# CLAWLINE ASI Assessment Template **Template version:** `CLAWLINE_ASI_TEMPLATE_V0.7_2026-07-02` **Use with:** `CLAWLINE_METHOD_V0.7_ASI_ALIGNMENT_2026-07-02` **Status:** Candidate assessment template **Scope:** Evidence-backed assessment reporting for OWASP ASI Top 10 traceability. **Automated assessment scope:** `STATIC_SUBMISSION`; `runtime_behavior_verified: false`. **Machine-readable contract:** [ASI assessment v0.7 JSON Schema](https://theclawline.com/schemas/asi-assessment-v0.7.schema.json) This template is an additive v0.7 candidate profile. It preserves the existing v0.5 base submission fields and accepts the optional ABOM v0.4 intake only at `clawline_submission.disclosure.clawline_disclosure.abom`. The ABOM contains untrusted `claimed_*` values. The checkup API exposes a sanitized, derived `owasp_asi` projection with `projection_version: "clawline-api-owasp-asi/v1"`, `archival_assessment_schema: "https://theclawline.com/schemas/asi-assessment-v0.7.schema.json"`, `assessment_scope`, `runtime_behavior_verified`, `version`, `traceability`, optional `claimed_traceability`, `claim_conflict`, `risk_tier`, and `items.ASI01` through `items.ASI10`. Per-item summaries carry computed status/evidence, conditional findings, severity, DAD route, reason codes, and control IDs. The explicit version and schema pointer distinguish this unsigned projection from the full signed archival schema object demonstrated below. --- ## 1. Executive summary | Field | Value | |---|---| | Assessment name | | | Agent / workflow | | | Owner | | | Sponsor | | | Environment | dev / test / staging / prod | | Assessment date | | | Assessor | | | Assessment scope | STATIC_SUBMISSION | | Runtime behavior verified | false | | Overall ASI traceability | ASI_TRACEABLE / ASI_TRACEABLE_WITH_EXCEPTIONS / PARTIAL / NOT_ASSESSED | | Blast radius | BR-0 / BR-1 / BR-2 / BR-3 / BR-4 / BR-5 | | DAD decision | ALLOW / WARN / FREEZE / KILL | | CLAWS action | PUBLISH / PUBLISH_WITH_WARN / QUARANTINE / BLOCK | --- ## 2. Evidence states Use only these evidence states: - `OBSERVED` - `TESTED` - `DECLARED` - `UNSUPPORTED` - `ABSENT` - `CONTRADICTED` In the submitter ABOM these appear only as `claimed_evidence_state` and remain untrusted even when the value is `OBSERVED` or `TESTED`. In the verifier output, `evidence_state` is derived from material available to the static assessment. It does not mean CLAWLINE observed a live agent runtime. Use only these coverage states: - `covered` - `covered_with_exceptions` - `partial` - `not_covered` - `not_applicable` - `not_assessed` --- ## 3. ASI coverage table | ASI | Risk | Computed status | Evidence state | CRABS finding, if emitted | DAD route | Exceptions | Remediation owner | |---|---|---|---|---|---|---|---| | ASI01 | Agent Goal Hijack | | | CRABS-ASI01 | DAD-ASI01-WRN / DAD-ASI01-CRT | | | | ASI02 | Tool Misuse and Exploitation | | | CRABS-ASI02 | DAD-ASI02-WRN / DAD-ASI02-CRT | | | | ASI03 | Identity and Privilege Abuse | | | CRABS-ASI03 | DAD-ASI03-WRN / DAD-ASI03-CRT | | | | ASI04 | Agentic Supply Chain Vulnerabilities | | | CRABS-ASI04 | DAD-ASI04-WRN / DAD-ASI04-CRT | | | | ASI05 | Unexpected Code Execution / RCE | | | CRABS-ASI05 | DAD-ASI05-WRN / DAD-ASI05-CRT | | | | ASI06 | Memory and Context Poisoning | | | CRABS-ASI06 | DAD-ASI06-WRN / DAD-ASI06-CRT | | | | ASI07 | Insecure Inter-Agent Communication | | | CRABS-ASI07 | DAD-ASI07-WRN / DAD-ASI07-CRT | | | | ASI08 | Cascading Failures | | | CRABS-ASI08 | DAD-ASI08-WRN / DAD-ASI08-CRT | | | | ASI09 | Human-Agent Trust Exploitation | | | CRABS-ASI09 | DAD-ASI09-WRN / DAD-ASI09-CRT | | | | ASI10 | Rogue Agents | | | CRABS-ASI10 | DAD-ASI10-WRN / DAD-ASI10-CRT | | | For every row, a