The landscape page, regenerated against 0.12.1, and the test it never had

docs/OWASP-AGENTIC-TOP10.md

@@ -116,7 +116,7 @@ stated here rather than left implied:
 |---|---|---|---|
 | `ASI06:2026` | Memory & Context Poisoning | G6 and G1 constrain what an agent acting on a poisoned context can *do*: the action must still be named in the policy, so a belief an attacker planted cannot reach a tool the agent was never entitled to use, and an approval granted for one action cannot be spent on another. This is the same downstream constraint that makes `ASI01` partial, and it is here for the same reason. | CTRLRun never reads a model's memory, its context or its prompt, so it neither detects nor prevents the poisoning. And the shape poisoning most often takes is the one the kernel has least to say about: **corrupted arguments to an action the agent is entitled to take** — the right operation against the wrong record. Policy conditions, resource patterns and v0.6 data scope bite on part of that, and since v0.9 **G23 bites on the identifier itself**: where a deployment configures a scope provider, the kernel asks its system of record whether `customer:90210` is this principal's before reserving anything. That closes the sharpest version of this and not the category. The provider is the operator's own code reading the operator's own data, so a poisoned source answers wrongly with the kernel none the wiser, and a deployment that configures no provider is exactly where it was. |
 | `ASI01:2026` | Agent Goal Hijack | G1 and G6 constrain what a hijacked agent can *do*: it still meets the policy, and it still cannot present an approval granted for a different action. | CTRLRun does not detect or prevent the hijack. It never sees the prompt, the plan or the reasoning, so an agent whose goal was replaced proposes actions exactly as a healthy one would — and every action inside its policy and its grants will run. |
-| `ASI09:2026` | Human-Agent Trust Exploitation | G1 and G2 close the shape where an approval a human gave for one action is spent on another, or spent twice. | CTRLRun does not authenticate the *approver*, does not model separation of duties, and has no opinion on whether the human was misled into approving. A human persuaded to approve the right action for the wrong reason gets a valid approval, and the receipt records it as one. |
+| `ASI09:2026` | Human-Agent Trust Exploitation | G1 and G2 close the shape where an approval a human gave for one action is spent on another, or spent twice. Since 0.8.0, **where the deployment configures an approver identity**, the approver is a resolved principal rather than a string: G17 refuses an approval whose recorded entitlement does not cover the role the request pinned, G18 refuses the requester approving their own action, compared on the principal and never on the approver string, and G19 counts distinct principals, so one person cannot be several of an M-of-N. | **The three checks above are opt-in**: a deployment that configures no approver identity runs none of them, and its `approver` is the string it was before 0.8.0. The one case that is not left silent is a threshold above one, which is denied before a human is asked rather than counted against strings. And CTRLRun does not decide **who is entitled**: what entitled an approver was decided where the credential was verified, which is the operator MCP server or an embedding application; the kernel matches a recorded claim byte for byte, does not check that the role exists anywhere, and a cited control naming no role gates nobody. It has no opinion on whether the human was misled: a person persuaded to approve the right action for the wrong reason gives a valid approval, and the receipt records it as one. |
 
 ---
 
@@ -135,5 +135,5 @@ every report as `descends_from`.
 ---
 
 This document is regenerated when the guarantee catalogue changes, and when OWASP publishes a
-new edition. It was written against `ctrlrun.guarantees/v2` and the **2026** edition of the
+new edition. It was written against `ctrlrun.guarantees/v7` and the **2026** edition of the
 OWASP Top 10 for Agentic Applications.