injection
measuring-coverage-not-pass-rate
red-teaming-agents
a-finding-worked-through
when-it-happens-anyway
what-the-logs-cost-you-in-an-incident-you-did-not-have
governance-procurement-and-the-regulator
writing-the-policy
end-to-end
what-it-actually-took
what-stays-broken
why-this-is-probably-structural
the-trifecta-audit-worksheet
action-schema-and-policy-reference
control-mapping
prompt-injection-sources
incidents
appendix-e-what-we-re-ran-ourselves
e4-the-control-that-keeps-e2-and-e3-honest

Download the full PDF for free?

Free download — no account required

Get the PDF
Get the PDF
Related Chapters
Free Download
Get the full PDF
All pages, including all code examples, diagrams, and the appendix reference card.
No spam. Unsubscribe at any time.
Your email won't be shared.
Oops! There's a problem with your request. We're working on fixing it. Please try again later.