# Diagrams — Deep-Dive SDD-B01: OWASP Agentic AI Top 10 — Offensive Expansion

**Deep-Dive**: SDD-B01 — OWASP Agentic AI Top 10: Offensive Expansion
**Diagram count**: 5
**Tool**: Mermaid (primary). Each diagram validated in [Mermaid Live Editor](https://mermaid.live).

---

## Diagram 1 — The 10 Risks as Offensive Surface (attacker view, 5 boundary clusters)

**Type**: Cluster map
**Purpose**: The single orientation diagram. Shows the 10 ASI risks grouped by the five attack-surface boundaries, but annotated with the *attacker's* reading — the evasion each row produces. This is the offensive complement to B9's defense-cluster map.
**Reading the diagram**: Five clusters, ten risks. Each risk's annotation names the evasion the offensive expansion exploits, not the control B9 built. The footer is the thesis: B9 reads these as controls; SDD-B01 reads them as attack procedures.

```mermaid
flowchart TB
  subgraph INPUT["INPUT BOUNDARY — semantic, MEASURED residuals"]
    ASI01["ASI01 GOAL HIJACKING\nevasion: drift via trusted\ntool output; bypasses taint gate"]
    ASI02["ASI02 PROMPT LEAKAGE\nevasion: multi-turn rapport;\nparaphrased, canary-free disclosure"]
  end
  subgraph PERM["PERMISSION BOUNDARY — structural, class beneath vector"]
    ASI03["ASI03 EXCESSIVE AGENCY\nevasion: over-scoped credential\nthat survived minimization"]
    ASI10["ASI10 BROKEN ACCESS CONTROL\nevasion: inter-agent trust\nescalation; binding holds"]
  end
  subgraph STATE["STATE BOUNDARY — semantic + structural"]
    ASI04["ASI04 MEMORY POISONING\nevasion: taint-laundering via\nlegitimate trusted write tool"]
    ASI06["ASI06 CASCADING HALLUCINATION\nevasion: unverified-claim\npropagation; verifier misses it"]
  end
  subgraph TOOL["TOOL BOUNDARY — structural, class beneath vector"]
    ASI05["ASI05 TOOL/SKILL ABUSE\nevasion: semantic path confusion\nin the selection layer"]
    ASI08["ASI08 SUPPLY CHAIN\nevasion: signed-but-malicious;\nsignature verifies publisher not benignity"]
  end
  subgraph OUT["OUTPUT/RESOURCE BOUNDARY"]
    ASI07["ASI07 INSECURE OUTPUT HANDLING\nevasion: output-as-input to a\ndownstream agent; no NL escape"]
    ASI09["ASI09 RESOURCE EXHAUSTION\nevasion: under-threshold loop;\nper-call breaker never trips"]
  end

  THESIS["B9 reads these as CONTROLS (one test each).\nSDD-B01 reads them as ATTACK PROCEDURES (one evasion + chain each).\nThe gap between the two readings is the engagement."]

  OUT --> THESIS

  style INPUT fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style PERM fill:#14141f,stroke:rgba(240,168,104,0.5),color:#e4e4e8
  style STATE fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style TOOL fill:#14141f,stroke:rgba(240,168,104,0.5),color:#e4e4e8
  style OUT fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style ASI01 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style ASI02 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style ASI03 fill:#08080c,stroke:rgba(240,168,104,0.3),color:#f0a868
  style ASI10 fill:#08080c,stroke:rgba(240,168,104,0.3),color:#f0a868
  style ASI04 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style ASI06 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style ASI05 fill:#08080c,stroke:rgba(240,168,104,0.3),color:#f0a868
  style ASI08 fill:#08080c,stroke:rgba(240,168,104,0.3),color:#f0a868
  style ASI07 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style ASI09 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style THESIS fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
```

---

## Diagram 2 — The Evasion Pattern (test-verified direct surface vs attacker-arrived indirect surface)

**Type**: Two-track comparison with a gap
**Purpose**: The load-bearing diagram of the deep-dive. Shows why a control that PASSes its B9 test in isolation does not survive an adversary. The test verifies the *direct* surface; the attacker arrives on the *indirect* surface the test never exercised. The gap between them is the residual.
**Reading the diagram**: Top = the B9 test (taint gate verified on direct injection). Bottom = the offensive procedure (injection arrives on the trusted-tool-output channel the gate does not inspect). The annotation names the gap as the engagement's deliverable.

```mermaid
flowchart LR
  subgraph TEST["B9 PER-ROW TEST — verifies the DIRECT surface"]
    T1["Test input:\ndirect injection payload"]
    T2["Control:\ntaint gate tags + blocks"]
    T3["Result: PASS\n(direct vector closed)"]
    T1 --> T2 --> T3
  end
  subgraph OFFENSE["SDD-B01 PROCEDURE — arrives on the INDIRECT surface"]
    O1["Attacker input:\ninjection inside a\ntool output marked TRUSTED"]
    O2["Control:\ntaint gate does not\ninspect trusted outputs"]
    O3["Result: bypass\n(indirect class open)"]
    O1 --> O2 --> O3
  end

  GAP["THE GAP = the residual.\nB9 closed the vector the test names.\nThe attacker arrives on the class beneath.\nThis gap is what a B12 engagement characterizes."]

  TEST --> GAP
  OFFENSE --> GAP

  style TEST fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style OFFENSE fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style T1 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style T2 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style T3 fill:#08080c,stroke:rgba(130,224,170,0.4),color:#82e0aa
  style O1 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style O2 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style O3 fill:#08080c,stroke:rgba(240,128,128,0.4),color:#f08080
  style GAP fill:#08080c,stroke:#f0a868,stroke-width:1.5px,color:#f0a868
```

