Quartz 5

SECURITY_STANDARDS

9 min read

PAI Security Standards

NIST CSF, OWASP AI, and Zero Trust Implementation

Version: 1.0
Created: 2026-06-21
Purpose: Map industry security standards to PAI implementation
Related: GOVERNANCE_FRAMEWORK.md, ITIL_FRAMEWORK.md

Overview

PAI implements security using three complementary frameworks:

  1. NIST Cybersecurity Framework (CSF) - Comprehensive security program
  2. OWASP Top 10 for LLM/AI Applications - AI-specific threats
  3. Zero Trust Architecture - Modern security model

Implementation Philosophy:

  • Evidence-based (every control has proof)
  • Risk-proportionate (effort matches threat)
  • Pragmatic (security enables, doesn’t block)

1. NIST Cybersecurity Framework

IDENTIFY (Asset Management & Risk Assessment)

ID.AM - Asset Management

Standard: Know what you’re protecting

PAI Implementation:

  • ✅ ID.AM-1: Physical devices inventoried

    • Evidence: PAI/config/inventory.yml (12 devices on Tailscale)
    • Coverage: pai-primary, workstations, phones, tablets

  • ✅ ID.AM-2: Software platforms inventoried

    • Evidence: SERVICE_CATALOG.md (112 skills, 14 agents, 46 services)
    • Coverage: Engines (PNC/PNG/PNO/PNX/PNK), dependencies

  • ✅ ID.AM-3: Organizational communication flows mapped

    • Evidence: Cross-engine architecture (ICM, OmniPulse)
    • Coverage: Engine-to-engine, external APIs

  • ⚠️ ID.AM-5: Resources prioritized (Partial)

    • Evidence: ITIL Service Catalog has SLE tiers
    • Gap: No explicit asset criticality ranking
    • Remediation: Create asset criticality matrix (defer)

ID.RA - Risk Assessment

Standard: Understand threats and vulnerabilities

PAI Implementation:

  • ✅ ID.RA-1: Vulnerabilities identified

    • Evidence: PAISecurityAudit skill, SecurityTriage skill
    • Coverage: STRIDE-per-asset threat modeling

  • ⚠️ ID.RA-3: Threats from suppliers identified (Partial)

    • Evidence: External API inventory (Anthropic, Google, OpenAI, etc.)
    • Gap: No formal supplier risk assessment
    • Remediation: InfoSecRiskAssessment skill for vendors (defer)

  • ✅ ID.RA-5: Threats, vulnerabilities, likelihoods, impacts determined

    • Evidence: RiskRegister.ts (building this session)
    • Coverage: Risk scoring (likelihood × impact)

ID.GV - Governance

Standard: Security policies and procedures established

PAI Implementation:

  • ✅ ID.GV-1: Security policy established

    • Evidence: GOVERNANCE_FRAMEWORK.md (this document)
    • Coverage: 5 policy categories (Security, Privacy, Quality, Ops, Dev)

  • ✅ ID.GV-3: Legal/regulatory requirements understood

    • Evidence: N/A (personal use, not regulated entity)
    • Note: GDPR-inspired principles applied voluntarily

  • ✅ ID.GV-4: Governance and risk management integrated

    • Evidence: ITIL framework + Risk Management practice (3/5)
    • Coverage: Monthly risk review, problem detection

PROTECT (Safeguards to Ensure Service Delivery)

PR.AC - Access Control

Standard: Limit access to authorized users/processes

PAI Implementation:

  • ✅ PR.AC-1: Identities and credentials managed

    • Evidence: config/verifiable-identities.json, KeyRotation skill
    • Coverage: API keys, credentials, rotation workflows

  • ✅ PR.AC-3: Remote access managed

    • Evidence: Tailscale VPN (zero-trust network)
    • Coverage: All inter-device communication encrypted

  • ✅ PR.AC-4: Permissions managed via least privilege

    • Evidence: settings.json permissions, RBAC (org-rbac.example.yml)
    • Coverage: Tool-level permissions, role-based access

  • ✅ PR.AC-6: Identities authenticated

    • Evidence: Tailscale device authentication, API key verification
    • Coverage: Device identity, service identity

PR.DS - Data Security

Standard: Protect information and records

PAI Implementation:

