# AI SDLC Security and Compliance - Threats and Frameworks > The AI SDLC threat model, data classification tiers, and how SOC 2, HIPAA, ISO 27001, NIST, and the EU AI Act map to it. Source: https://aidlc.guru/security-and-compliance/ --- Security # AI SDLC Security, Privacy and Compliance AI coding tools add new attack surface on top of everything a software supply chain already had - prompt injection, excessive agency, and unbounded consumption chief among them. Data classification decides what can reach an IDE assistant, a chat window, a CI agent, or an MCP connector, and every major framework from SOC 2 to the EU AI Act already has a clause that maps to those controls. This page is the threat model, the data tiers, and the framework-by-framework answer key. Last reviewed: October 2026 ![A layered shield protecting a data vault, with locks and checklist tiles around it](https://aidlc.guru/images/pages/security-and-compliance.png) ## The Audit Finding Waiting to Happen An AI coding agent is not only a code-quality problem waiting to surface in review. It is an IP and PHI exposure risk waiting to surface at audit time. It reads the repository, calls external services, and can paste proprietary code or customer data into a vendor's servers, often through a chat window or CLI that a compliance team has never inventoried. The gap between what the agent can see and what the audit assumes it can see is where a finding starts. None of this requires a different security program. It requires applying the data classification, access review, and change management that SOC 2, HIPAA, and ISO 27001 already ask for to a class of tool that did not exist when most of those policies were written. Read the threat model and the framework mapping below together: know what can go wrong, then know which standard already asks you to have a control for it. ## Threat Model Threat Vector OWASP reference Control Prompt injection Issue text, PR comments, README files, dependency docs, fetched web pages, MCP server responses LLM01, ASI01 Treat all retrieved content as data, never instructions; agents never act on embedded instructions; human approval for anything outside task scope Sensitive data disclosure Secrets, PII, PHI, or customer data in prompts, context, fixtures, or an agent's working tree LLM02 Data classification enforced at the input side; secret scanning on context; synthetic fixtures only; vendor retention and training terms in writing Supply chain Hallucinated packages, typosquats, malicious MCP servers, unpinned model versions LLM03, ASI04 Lockfile mode; registry allow list; new-dependency review gate; MCP servers reviewed like dependencies; model pinning Excessive agency An agent with write access to protected branches, deploy rights, production credentials, or an unrestricted shell LLM06, ASI02, ASI03 Least privilege in harness config; branch namespace; tool deny list; no self-approve Unexpected code execution Agent runs generated code or scripts in a privileged environment ASI05 Ephemeral sandbox; egress allow list; no production credentials Memory and context poisoning Corrupted instruction files, skills, or retrieval sources change agent behavior persistently ASI06 Instruction files and skills reviewed as code; CODEOWNERS on them; eval suite runs on every change Insecure output handling Generated code with XSS, injection, or weak crypto merged because it looked fine LLM05 SAST in the pipeline; review rules for the classes AI gets wrong most; mutation-scored tests Unbounded consumption Runaway agent loops, retry storms LLM10 Per-workflow budgets, attempt limits, hard caps Human-agent trust exploitation Reviewers rubber-stamp a change because the agent's summary sounded confident ASI09 AI comments labeled; tiered review; rework and no-comment-merge metrics tracked ### Which OWASP Edition The LLM01 to LLM10 codes above come from [OWASP's Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/); the ASI01 to ASI10 codes come from the [Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), published 12-09-2025. OWASP released a 2026 edition of the LLM Top 10 in 08-2026 and an Agent Control Standard v0.1 on 09-01-2026; re-verify the mapping before citing that later edition. The [Secure Coding with AI cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html) is the practical companion. ### MCP-Specific Risk The [MCP specification's 2026-07-28 revision](https://modelcontextprotocol.io/specification/2026-07-28/basic/security_best_practices) made the protocol core stateless and added security best practices covering confused deputy attacks, token passthrough (a server must never forward a client's token upstream), server-side request forgery through metadata endpoints, and localhost redirect impersonation. The reference filesystem and git servers, and the mcp-remote bridge, have all carried CVEs since mid-2025 - review every MCP server like an unreviewed dependency. ### CISA's Guidance CISA's "Careful Adoption of Agentic AI Services" (05-2026) is the government-issued