Appendix A: Code Examples: Detection, Evaluation and Guardrail Artefacts

This appendix collects fuller versions of artefacts that the chapters introduce. Each example is identified as NN_CODE_XXX, where NN is the introducing chapter, and grouped by NIST CSF 2.0 Function. In keeping with the book's rules it contains only defensive artefacts and no exploit code, payloads, attack prompts or other attack tooling. All identifiers refer to the fictional organisations Nordvik Region and Hansa Mutual and are illustrative, and every YAML listing parses as written.

Index of examples

Identifier	Chapter	Artefact
03_CODE_PROFILE	3	CSF profile as code with an AI focus
06_CODE_AUTONOMY	6	Autonomy-level decision for a security AI capability
07_CODE_ROE	7	Rules-of-engagement manifest
18_CODE_PERMISSIONS	18	Permission manifest for a SOC investigation agent
25_CODE_CHAOSEXP	25	Security chaos experiment manifest
25_CODE_CHAOSPOLICY	25	Safety-boundary policy for a security chaos engineering platform
26_CODE_FINDING	26	Finding record carried to verified closure

Foundations

03_CODE_PROFILE: CSF profile as code with an AI focus

Chapter 3 keeps the CSF profile in version control. In Hansa Mutual's excerpt below, a Category records current and target maturity, targets for the three AI focus areas, the implementing controls and the European obligations the same evidence serves, so that one control is assured once and reported often.

kind: CsfProfile
id: HM-CSF-2027
aiProfile: NIST-IR-8596-iprd    # Cyber AI Profile, initial preliminary draft
owner: group-ciso
categories:
  - id: DE.AE
    current: repeatable
    target: measured
    focus:
      secure: {target: defined, outcome: agent telemetry analysed for attacks on AI systems}
      defend: {target: measured, outcome: AI-assisted triage with verified quality, capability: HM-SEC-001}
      thwart: {target: measured, outcome: detections for AI-accelerated intrusion tested quarterly}
    controls: [CTRL-SOC-004, CTRL-SOC-011, CTRL-AGT-002]
    obligations:
      - {instrument: DORA, article: "10"}
      - {instrument: NIS2, article: "21(2)(b)"}

Govern

06_CODE_AUTONOMY: Autonomy-level decision for a security AI capability

Chapter 6 assigns an autonomy level per action. Hansa Mutual's record below lets its SOC investigation agent execute two reversible containment actions at Level 3 Bounded, while other actions stay at Level 2 Supervised.

kind: AutonomyDecision
id: AIDR-0311
capability: HM-SEC-001
usageMode: 5
decidedBy: group-ai-governance-board
defaultLevel: 2
levels:
  - {action: isolate-managed-workstation, level: 3, reversible: true, maxPerHour: 20}
  - {action: revoke-user-session, level: 3, reversible: true, maxPerHour: 50}
  - {action: disable-user-account, level: 2}
  - {action: delete-or-modify-data, level: 0, reason: irreversible}
oversight: {stopPath: soc-console-and-out-of-band, reviewSample: 10%}   # of level-3 actions
review: {trigger: [model-version-change, incident, quarterly], revertTo: 2}
worksCouncilConsultation: {DE: completed, NL: completed, SE: completed}

07_CODE_ROE: Rules-of-engagement manifest

Chapter 7 treats rules of engagement as a signed, versioned artefact. Nordvik Region's manifest names permitted ATT&CK tactics rather than procedures, and its stop-path holders include the MSSP's out-of-hours shift lead.

kind: RulesOfEngagement
id: RoE-NR-2027-001
approvedBy: [chief-information-security-officer, head-of-benefits-unit]
window: {start: 2027-03-08, end: 2027-04-02, blackout: [month-end-benefit-payment-run]}
blueTeam: nordvik-security-analysts-and-mssp   # not informed of timing
scope:
  inScope: [citizen-service-assistant, benefits-explanations-service, staff-identity-provider-test-tenant]
  outOfScope: [benefits-triage-production-scoring, third-party-systems]   # high-risk system: test only
  permittedTactics: [reconnaissance, initial-access, credential-access, discovery, lateral-movement]
  prohibitedTactics: [impact]
aiParticipation:
  permitted: true
  maxAutonomyLevel: 2                 # each AI-proposed action approved by the test lead
  models: [self-hosted-open-weight]   # no external model receives Nordvik data
  logging: full-transcript-to-white-team
dataProtection: {legalBasis: gdpr-art-6-1-e-public-task, classification: exempt-from-disclosure}
stopConditions: [unplanned-service-degradation, access-to-real-personal-data, ai-action-outside-approved-plan]
stopPath: {holders: [ciso, contracted-test-lead, mssp-shift-lead], channel: out-of-band-phone-bridge}
evidence: {required: [activity-log, ai-transcripts, findings-register], findingsTo: purple-session-2027-q2}