  • ⚠️ PR.DS-1: Data at rest protected (Accepted Risk)

    • Evidence: LUKS full-disk encryption NOT enabled on pai-primary
    • Status: RISK ACCEPTED - See MEMORY/WORK/20260704-200000_luks-encryption-decision/LUKS_RISK_ACCEPTANCE.md
    • Compensating Controls:
      • Network encryption (Tailscale VPN)
      • Backup encryption (QNAP NAS)
      • Physical security (home office, residential security)
      • Secret management (no plaintext secrets on disk)
    • Migration Plans Ready: Fresh build (Plan A) and in-place conversion (Plan B) documented
    • Review Date: 2027-01-04 (6 months)

  • ✅ PR.DS-2: Data in transit protected

    • Evidence: Tailscale WireGuard encryption, HTTPS for external APIs
    • Coverage: Network-level encryption

  • ✅ PR.DS-5: Protections against data leaks

    • Evidence: OutputSecretsScanner hook, .gitignore patterns
    • Coverage: Secrets never committed, logs scrubbed

  • ⚠️ PR.DS-6: Integrity checking mechanisms (Partial)

    • Evidence: Git version control (detects tampering)
    • Gap: No file integrity monitoring (AIDE/Tripwire)
    • Remediation: Implement FIM for critical configs (defer)

PR.PT - Protective Technology

Standard: Technical security solutions

PAI Implementation:

  • ✅ PR.PT-1: Audit/log records determined/maintained

    • Evidence: STATE.claude/*.jsonl files, systemd journal
    • Coverage: Problem logs, security events, hook actions

  • ✅ PR.PT-3: Principle of least functionality

    • Evidence: Minimal systemd services, no unnecessary daemons
    • Coverage: Only required services running

  • ✅ PR.PT-4: Communications and control networks protected

    • Evidence: Tailscale VPN, firewall rules
    • Coverage: Network segmentation, encrypted comms

DETECT (Identify Security Events)

DE.AE - Anomalies and Events

Standard: Detect anomalous activity

PAI Implementation:

  • ✅ DE.AE-1: Baseline of network operations established

    • Evidence: pai-automation@lan-device-watcher service
    • Coverage: Known devices, expected traffic patterns

  • ✅ DE.AE-2: Detected events analyzed

    • Evidence: Problem Detection (4/5), ProblemMetrics.ts
    • Coverage: Pattern detection (≥3 occurrences)

  • ✅ DE.AE-3: Event data aggregated

    • Evidence: problem-metrics.jsonl, centralized logging
    • Coverage: Security events, problems, hook triggers

DE.CM - Continuous Monitoring

Standard: Monitor for security events

PAI Implementation:

  • ✅ DE.CM-1: Network monitored

    • Evidence: pai-egress-monitor service, audit logs
    • Coverage: Outbound connections logged

  • ✅ DE.CM-4: Malicious code detected

    • Evidence: No automated malware scanning (low risk - curated code)
    • Note: All code reviewed before execution (manual gate)

  • ✅ DE.CM-7: Monitoring for unauthorized activity

    • Evidence: DestructiveOpGuard hook, SecurityValidator hook
    • Coverage: Destructive operations blocked, security violations logged

DE.DP - Detection Processes

Standard: Maintain/test detection processes

PAI Implementation:

  • ✅ DE.DP-2: Detection activities comply with requirements

    • Evidence: Problem Response Playbook
    • Coverage: Incident response workflow documented

  • ⚠️ DE.DP-4: Event detection information communicated (Partial)

    • Evidence: Problem logs written to STATE.claude/
    • Gap: No automated alerting (relies on dashboard review)
    • Remediation: Critical alerts via voice/notification (defer)

RESPOND (Take Action on Detected Events)

RS.AN - Analysis

Standard: Analyze security events

PAI Implementation:

  • ✅ RS.AN-1: Notifications investigated

    • Evidence: Security Triage skill, RCA process
    • Coverage: Adversarial verification of findings

  • ✅ RS.AN-2: Impact of incidents understood

    • Evidence: RCA postmortem template (blameless)
    • Coverage: Timeline, contributing factors, action items

RS.MI - Mitigation

Standard: Contain incidents

PAI Implementation:

  • ✅ RS.MI-2: Incidents mitigated

    • Evidence: Problem Response Playbook (severity-based workflows)
    • Coverage: SEV1-SEV4 response procedures

