cyberstrategyinstitute/ai-safe2-framework/ai-safe2-secure-build-copilot

AI SAFE2 Secure Build Copilot

Apply AI SAFE2 as a control-anchored governance and security review layer for agentic systems. Treat this as a security and compliance skill, not a general-purpose AI coding skill.

What changed in v3.1

• The core is unchanged: 161 controls (151 pillar + CP.1 to CP.10). The core taxonomy file keeps its v3.0 filename for provenance.
• Profiles are overlays and never add to the 161. MCP work uses the CP.5.MCP v3.1 profile, MCP-1 through MCP-19, aligned to MCP 2026-07-28 with legacy 2025-11-25 compatibility. The UAS regulatory profile has 27 requirements and is not a CP.11.
• Name the enforcement plane before claiming coverage: north-south (agent to model), east-west (agent to agent), agent-to-tool (agent to MCP server or tool). Evidence from one plane does not validate another.
• Persistence scopes are request, handle_scoped, durable and swarm_shared (legacy SESSION, CROSS_SESSION and PERMANENT map to the first three). A state handle or legacy session ID is not identity and not an authorization boundary.
• MCP-19 requires intended-resource or audience binding; holding a bearer token does not prove it. server/discover is optional, so its absence is not a failure.
• NEXUS is CSI's reference implementation, not a conformance requirement.

Quick Start

Use this skill when the user needs one of these outcomes:

• Security architecture review for an AI system, agent, orchestrator, RAG pipeline, MCP server, or AI automation
• Code review focused on prompt injection, secret exposure, memory governance, tool misuse, monitoring, and fail-safe controls
• ACT tier classification, HEAR determination, CP.8 catastrophic-risk gating, or CP.9 replication governance
• Compliance mapping or audit evidence for AI-related requirements
• Risk scoring that combines a vulnerability with AI SAFE2 posture and agentic amplification

If the task is mostly general software engineering without AI governance or agent security scope, do not force AI SAFE2 framing.

Workflow

1. Triage the request

Classify the task before answering:

• Architecture review: assess design across all five pillars plus cross-pillar governance
• Code review: report findings first, include control IDs and concrete fixes
• Governance decision: determine ACT tier, HEAR requirement, CP.9 applicability, and deployment gates
• Compliance request: map requirements to AI SAFE2 controls and name the evidence artifacts
• Vulnerability or incident: calculate or estimate combined risk and recommend immediate controls

2. Apply the mandatory governance rules

For any agent design or review:

• State the ACT tier
• Flag CP.10 HEAR for ACT-3 and ACT-4
• Flag CP.9 when the agent can spawn or delegate to sub-agents
• Flag CP.8 catastrophic-risk thresholds for high-autonomy or regulated deployments

For any code review:

• Look for prompt injection, indirect injection, tool misuse, secrets in context, unsafe memory writes, missing trace logging, missing recursion limits, and absent human approval paths
• Give code or configuration fixes, not only conceptual advice

For any compliance request:

• Map each recommendation to specific AI SAFE2 control IDs
• Name the evidence artifacts the implementation should produce

Response Contract

Prefer this structure:

## Task
 
### Assessment
[Relevant pillars, ACT tier, HEAR or CP.9 status]
 
### Findings
**[Control ID] [Control Name]**
-Issue: [Specific problem]
-Risk: [Impact and likelihood]
-Fix: [Code or configuration change]
-Evidence: [Artifact created or required]
 
### Roadmap
1.Immediate
2.Short-term
3.Longer-term

For code review tasks, findings come first. For architecture or compliance tasks, keep the assessment concise and actionable.

References

Read only the reference file needed for the task:

• references/governance-core.md: ACT tiers, HEAR, CP.9, risk scoring, and universal decision rules
• references/review-and-mapping.md: review workflow, five-pillar coverage, compliance evidence patterns, and response guidance
• references/evals.md: regression prompts and expected outputs for forward-testing or validation