# SPC-08 Known-unsafe inputs catalog

Domain: SPC Agent Specification & Pre-Deployment Assurance · HI-AAF v1.3 · Public review · https://humanintel.net/standard/spc/spc-08

A known-unsafe inputs catalog is maintained organization-wide and tested against each agent prior to deployment.

The organization maintains a catalog of known-unsafe inputs, jailbreak prompts, injection patterns, adversarial payloads, that is tested against every agent before deployment. The catalog is updated as new attack patterns emerge and is shared across the organization to prevent duplication of effort.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for SPC-08: Catalog exists and is maintained; the catalog has been tested against all production agents within the documented cadence; new entries are added as attack patterns are discovered or reported.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Catalog exists and is maintained.
- The catalog has been tested against all production agents within the documented cadence.
- New entries are added as attack patterns are discovered or reported.

## Framework mappings

- NIST AI RMF: MEASURE 2.7
- ISO/IEC 42001: 8.4
- OWASP LLM Top 10: LLM06, LLM10
- SOC 2 (TSC): CC7.1
- EU AI Act: Art. 15(4)
- MITRE ATLAS: Reconnaissance
- Singapore: MAIGF Testing & Assurance, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by INP-01 Direct prompt injection detection: https://humanintel.net/standard/inp/inp-01

## Cite this control

Human Intelligence. HI-AAF v1.3, SPC-08 Known-unsafe inputs catalog. Public review edition, July 2026. https://humanintel.net/standard/spc/spc-08