version of the same advice: inventory every agent, apply least privilege, log everything, and require human approval before a consequential action executes. ## Data Classification Mapped to AI Surfaces Tier IDE assistant Chat Agent in CI MCP or connector Public Yes Yes Yes Yes Internal Company-managed account, training opt-out Same Yes, logged Approved connectors only Confidential Company-managed, opt-out, no consumer tools Same, no pasting into consumer tools Yes, with audit log Approved, read-only unless reviewed Restricted (PII, PHI, secrets, customer data) Never in prompt or context Never Never; synthetic fixtures only Never ![Four data tiers: Public (any AI surface), Internal (approved, logged), Confidential (managed accounts only), Restricted (never reaches AI).](https://aidlc.guru/images/figures/security-and-compliance-data-tiers.png) ## Framework Mapping ### SOC 2 (change management, logical access) **What it asks:** changes authorized, tested, and approved by someone other than the author, with access kept least-privilege and reviewed. **How this answers it:** a named human approver on every production merge; an agent identity with scoped access instead of a personal token; an evidence pack per release; no self-approve. ### HIPAA **What it asks:** PHI never leaves the covered boundary without a signed Business Associate Agreement; access is logged; only the minimum necessary data is used. **How this answers it:** the Restricted tier keeps PHI out of every prompt; any vendor whose service could see PHI needs a BAA in writing; the audit log export comes from whichever vendor tier actually provides one. ### ISO/IEC 27001:2022 **What it asks:** a secure development lifecycle (clauses A.8.25 to A.8.31), supplier security, and logging. **How this answers it:** the written policy, review standards, vendor evaluation checklist, and agent audit trail map directly to those clauses. ### ISO/IEC [42001:2023](https://www.iso.org/standard/42001) **What it asks:** an AI management system covering risk assessment, impact assessment, lifecycle controls, transparency, and human oversight. **How this answers it:** this playbook covers most of the AI management system for the engineering function; the [maturity model](https://aidlc.guru/maturity-model/) and its self-assessment map to the standard's clauses. ### [NIST AI RMF 1.0](https://www.nist.gov/itl/ai-risk-management-framework) and Generative AI Profile (AI 600-1) **What it asks:** four functions - Govern, Map, Measure, Manage - plus generative-AI-specific risks including confabulation, information security, and IP exposure. The core RMF is under revision with no draft published as of 10-2026; a companion Cyber AI Profile (IR 8596) is in preliminary draft, and NIST launched an AI Agent Standards Initiative in 02-2026. **How this answers it:** the governance pillars cover Govern, the threat model above covers Map, the measurement stack covers Measure, and agent controls cover Manage. ### [NIST SP 800-218A](https://csrc.nist.gov/pubs/sp/800/218/a/final) **What it asks:** secure development practices for when AI models are themselves part of the development process (the July 2024 SSDF profile for generative AI). **How this answers it:** the engineering-practices and provenance controls in this playbook implement its practices directly. ### EU AI Act **What it asks:** AI literacy training (Article 4, since 02-2025); general-purpose AI provider obligations (since 08-02-2025, with Commission enforcement since 08-02-2026); Article 50 transparency duties (since 08-02-2026). The [Digital Omnibus Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng), in force since 07-27-2026, moved the Annex III high-risk obligations to a fixed date of 12-02-2027 and the Annex I product-embedded obligations to 08-02-2028. See the [implementation timeline](https://artificialintelligenceact.eu/implementation-timeline/) for the full schedule. **How this answers it:** staff get a training record for Article 4; coding assistants are not high-risk on their face under the Commission's draft classification guidelines, but a product built with them that makes consequential decisions about people inherits this playbook's evidence pack as technical documentation, with until 12-2027 to assemble it. ### SOC 2 (AI specifics) **What it asks:** no authoritative AICPA guidance names AI-authored code as of 10-2026, and the Trust Services Criteria are unchanged. A nonauthoritative Technical Q&A, TQA 9561, dated 09-10-2026, addresses a service organization's use of AI in SOC examinations. Practitioner consensus routes AI-authored changes through the same CC8.1 path as any change, with the AI tool inventory sitting under CC9.2 vendor management. **How this answers it:** the ticket, human review, test evidence, approval, rollback, and deploy log already required elsewhere in this playbook satisfy CC8.1; expect auditors to ask for the AI tool inventory and proof that an agent cannot approve its own change. ### HIPAA (vendor specifics) **What it asks:** coverage