Detect

18_CODE_PERMISSIONS: Permission manifest for a SOC investigation agent

Chapter 18 gives the SOC investigation agent the tools it needs and nothing else, following the containment baseline of AI Platform and Security, Chapter 19.

kind: PermissionManifest
id: HM-SEC-001-permissions
agent: soc-investigation-agent
usageMode: 5
identity:
  workloadIdentity: spiffe://hansa.example/soc/investigation-agent
  credentialLifetimeMinutes: 15
tools:
  read:
    - siem.search
    - edr.get-process-tree
    - identity.get-sign-in-history
  act:
    - {name: edr.isolate-host, autonomyLevel: 3, decisionRecord: AIDR-0311}
    - {name: identity.revoke-sessions, autonomyLevel: 3, decisionRecord: AIDR-0311}
  denied: [identity.change-role, edr.run-script, mail.send-external]
egress:
  default: deny
  allow: [siem.internal, edr.internal, ti.internal]
budgets: {toolCallsPerCase: 200}
stopPath:
  holders: [soc-shift-lead, group-ciso, incident-commander]
  mechanism: gateway-revocation   # outside the agent runtime
logging: {transcript: evidence-store}

Verification and improvement

25_CODE_CHAOSEXP: Security chaos experiment manifest

This Chapter 25 catalogue entry injects a condition, not an attacker technique, to verify that the SOC notices a silent log source.

# Illustrative: catalogue entry for a Detect experiment
kind: ChaosExperiment
id: SCE-DE-014
title: Silent log source is noticed by the SOC
csf: [DE.CM]
owner: detection-engineering
hypothesis:
  condition: log forwarding from one host in scope stops
  expected: alert "log source silent" in SOC queue
  withinMinutes: 30
injection:
  actuator: log-forwarder-pause
  targetSelector: {tier: [test, production], role: [app-server]}
rollback: {action: resume-forwarder, verify: events-received-again, automatic: true}
blastRadius:
  maxTargets: 1
  excludedRoles: [domain-controller, identity-provider]
autonomy: {test: 3, production: 3}     # promoted after 20 safe runs in test
evidence: {controlIds: [CTRL-SOC-021]}
onFailure: {createFinding: true, route: purple-backlog}

25_CODE_CHAOSPOLICY: Safety-boundary policy for a security chaos engineering platform

The chaos platform's policy decision point evaluates every AI planner proposal against this policy, which separates planning from execution and bounds blast radius, data access, timing and autonomy.

# Illustrative: Hansa Mutual, safety boundaries for HM-SEC-006
kind: ChaosSafetyPolicy
id: HM-SEC-006-boundaries
approvedBy: group-ciso
rulesOfEngagement: RoE-HM-2027-SCE      # standing rules of engagement
catalogue: {onlyReviewedEntries: true, aiMayGenerateNewInjections: false}
separation:
  plannerHasEstateCredentials: false
  actuatorCredentials: just-in-time-per-experiment
environments:
  test:            {maxAutonomyLevel: 3, maxShareOfTargets: 0.20}
  production:
    maxAutonomyLevel: 3          # only types with 20 safe runs in test
    newTypesAutonomyLevel: 2
    maxShareOfTargets: 0.01
    maxDurationMinutes: 30
    destructive: forbidden
data: {syntheticAccountsOnly: true, readRealPersonalData: false}
schedule:
  windows: ["Mon-Thu 08:00-16:00 local"]
  blackouts: [month-end-claims-run, open-major-incident]
abort:
  independentOfPlanner: true
  guardMetrics: [service-health, claims-throughput, error-rate]
stopPath: {mechanism: out-of-band-credential-revocation, testedBy: SCE-GV-006}
ledger: {tamperEvident: true, sealedFromSocMinutes: 60}

26_CODE_FINDING: Finding record carried to verified closure

Chapter 26 requires every finding to end as a verified control. This Nordvik Region record describes the weakness by technique and control, not by procedure.

kind: FindingRecord
id: FND-NR-2027-007
source: RoE-NR-2027-001
title: Session tokens for the staff test tenant accepted after password reset
attack:
  tactic: lateral-movement
  technique: T1550            # use alternate authentication material
severity: high
detectedByBlueTeam: false
control: {change: revoke-all-sessions-on-credential-reset, ticket: CHG-2027-0412}
detection: {rule: detections/identity/session-reuse-after-reset.yml, format: sigma}
retest: {scenario: RT-NR-007, date: 2027-05-03, result: prevented-and-detected}
evidence:
  - evidence/purple/FND-NR-2027-007/retest-log.json
  - evidence/purple/FND-NR-2027-007/detection-test.json
status: closed-verified
closedBy: purple-session-2027-q2