---

## Diagram 3 — The Three Cross-Row Chains (the compound is the finding)

**Type**: Three parallel chain flows
**Purpose**: The centerpiece offensive diagram. Shows the three recurring chains that turn individually-defensible row-findings into compound impact. Each link in each chain PASSes its B9 control; the chain is the finding.
**Reading the diagram**: Three horizontal chains. Each node is an ASI row; each arrow is the step that passes the row's control but advances the compound. The right-hand annotation names each chain's impact class.

```mermaid
flowchart LR
  subgraph C1["CHAIN 1 — the exfiltration chain"]
    direction LR
    C1A["ASI07\noutput-as-input"] --> C1B["ASI01\ngoal drift"]
    C1B --> C1C["ASI05\ntool dispatched"]
    C1C --> C1D["ASI03\nover-scoped cap exercised"]
  end
  subgraph C2["CHAIN 2 — persistence & propagation"]
    direction LR
    C2A["ASI02\ncapability disclosed"] --> C2B["ASI04\nmemory poisoned via trusted write"]
    C2B --> C2C["ASI06\npoisoned entry propagates as unverified fact"]
  end
  subgraph C3["CHAIN 3 — supply chain to escalation"]
    direction LR
    C3A["ASI08\nsigned-but-malicious MCP"] --> C3B["ASI05\ndispatch via description collision"]
    C3B --> C3C["ASI10\naction executes under orchestrator trust"]
  end

  IMPACT1["IMPACT:\ndata exfiltration /\nlateral movement"]
  IMPACT2["IMPACT:\npersistent backdoor\nsurvives session restart"]
  IMPACT3["IMPACT:\nprivileged action\nunder forged authority"]

  C1D --> IMPACT1
  C2C --> IMPACT2
  C3C --> IMPACT3

  NOTE["Every link PASSed its B9 control.\nThe COMPOUND is the finding —\ninvisible to any per-row test."]

  IMPACT2 --> NOTE

  style C1 fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style C2 fill:#14141f,stroke:rgba(240,168,104,0.5),color:#e4e4e8
  style C3 fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style C1A fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style C1B fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style C1C fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style C1D fill:#08080c,stroke:rgba(94,234,212,0.4),color:#5eead4
  style C2A fill:#08080c,stroke:rgba(240,168,104,0.3),color:#f0a868
  style C2B fill:#08080c,stroke:rgba(240,168,104,0.3),color:#f0a868
  style C2C fill:#08080c,stroke:rgba(240,168,104,0.4),color:#f0a868
  style C3A fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style C3B fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style C3C fill:#08080c,stroke:rgba(240,128,128,0.4),color:#f08080
  style IMPACT1 fill:#08080c,stroke:#f08080,stroke-width:1.5px,color:#f08080
  style IMPACT2 fill:#08080c,stroke:#f08080,stroke-width:1.5px,color:#f08080
  style IMPACT3 fill:#08080c,stroke:#f08080,stroke-width:1.5px,color:#f08080
  style NOTE fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
```

