Frameworks & Standards
MITRE ATLAS
MITRE ATLAS is a living knowledge base of adversary tactics and techniques against AI-enabled systems. It complements MITRE ATT&CK and covers predictive, generative, and agentic AI, including attacks on models, prompts, retrieval context, data, tools, agents, and their surrounding enterprise systems.
Buyer question
"Can Legra reduce, detect, and evidence attacks against the knowledge, context, tools, and actions used by AI agents?"
Legra fit
| ATLAS concern | Legra fit | Status |
|---|---|---|
| Training-data and model attacks | Legra can govern datasets, versions, lineage, and validation evidence, but model training, weights, evaluation, serving, and model-specific defenses require separate tools and controls. | Partial fit |
| Retrieval and context poisoning | Signed commits, source provenance, validation, branch review, and pinned workspace state make changes to retrieved graph context attributable and reviewable. | Native fit |
| Prompt injection and prompt infiltration | Persona-bound Stories and narrowly exposed operations reduce reachable authority, but prompt handling and model behavior still require application- and model-level defenses. | Partial fit |
| Agent tool invocation | Story-defined operations, scoped tools, workspace permissions and human review constrain what an agent can invoke and promote. | Native fit |
| Agent tool or configuration poisoning | Versioned definitions, signed changes, validation gates, and branch review protect governed tools and agent configuration stored in Legra. External tools and packages require their own supply-chain controls. | Partial fit |
| Detection and investigation | Tasks, activity events, commits, provenance, and graph queries provide evidence for reconstructing agent activity. Threat detection rules and security operations remain deployment-specific. | Partial fit |
| Enterprise compromise | Endpoint, network, identity-provider, cloud, host, and incident-response controls remain necessary; ATLAS explicitly includes the surrounding enterprise attack surface. | External responsibility |
What Legra can say
Legra applies a least-authority model to agentic work:
- A production agent is bound to an intended persona and Use Case Tree.
- Its executable surface can be limited to approved Stories rather than raw infrastructure access.
- Its knowledge and writes are scoped to controlled workspaces and branches.
- Proposed changes can be validated and reviewed before merge.
- Tasks, events, commits, and provenance retain evidence across the action tree.
These controls reduce the consequence of a manipulated agent even when the model itself behaves incorrectly.
Assessment boundary
ATLAS is a threat knowledge base, not a product certification. Legra covers the governed knowledge and execution boundary around an AI system; it does not replace model security, prompt filtering, endpoint protection, cloud security, software supply-chain controls, red teaming, detection engineering, or incident response.
An ATLAS assessment should map threats to the complete deployed AI system and attribute each mitigation to its actual owner.