{"graph":{"schemaVersion":"guard-evidence-graph/v1","reviewedAt":"2026-08-08T00:00:00.000Z","nodes":[{"id":"threat:prompt-injection","kind":"threat","title":"Prompt injection","summary":"Untrusted instructions attempt to redirect an agent away from the user or operator intent.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"/guard/security/prompt-injection"},{"id":"campaign:modeled-untrusted-instruction-chain","kind":"campaign","title":"Modeled untrusted-instruction attack chain","summary":"A teaching model showing how untrusted repository content can influence an agent before a sensitive action.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"/guard/security/prompt-injection","modeled":true},{"id":"artifact:untrusted-repository-instruction","kind":"artifact","title":"Untrusted repository instruction","summary":"Repository-controlled text that should be treated as data rather than trusted operator policy.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z"},{"id":"harness:claude-code","kind":"harness","title":"Claude Code","summary":"Coding-agent harness represented in the Guard harness guide set.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"/guard/harnesses/claude-code"},{"id":"surface:tool-execution","kind":"surface","title":"Tool execution boundary","summary":"The point where an agent converts model output into a tool or command action.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"/guard/security/prompt-injection"},{"id":"policy:approval-required-sensitive-actions","kind":"policy","title":"Approval-required sensitive actions","summary":"A policy pattern that routes sensitive actions to explicit review instead of unconditional execution.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z"},{"id":"benchmark:ai-coding-agent-runtime-security","kind":"benchmark","title":"AI coding-agent runtime security fixture benchmark","summary":"The published deterministic fixture benchmark; modeled outputs are not live attack-resistance measurements.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"/guard/research/ai-coding-agent-runtime-security-benchmark"},{"id":"control:pre-tool-request-evaluation","kind":"control","title":"Pre-tool request evaluation","summary":"Evaluate a proposed action before it reaches the execution boundary and require review when policy demands it.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"/guard/features"},{"id":"source:hol-guard-claude-daemon-bridge-tests","kind":"source","title":"HOL Guard Claude daemon bridge test contract","summary":"Reviewed release/3.0 test source used by source-bound public evidence records.","visibility":"public","reviewedAt":"2026-08-08T00:00:00.000Z","href":"https://github.com/hashgraph-online/hol-guard/blob/8c83a4d757cd37c97f72993945f02d90ca91dfcf/tests/test_claude_daemon_hook_bridge.py","sourceRefs":["https://github.com/hashgraph-online/hol-guard/commit/8c83a4d757cd37c97f72993945f02d90ca91dfcf"]}],"relations":[{"id":"rel:campaign-uses-artifact","kind":"uses","from":"campaign:modeled-untrusted-instruction-chain","to":"artifact:untrusted-repository-instruction","visibility":"public","summary":"The modeled chain begins with an untrusted repository-controlled instruction artifact."},{"id":"rel:artifact-precedes-threat","kind":"precedes","from":"artifact:untrusted-repository-instruction","to":"threat:prompt-injection","visibility":"public","summary":"The untrusted instruction becomes a prompt-injection threat when it influences agent reasoning."},{"id":"rel:threat-precedes-surface","kind":"precedes","from":"threat:prompt-injection","to":"surface:tool-execution","visibility":"public","summary":"A successful injection can influence the action proposed at a tool-execution boundary."},{"id":"rel:campaign-targets-harness","kind":"targets","from":"campaign:modeled-untrusted-instruction-chain","to":"harness:claude-code","visibility":"public","summary":"The modeled example uses a coding-agent harness as the execution context."},{"id":"rel:threat-affects-surface","kind":"affects","from":"threat:prompt-injection","to":"surface:tool-execution","visibility":"public","summary":"Prompt injection matters when untrusted instructions can influence a consequential action boundary."},{"id":"rel:threat-mitigated-control","kind":"mitigated_by","from":"threat:prompt-injection","to":"control:pre-tool-request-evaluation","visibility":"public","summary":"Pre-tool evaluation can block or route an unsafe proposed action for review; it does not make prompt injection impossible."},{"id":"rel:surface-mitigated-control","kind":"mitigated_by","from":"surface:tool-execution","to":"control:pre-tool-request-evaluation","visibility":"public","summary":"The control is placed before the execution boundary so a policy decision can happen before the action."},{"id":"rel:control-configured-policy","kind":"configured_by","from":"control:pre-tool-request-evaluation","to":"policy:approval-required-sensitive-actions","visibility":"public","summary":"The policy pattern requires explicit review for actions classified as sensitive."},{"id":"rel:threat-measured-benchmark","kind":"measured_by","from":"threat:prompt-injection","to":"benchmark:ai-coding-agent-runtime-security","visibility":"public","summary":"The fixture benchmark includes modeled prompt-injection scenarios and must not be read as live efficacy evidence."},{"id":"rel:control-supported-source","kind":"supported_by","from":"control:pre-tool-request-evaluation","to":"source:hol-guard-claude-daemon-bridge-tests","visibility":"public","summary":"Source-bound evidence points to reviewed integration-test contracts for the pre-tool bridge boundary."}]},"integrity":{"ok":true,"nodeCount":9,"relationCount":10}}