---

## Diagram 4 — MEASURED honesty vs PASS/FAIL illusion (every row has a residual)

**Type**: Annotated column comparison
**Purpose**: Resolves the misconception that the eight PASS/FAIL rows are fully closed. Shows that the two MEASURED rows are merely where the standard *admits* the residual — every row has one, and the offense team's opening is the residual the PASS/FAIL result cannot express.
**Reading the diagram**: Left column = the two MEASURED rows (admitted residual). Right column = the eight PASS/FAIL rows, each with the residual the deterministic test closed off but the class beneath remains open. The footer is the principle.

```mermaid
flowchart TB
  subgraph MEAS["2 MEASURED rows — the standard ADMITS the residual"]
    M1["ASI01 — detector + model compliance\nhave a bypass rate"]
    M2["ASI06 — hallucination detection\nhas a miss rate"]
  end
  subgraph PF["8 PASS/FAIL rows — closed at the VECTOR, open at the CLASS"]
    P1["ASI02 — canary match closes verbatim leak;\nparaphrased multi-turn disclosure open"]
    P2["ASI03 — enumeration closes extra tools;\nover-scoped credential open"]
    P3["ASI04 — managed writes close direct path;\ntaint-laundering via trusted sink open"]
    P4["ASI05 — normalization closes ../ ;\nselection-layer confusion open"]
    P5["ASI07 — sanitizer closes HTML/shell;\noutput-as-input to agent open"]
    P6["ASI08 — signature closes unsigned;\nsigned-but-malicious open"]
    P7["ASI09 — breaker closes over-threshold;\nunder-threshold loop open"]
    P8["ASI10 — binding closes forged principal;\ninter-agent trust assumption open"]
  end

  PRINCIPLE["Every row has a residual.\nThe 2 MEASURED rows are where the standard admits it.\nThe 8 PASS/FAIL rows are where it does not —\nand that silence is the offense team's first opening."]

  MEAS --> PRINCIPLE
  PF --> PRINCIPLE

  style MEAS fill:#14141f,stroke:rgba(94,234,212,0.6),color:#e4e4e8
  style PF fill:#14141f,stroke:rgba(240,168,104,0.6),color:#e4e4e8
  style M1 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style M2 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style P1 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P2 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P3 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P4 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P5 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P6 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P7 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style P8 fill:#08080c,stroke:rgba(240,168,104,0.25),color:#f0a868
  style PRINCIPLE fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
```

---

## Diagram 5 — The B9-then-SDD-B01 Reading Order (test vs adversary)

**Type**: Two-phase pipeline
**Purpose**: Shows how the two artifacts compose in an engagement. B9 verifies the controls are present and passing (per-row, isolated). SDD-B01 runs the offensive procedures against a system that PASSed B9 and finds the residuals the deterministic tests cannot express. The gap is the B12 deliverable.
**Reading the diagram**: Left phase = B9 (builder, per-row test, scored report). Right phase = SDD-B01 (attacker, per-row procedure + cross-row chain, reproduced finding). The arrow between them is the load-bearing transition: a system that PASSed the left and FAILed the right is not a contradiction.

```mermaid
flowchart LR
  subgraph B9["PHASE 1 — B9 (read as BUILDER)"]
    B1["Per-row test\n(one risk, one control)"]
    B2["Isolated execution\n(each row tested alone)"]
    B3["Scored report\n8 PASS/FAIL + 2 MEASURED"]
    B1 --> B2 --> B3
  end
  subgraph SDD["PHASE 2 — SDD-B01 (read as ATTACKER)"]
    S1["Per-row offensive procedure\n(attack + evasion + chain)"]
    S2["Chained execution\n(rows composed into compounds)"]
    S3["Reproduced findings\nresiduals the test cannot express"]
    S1 --> S2 --> S3
  end

  TRANSITION["THE TRANSITION:\na row that PASSed B9 and FAILed\nthe offensive expansion is NOT a contradiction —\nit is the definition of a residual the\ndeterministic test cannot express."]

  B9 --> TRANSITION --> SDD

  DELIVERABLE["B12 packages BOTH:\nthe scored report (B9) + the chains (SDD-B01).\nNeither alone is sufficient."]

  SDD --> DELIVERABLE

  style B9 fill:#14141f,stroke:rgba(94,234,212,0.5),color:#e4e4e8
  style SDD fill:#14141f,stroke:rgba(240,128,128,0.5),color:#e4e4e8
  style B1 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style B2 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style B3 fill:#08080c,stroke:rgba(94,234,212,0.3),color:#5eead4
  style S1 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style S2 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style S3 fill:#08080c,stroke:rgba(240,128,128,0.3),color:#f08080
  style TRANSITION fill:#08080c,stroke:#f0a868,stroke-width:1.5px,color:#f0a868
  style DELIVERABLE fill:#08080c,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
```

---

## Validation notes

- All five diagrams use the course design system colors: `#14141f` panel fill, `#08080c` deep background for nested nodes, `#5eead4` teal accent for input/state surfaces and principle nodes, `#f0a868` warn for the permission/tool surfaces and the gap/transitions, `#f08080` danger for the output/resource surfaces and impact nodes. `#e4e4e8` / `#9494a0` for text.
- Paste each into [Mermaid Live Editor](https://mermaid.live) to render. All use stable Mermaid syntax (`flowchart TB/LR`, `subgraph`) supported in current Mermaid (v10.4+).
- For the slide deck (artifact 03), these are rendered as static captures from Mermaid Live, inlined into reveal.js.
- The teal/warn/danger color coding is consistent across diagrams: teal = the input/state semantic surface and the thesis/principle nodes; warn (orange) = the permission/tool structural surface and the gap/transitions; danger (red) = the output/resource surface and impact. This mapping is load-bearing — it lets the reader track which boundary a node belongs to across all five diagrams.