WARN finding uses `-WRN` and a CRITICAL finding uses `-CRT`. An INFO row emits no finding and carries `-WRN` only as the canonical placeholder. --- ## 4. Per-item evidence worksheet ### ASI01 - Agent Goal Hijack - Required evidence: - [ ] Intent capsule / task envelope. - [ ] Goal-state identifier. - [ ] Constraint hash or policy reference. - [ ] Goal-drift telemetry. - [ ] Red-team result for hidden goal override. - Negative-space result: - Finding: - Remediation: ### ASI02 - Tool Misuse and Exploitation - Required evidence: - [ ] Approved tool catalog. - [ ] Fully qualified tool names. - [ ] Version pins / manifest hashes. - [ ] Semantic tool firewall. - [ ] Tool sequence policy. - [ ] Cost, rate, fan-out, and loop caps. - Negative-space result: - Finding: - Remediation: ### ASI03 - Identity and Privilege Abuse - Required evidence: - [ ] Discrete agent identity. - [ ] Owner and sponsor. - [ ] Delegation-chain map. - [ ] Per-action authorization receipt. - [ ] Short-lived task-scoped credential proof. - [ ] Token revocation test. - Negative-space result: - Finding: - Remediation: ### ASI04 - Agentic Supply Chain Vulnerabilities - Required evidence: - [ ] ABOM v0.4. - [ ] Signed or pinned manifests. - [ ] Registry trust tier. - [ ] Runtime attestation. - [ ] Install/activation allowlist. - [ ] Supply-chain kill switch proof. - Negative-space result: - Finding: - Remediation: ### ASI05 - Unexpected Code Execution / RCE - Required evidence: - [ ] Code generation separated from code execution. - [ ] Production `eval` / direct shell execution prohibited or sandboxed. - [ ] Pre-execution scan result. - [ ] Sandbox/container/VM proof. - [ ] Filesystem/network/syscall policy. - [ ] Dedicated ephemeral working directory. - [ ] Production execution gate and rollback path. - Negative-space result: - Finding: - Remediation: ### ASI06 - Memory and Context Poisoning - Required evidence: - [ ] Memory write gate. - [ ] Source/provenance metadata. - [ ] Tenant/session namespace isolation. - [ ] TTL or decay policy. - [ ] Snapshot/rollback/quarantine proof. - [ ] Self-reingestion denial or cap. - Negative-space result: - Finding: - Remediation: ### ASI07 - Insecure Inter-Agent Communication - Required evidence: - [ ] mTLS or equivalent mutual authentication. - [ ] Message signing/integrity protection. - [ ] Nonce/timestamp replay defense. - [ ] Agent descriptor/card validation. - [ ] Registry trust record. - [ ] Semantic intent diffing. - Negative-space result: - Finding: - Remediation: ### ASI08 - Cascading Failures - Required evidence: - [ ] Dependency graph. - [ ] Fan-out/recursion/retry/queue caps. - [ ] Circuit breakers. - [ ] Progress/loop caps. - [ ] Replay or digital-twin test. - [ ] Rollback or compensation drill. - Negative-space result: - Finding: - Remediation: ### ASI09 - Human-Agent Trust Exploitation - Required evidence: - [ ] Trust UX review. - [ ] Risk-summary template. - [ ] Confidence/provenance cues. - [ ] Approval screen showing impact. - [ ] Suspicious-interaction reporting path. - [ ] Anti-manipulative UI review. - Negative-space result: - Finding: - Remediation: ### ASI10 - Rogue Agents - Required evidence: - [ ] Behavioral manifest hash. - [ ] Behavior attestation cadence. - [ ] Watchdog/policy/peer validation. - [ ] Self-replication/self-provisioning block. - [ ] Kill-switch test. - [ ] Rogue-agent quarantine playbook. - Negative-space result: - Finding: - Remediation: --- ## 5. Signed archival machine-readable report block The following is a complete schema-conforming `NOT_ASSESSED` example. It deliberately emits no synthetic findings. Each INFO item uses its canonical `-WRN` route placeholder; that does not mean a WARN