  • ✅ RS.MI-3: Newly identified vulnerabilities mitigated/documented

    • Evidence: Feedback memories (feedback_*.md)
    • Coverage: Lessons learned, pattern prevention

RS.RP - Recovery Planning

Standard: Restore capabilities

PAI Implementation:

  • ⚠️ RS.RP-1: Recovery plan executed (Partial)
    • Evidence: Backup systems (3-2-1 rule)
    • Gap: No formal BC/DR plan, restore not regularly tested
    • Remediation: Create BC/DR document, test restores quarterly (defer)

RECOVER (Restore Services After Incident)

RC.RP - Recovery Planning

Standard: Manage restoration of systems

PAI Implementation:

  • ⚠️ RC.RP-1: Recovery plan executed (Partial)

    • Evidence: Backups exist, restoration possible
    • Gap: No documented recovery procedures
    • Remediation: Recovery runbook (defer)

  • ✅ RC.IM - Improvements incorporated

    • Evidence: Learning Capture (4/5), reflection mining
    • Coverage: Post-incident improvements documented

2. OWASP Top 10 for LLM Applications

LLM01: Prompt Injection

Threat: Malicious prompts manipulate AI behavior

PAI Mitigation:

  • ✅ ReviewMode skill (dual-context isolation for untrusted input)
  • ✅ PromptInjection skill (testing/detection)
  • ⚠️ Input validation (partial - no systematic sanitization)
  • Remediation: Structured input validation layer (defer)

LLM02: Insecure Output Handling

Threat: Unsanitized AI output causes downstream issues

PAI Mitigation:

  • ✅ OutputSecretsScanner hook (prevents secret leakage)
  • ✅ Algorithm verification phase (output checked before delivery)
  • ✅ Reality Checker (skeptical quality gate)

LLM03: Training Data Poisoning

Threat: Malicious training data affects model behavior

PAI Mitigation:

  • ✅ Use established model providers (Anthropic, Google, OpenAI)
  • ✅ No custom model training (reliance on provider security)
  • N/A for PAI (don’t train models)

LLM04: Model Denial of Service

Threat: Resource exhaustion attacks

PAI Mitigation:

  • ✅ Token budget tracking (UsageProbe.ts)
  • ✅ Rate limiting via API providers
  • ✅ Local Ollama fallback (cost-free tier)
  • ✅ Quota-check gate (Algorithm PLAN phase)

LLM05: Supply Chain Vulnerabilities

Threat: Compromised dependencies

PAI Mitigation:

  • ⚠️ Dependency auditing (partial - no automated scanning)
  • ✅ Minimal dependencies (Bun, TypeScript, curated packages)
  • ⚠️ Provider security reliance (Anthropic, Google, OpenAI)
  • Remediation: npm audit integration, SBOM generation (defer)

LLM06: Sensitive Information Disclosure

Threat: AI reveals private data

PAI Mitigation:

  • ✅ OutputSecretsScanner hook (secret patterns)
  • ✅ Honesty & No Fabrication policy (no made-up credentials)
  • ✅ Privacy boundaries (kids’ consent, personal data)
  • ✅ Data minimization (collect only necessary)

LLM07: Insecure Plugin Design

Threat: Malicious/vulnerable plugins

PAI Mitigation:

  • ✅ Skills = curated code (not third-party plugins)
  • ✅ MCP servers reviewed before use
  • ✅ DestructiveOpGuard (blocks dangerous operations)
  • ✅ Skill governance (CreateSkill validation)

LLM08: Excessive Agency

Threat: AI acts beyond intended scope

PAI Mitigation:

  • ✅ Principal approval gates (destructive ops blocked)
  • ✅ Permissions framework (settings.json explicit allows)
  • ✅ RBAC (org-rbac.example.yml role boundaries)
  • ✅ Human-in-loop for critical decisions

LLM09: Overreliance

Threat: Uncritical trust in AI output

PAI Mitigation:

  • ✅ Verification requirements (ISC = tool probe, not assertion)
  • ✅ Reality Checker (default verdict: NEEDS WORK)
  • ✅ Evidence-based culture (show your work)
  • ✅ Algorithm honesty rules (retrieve, don’t fabricate)

