# SPC-03 Adversarial assessment (Critical)

Domain: SPC Agent Specification & Pre-Deployment Assurance · HI-AAF v1.3 · Public review · https://humanintel.net/standard/spc/spc-03

An adversarial assessment (red team) is performed prior to initial deployment and after any material change. Minimum coverage: direct and indirect prompt injection, tool misuse, data exfiltration, role hijacking, jailbreak resistance, memory poisoning, and multi-agent escalation paths.

Red-team testing covers the full adversarial surface: direct and indirect prompt injection, tool misuse, data exfiltration paths, role hijacking, jailbreak resistance, memory poisoning (see INP-09), and where applicable, multi-agent escalation paths (see Domain 9). Findings are triaged, remediated or formally risk-accepted with executive sign-off, and the assessment is re-executed after material changes.

Critical control: a Critical failure precludes HI-AAF Certification regardless of the maturity level achieved on any other control.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for SPC-03: Red team assessment report exists for every production agent; findings have been triaged and dispositioned; the assessment has been re-executed within the documented cadence or after the most recent material change.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Red team assessment report exists for every production agent.
- Findings have been triaged and dispositioned.
- The assessment has been re-executed within the documented cadence or after the most recent material change.

## Framework mappings

- NIST AI RMF: MEASURE 2.7, MEASURE 2.8
- ISO/IEC 42001: A.6.2.5, 8.4
- OWASP LLM Top 10: LLM06, LLM10
- SOC 2 (TSC): CC7.1
- EU AI Act: Art. 9(6), Art. 15(4)
- MITRE ATLAS: Reconnaissance
- Singapore: MAIGF Testing & Assurance, AI Verify Security, AI Verify Robustness

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites INP-09 Memory and retrieval injection defense: https://humanintel.net/standard/inp/inp-09
- Cited by INP-09 Memory and retrieval injection defense: https://humanintel.net/standard/inp/inp-09
- Cited by MAS-04 Privilege escalation prevention: https://humanintel.net/standard/mas/mas-04

## Cite this control

Human Intelligence. HI-AAF v1.3, SPC-03 Adversarial assessment. Public review edition, July 2026. https://humanintel.net/standard/spc/spc-03