{
  "updated_at": "2026-09-18T12:00:00Z",
  "cognitive_layers": [
    {
      "layer_id": "perception",
      "name": "Perception Layer (Input Processing & Context)",
      "threat_summary": "Weaponization of untrusted inputs, indirect context injections via web scraping/documents, and tokenizer bypasses that override system instructions.",
      "associated_aaps": [
        "AAP-001",
        "AAP-002"
      ],
      "primary_risk_driver": "Unsanitized third-party text directly altering system instruction state in the model context window.",
      "recommended_control": "Dual-LLM architectural isolation (privileged planner vs untrusted parser) and structural XML delimiter validation."
    },
    {
      "layer_id": "brain",
      "name": "Brain / Reasoning Layer (Planning & Routing)",
      "threat_summary": "Subversion of task decomposition, deceptive goal re-prioritization, semantic tool poisoning, and lateral impersonation between agent swarm nodes.",
      "associated_aaps": [
        "AAP-004",
        "AAP-006"
      ],
      "primary_risk_driver": "Natural-language tool description poisoning manipulating the LLM router's semantic similarity matching.",
      "recommended_control": "Cryptographically signed tool schemas, deterministic intent gating, and inter-agent mTLS authentication."
    },
    {
      "layer_id": "action",
      "name": "Action Layer (Tools, Actuation & Sinks)",
      "threat_summary": "Unauthorized invocation of state-modifying tools, parameter tampering, command injection via shell built-ins, and multi-turn autonomous retry loops.",
      "associated_aaps": [
        "AAP-003",
        "AAP-007"
      ],
      "primary_risk_driver": "Un-sandboxed execution of arbitrary OS binaries and AST parser discrepancies allowing subshell breakout.",
      "recommended_control": "MicroVM ephemeral isolation (Firecracker), non-bypassable JIT approval gates, and Linux capability stripping (CAP_SYS_ADMIN drops)."
    },
    {
      "layer_id": "memory",
      "name": "Memory & Persistence Layer (State & Vector DB)",
      "threat_summary": "Persistent poisoning of long-term vector embeddings, episodic state contamination, and cross-session sleeper vulnerabilities surviving restarts.",
      "associated_aaps": [
        "AAP-005"
      ],
      "primary_risk_driver": "Corrupted semantic memories loaded into subsequent user sessions without authenticity verification.",
      "recommended_control": "Read-only signed embedding stores, semantic drift anomaly detection, and strict session-scoped episodic isolation."
    }
  ]
}