LLM10: Model Theft

Threat: Unauthorized model access/extraction

PAI Mitigation:

  • N/A (use provider-hosted models)
  • ✅ API key security (KeyRotation, secret management)
  • ✅ Access logs (who used which model when)

3. Zero Trust Architecture

Core Principles

1. Never Trust, Always Verify

Principle: Don’t assume trust based on network location

PAI Implementation:

  • ✅ Tailscale VPN (every connection authenticated)
  • ✅ API key verification (every external call)
  • ✅ Permission checks (every tool invocation)

2. Assume Breach

Principle: Design assuming attacker has foothold

PAI Implementation:

  • ✅ Defense in depth (multiple security layers)
  • ✅ Least privilege (minimize blast radius)
  • ✅ Monitoring (detect lateral movement)
  • ✅ Incident response ready (Problem Response Playbook)

3. Verify Explicitly

Principle: Use all available data for authentication

PAI Implementation:

  • ✅ Device identity (Tailscale)
  • ✅ Service identity (API keys)
  • ✅ User identity (Duane = principal)
  • ⚠️ Context-aware access (partial - no risk-based auth)

4. Least Privileged Access

Principle: Just-in-time, just-enough access

PAI Implementation:

  • ✅ Explicit permission grants (settings.json)
  • ✅ Role-based access (RBAC)
  • ✅ Time-limited overrides (security-pending.json once/session)
  • ⚠️ Just-in-time credentials (partial - no auto-rotation)

5. Micro-Segmentation

Principle: Segment resources to limit lateral movement

PAI Implementation:

  • ✅ Engine isolation (PNC/PNG/PNO/PNX/PNK separate)
  • ✅ Network segmentation (Tailscale subnets)
  • ⚠️ Process isolation (partial - same user, no containerization)
  • Remediation: Docker/systemd hardening (defer)

6. Continuous Monitoring

Principle: Log and analyze everything

PAI Implementation:

  • ✅ Problem Detection (4/5)
  • ✅ Security events logged (STATE.claude/)
  • ✅ Egress monitoring (pai-egress-monitor)
  • ⚠️ Real-time alerting (partial - dashboard polling)

Implementation Status Summary

StandardCoverageStatusGap
NIST CSF Identify85%✅ GoodAsset criticality matrix
NIST CSF Protect90%✅ GoodFile integrity monitoring
NIST CSF Detect85%✅ GoodAutomated alerting
NIST CSF Respond80%⚠️ PartialBC/DR documentation
NIST CSF Recover70%⚠️ PartialRecovery runbook, test restores
OWASP Top 10 AI80%✅ GoodDependency auditing, SBOM
Zero Trust75%⚠️ PartialProcess isolation, JIT creds

Overall Security Posture: ⚠️ STRONG with identified gaps for future improvement

Evidence Locations

Policies:

  • GOVERNANCE_FRAMEWORK.md - Security policies
  • PROBLEM_RESPONSE_PLAYBOOK.md - Incident response

Tools:

  • OutputSecretsScanner hook - Secret detection
  • DestructiveOpGuard hook - Operation blocking
  • SecurityValidator hook - Security enforcement
  • KeyRotation skill - Credential rotation
  • PAISecurityAudit skill - STRIDE threat modeling
  • SecurityTriage skill - Finding verification
  • InfoSecRiskAssessment skill - Vendor risk

Configuration:

  • settings.json - Permissions
  • org-rbac.example.yml - Role-based access
  • config/verifiable-identities.json - Identity management
  • security-pending.json - Override tracking

Logs:

  • STATE.claude/problem-metrics.jsonl - Security events
  • STATE.claude/itil-metrics.jsonl - Compliance metrics
  • systemd journal - Service logs

Remediation Roadmap

High Priority (Next Session):

  1. Automated critical alerting
  2. BC/DR documentation
  3. Quarterly restore testing

Medium Priority (This Quarter): 4. Asset criticality matrix 5. Dependency auditing integration 6. File integrity monitoring

Low Priority (Future): 7. Process isolation (containerization) 8. Just-in-time credential provisioning 9. Formal supplier risk assessments

Maintained By: PAI System
Review Cadence: Quarterly (align with security practice maturity assessment)
Last Updated: 2026-06-21
Version: 1.0

Graph View