finding was emitted. Replace placeholders with real derived values; do not copy submitter claims into verifier fields. `WARN` and `PUBLISH_WITH_WARN` are assessment/publication decisions for this static submission, not live runtime actions. ```json { "assessment_version": "0.7", "abom_version": "0.4", "method_version": "CLAWLINE_METHOD_V0.7_ASI_ALIGNMENT_2026-07-02", "policy_version": "DAD_POLICY_V6_ASI_2026-07-10", "assessment_id": "assessment_example_001", "submission_id": "submission_example_001", "assessment_scope": "STATIC_SUBMISSION", "runtime_behavior_verified": false, "assessed_at": "2026-07-10T00:00:00Z", "assessed_by": "CLAWLINE", "canonical_sha256": "0000000000000000000000000000000000000000000000000000000000000000", "assessment_signature": { "algorithm": "HMAC-SHA256", "key_id": "verifier-key-example", "encoding": "hex", "value": "0000000000000000000000000000000000000000000000000000000000000000" }, "agent": { "identity_subject": "principal:opaque-agent-id", "environment": "unknown", "autonomy_tier": 0, "blast_radius_tier": "BR-0" }, "traceability": "NOT_ASSESSED", "items": { "ASI01": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI01-WRN", "negative_space": [{ "control_id": "ASI01-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI02": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI02-WRN", "negative_space": [{ "control_id": "ASI02-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI03": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI03-WRN", "negative_space": [{ "control_id": "ASI03-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI04": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI04-WRN", "negative_space": [{ "control_id": "ASI04-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI05": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI05-WRN", "negative_space": [{ "control_id": "ASI05-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI06": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI06-WRN", "negative_space": [{ "control_id": "ASI06-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI07": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI07-WRN", "negative_space": [{ "control_id": "ASI07-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI08": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI08-WRN", "negative_space": [{ "control_id": "ASI08-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI09": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI09-WRN", "negative_space": [{ "control_id": "ASI09-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null }, "ASI10": { "computed_status": "not_assessed", "evidence_state": "ABSENT", "finding_ids": [], "finding_emitted": false, "severity": "INFO", "dad_route": "DAD-ASI10-WRN", "negative_space": [{ "control_id": "ASI10-C1", "result": "NOT_ASSESSED", "severity": "INFO", "reason_code": "NOT_REVIEWED_IN_STATIC_SUBMISSION", "evidence_refs": [] }], "evidence_refs": [], "exceptions": [], "remediation": null } }, "dad_decision": "WARN", "claws_action": "PUBLISH_WITH_WARN" } ``` --- ## 6. Final claim language Use one of these report statements: - `ASI_TRACEABLE`: All ten items have observed or tested evidence and no unresolved critical negative-space findings. - `ASI_TRACEABLE_WITH_EXCEPTIONS`: All ten items have evidence or documented compensating controls with owners and expiry. - `PARTIAL`: One or more ASI items are missing evidence or have unresolved findings. - `NOT_ASSESSED`: ASI evidence was not reviewed. Do not claim OWASP certification or endorsement. Do not claim that runtime behavior was verified from this automated report. A separate runtime observation or test engagement must identify its own scope and evidence.