is per product, not per vendor. [Anthropic's BAA](https://support.claude.com/en/articles/15455031-covered-models-under-a-business-associate-agreement-baa) covers chat on HIPAA-ready Enterprise plans and the API in a HIPAA-ready configuration; as of 10-2026 its own documentation also covers Claude Code and Cowork in local mode on a HIPAA-ready Enterprise plan, once the primary owner accepts the BAA and applies the HIPAA configuration to those products. Claude Code with zero data retention stays covered but cannot reach a covered model, because covered models require 30-day retention; Cowork without that configuration, and Cowork in the cloud, are not covered. OpenAI's BAA covers the API and ChatGPT Enterprise. [GitHub does not sign BAAs](https://ghec.github.trust.page/faq), so Copilot is never HIPAA-eligible. Google's Cloud BAA covers Gemini Code Assist, Gemini Enterprise and Antigravity in Gemini Enterprise, per [Google's HIPAA supported-services list](https://docs.cloud.google.com/docs/security/compliance/hipaa), but its certifications do not extend to Gemini Code Assist on GitHub. AWS covers Bedrock and Kiro, but not Kiro Web. **How this answers it:** if PHI could reach a tool, only a BAA-covered product may touch it, and the Restricted tier rule - never in a prompt - is what keeps the rest of the toolchain out of scope. See [OpenAI's HIPAA-eligible products list](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality) for the current scope. ### US state AI laws **What it asks:** Colorado's SB 24-205 never took effect as written - stayed by a federal court in April 2026, then repealed and re-enacted as [SB 26-189](https://leg.colorado.gov/bills/sb26-189) (signed 05-14-2026), an automated-decision notice and documentation law effective 01-01-2027. Also in force: California SB 53 (frontier model transparency) and CPPA automated decision-making rules (compliance by 01-01-2027), Texas TRAIGA, and Illinois HB 3773 (AI in employment decisions). New York's RAISE Act takes effect 01-01-2027. Federal EO 14365 set up a preemption push, but no federal preemption law had passed as of 10-2026. **How this answers it:** these laws target products that make consequential decisions about people, not coding tools themselves. If your product does, the ticket contract's rule ID and the release evidence pack (see [Templates](https://aidlc.guru/templates/)) are the documentation these laws ask for. Track by state - the map shifts quarterly. ### [SLSA](https://slsa.dev/) and Sigstore **What it asks:** build provenance and signed attestations. SLSA v1.2 (11-2025) finalized the Source track; Source L4 requires two-party review, which an agent cannot satisfy alone. No SLSA track or in-toto predicate exists yet for AI-generated code specifically. **How this answers it:** add the agent identity to the attestation for agent-opened PRs; npm trusted publishing over OIDC, with classic tokens revoked November 2025, removes long-lived publish tokens from agent reach. ## IP, Licensing and Copyright The frameworks above cover security and privacy. The legal questions engineering leaders tend to ask first are about ownership and licensing, and none of them is settled by an engineering control alone. Nothing here is legal advice: it is the public record as of 10-2026, the engineering habit each fact suggests, and the questions to take to counsel. ### Who owns agent-written code The [U.S. Copyright Office](https://www.copyright.gov/ai/) concluded in its January 2025 report on copyrightability that AI-generated material is protected only to the extent a human author contributed expressive elements: prompts alone are not enough, while human-authored input, creative selection and arrangement, and human modifications of the output can be, assessed case by case. The D.C. Circuit held in Thaler v. Perlmutter (03-18-2025) that only humans can be authors under the Copyright Act, and the Supreme Court declined to review it on 03-02-2026. **Engineering habit:** keep the record of human contribution - approved plans, review comments, edits - which this playbook already requires for other reasons. ### License contamination An agent can reproduce code that exists elsewhere under a license your project cannot accept. [GitHub Copilot's code referencing](https://docs.github.com/en/copilot/how-tos/get-code-suggestions/find-matching-code) flags suggestions that match public GitHub code and shows the matching file's URL and license, when the setting that allows public-code matches is on. In the Copilot class action, Doe v. GitHub, the Ninth Circuit affirmed dismissal of the claim that Copilot's output removed copyright management information on 09-16-2026, and did not rule on the training-data theory ([Gibson Dunn summary](https://www.gibsondunn.com/ninth-circuit-clarifies-limits-of-dmca-liability-for-ai-generated-code/)). **Engineering habit:** choose a deliberate public-code setting per tool, and run the same license scanning on agent pull requests that you run on new dependencies. ### Contributing to open source Projects now publish their own rules. [The Apache Software Foundation](https://www.apache.org/legal/generative-tooling.html) accepts AI-generated contributions only if the tool's terms do not restrict use of the output and the contributor is reasonably certain the output is non-copyrightable, free of third-party material, or properly licensed, and recommends a Generated-by commit trailer. [Linux kernel documentation](https://docs.kernel.org/process/coding-assistants.html) requires a human to certify the Developer Certificate of Origin - an agent must not add Signed-off-by - and asks for an Assisted-by trailer. **Engineering habit:** read the upstream project's policy before an agent-assisted pull request, and record tool use the way it asks; the [PR template's](https://aidlc.guru/templates/#pr-template) AI-assistance field already captures it internally. ### What model providers owe you Under the EU AI Act, providers of general-purpose AI models must maintain a copyright policy and publish a summary of their training content; per the [European Commission](https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers), those duties applied from 08-02-2025, enforcement began 08-02-2026, and models already on the market have until 08-02-2027. **Engineering habit:** add the training-content summary and any IP indemnity terms, with the conditions attached to them, to the [vendor evaluation](https://aidlc.guru/governance/#vendor-evaluation-checklist). ### Questions to take to counsel - Does our ownership of the codebase depend on copyright in every file, or on contracts and trade secrets that do not need it? - Which public-code and filtering settings must be on for a vendor's IP indemnity to apply? - Which licenses must never appear in our product, and how is an agent's output checked against that list? - What do our customer contracts promise about how our software is written, and do they say anything about AI? - What may engineers contribute upstream with agent help, and under whose name? ## Where It Fits in AIDLC Security is not a phase - it runs through all five. [Analyze](https://aidlc.guru/phases/analyze/) decides data classification and vendor BAA questions before a tool is adopted; [Ideate](https://aidlc.guru/phases/ideate/) threat-models the surfaces a new feature exposes to an agent; [Develop](https://aidlc.guru/phases/develop/) runs SAST, secret scanning, MCP review, and sandboxing; [Launch](https://aidlc.guru/phases/launch/) requires the evidence pack and a named approver before production; [Curate](https://aidlc.guru/phases/curate/) feeds incident review back into the control set. ## Related Pages [ ### Governance Before Scale The pillars, policy outline, and vendor evaluation this framework mapping assumes. ](https://aidlc.guru/governance/)[ ### Agents in the Pipeline Identity, permissions, and sandboxing - where excessive agency actually gets controlled. ](https://aidlc.guru/agents-in-the-pipeline/)[ ### Hidden Risks The quality and trust data behind why review discipline matters here too. ](https://aidlc.guru/hidden-risks/)[ ### Templates and Checklists The vendor checklist and evidence pack this page's frameworks reference. ](https://aidlc.guru/templates/)[ ### Research Library Every primary source, including the standards and vendor documentation cited here. ](https://aidlc.guru/research/) ## Frequently Asked Questions Not on their face. The Commission's draft classification guidelines from May 2026 do not name coding assistants as high-risk, and Article 4 AI literacy and Article 50 transparency obligations apply broadly rather than triggering Annex III. The Digital Omnibus Regulation (EU) 2026/1744, in force since 07-27-2026, pushed Annex III high-risk obligations to 12-02-2027, so a product that does make consequential decisions about people has until then to comply. No. PHI is Restricted tier data, which this playbook's data classification never allows into a prompt, chat, CI agent, or MCP connector, regardless of vendor BAA coverage. Coverage is per product and per configuration, not per vendor: Anthropic's BAA reaches Claude Code and Cowork only in local mode on a HIPAA-ready Enterprise plan with the HIPAA configuration applied, GitHub does not sign BAAs at all, and OpenAI's covers the API and ChatGPT Enterprise. Use synthetic fixtures instead. No authoritative AICPA guidance names AI-authored code as of 10-2026, and the Trust Services Criteria are unchanged. A nonauthoritative Technical Q&A, TQA 9561 dated 09-10-2026, addresses AI use in SOC examinations. Practitioner consensus routes AI changes through the same CC8.1 path as any change: ticket, human review, test evidence, approval, rollback, deploy log, with the AI tool inventory under CC9.2 vendor management. ## Build the Control Before the Auditor Asks See the five governance pillars this framework mapping assumes, then bring the rest of the playbook together. [Governance Before Scale](https://aidlc.guru/governance/) [Back to the Playbook](https://aidlc.guru/playbook/)