ZeroPoint AI Security Landscape Footprint

Footprint = Authority Surface + Coverage Map. Autonomous systems don't just "run workflows" — they make determinations that the rest of the system treats as legitimate. That's authority. ZeroPoint's approach is to make authority explicit, enforceable at the point of action, observable by default, and terminable by design.

ZeroPoint's coverage across 91 capabilities from NIST AI RMF, OWASP LLM Top 10, OWASP Agentic Top 10, OWASP MCP Top 10, MITRE ATLAS, and ZeroPoint governance domains — including the Sovereign Viewport, which structurally eliminates seven client-side attack classes. Green = directly addressed, Yellow = partially addressed, Red = outside scope.

Identity & Access (NIST AI RMF · GOVERN)

Cryptographic identity and scoped authorization for every participant

Agent Authentication — Ed25519 keypair identity; every request signed
Dynamic Authorization — PolicyContext + TrustTier evaluation per-request
Credential Vault — ChaCha20-Poly1305 encrypted storage (zp-trust)
Scoped Capability Grants — Read/Write/Execute/ApiCall scoped per-agent
Least-Privilege Enforcement — Scoped fields + expiry + delegation depth limits
Credential Rotation — Dynamic keypair lifecycle; zero static secrets
Peer Discovery — Presence Plane: dual-backend discovery (web relay + Reticulum mesh) with reciprocity enforcement; no central registry

Governance & Policy (NIST AI RMF · GOVERN + MAP)

Constitutional rules and automated policy enforcement pipeline

AI Gateway / Firewall — GovernanceGate: Guard → Policy → Execute → Audit
Constitutional Rules — HarmPrincipleRule (non-removable) + SovereigntyRule
Content Policy Screening — Policy rules evaluate actions before execution
Human Override — SovereigntyRule: human is always root authority
Responsible AI Tenets — Four Tenets enforced at protocol level
Regulatory Compliance — Immutable audit trail satisfies audit requirements

Audit & Traceability (NIST AI RMF · MEASURE)

Tamper-evident, hash-chained record of every action

Immutable Audit Trail — Hash-chained receipt chain; tamper-evident
Non-repudiation — Ed25519-signed receipts prove who did what
Chain Verification — AuditStore with cryptographic chain checks
Forensic Record — Complete action history for incident response
Behavioral Analytics — Audit data enables analytics; detection ML not built-in
Posture Assessment — Framework provides data; assessment is human process

Agentic Threats (OWASP Agentic Top 10)

Threats unique to autonomous AI agents in production

Agent Goal Hijack — GovernanceGate screens; policy rules constrain goals
Tool Misuse — zp-skills: verified registry + sandboxed execution
Rogue Agents — Kill switch (SovereigntyRule) + capability revocation
Insecure Inter-Agent Comms — zp-mesh: Ed25519-signed messages over Presence Plane dual-backend transport
Passive Scanning — Presence Plane reciprocity enforcement; peers must announce before they can observe
Cascading Hallucinations — Receipt chain traces provenance across chains
Excessive Agency — Scoped capabilities + delegation depth limits
Identity & Privilege Abuse — Scoped capabilities + delegation depth; cross-chain identity federation in design (ASI03)
Unexpected Code Execution — zp-skills sandboxed execution; dynamic code generation screening planned (ASI05)
Memory Poisoning — Receipt chain provides provenance; persistent context integrity checks in design (ASI06)
Human-Agent Trust Exploitation — Sovereign Viewport prevents agent from manipulating local UI elements. Agent cannot inject client-side code, modify DOM, or persist deceptive state. SovereigntyRule + kill switch enforce the trust boundary architecturally

LLM Threats (OWASP LLM Top 10, 2025)

Top risks for applications built on large language models

Prompt Injection — GovernanceGate pipeline screens; not a dedicated WAF
Sensitive Info Disclosure — Scoped capability grants control data access
Insecure Plugin Design — zp-skills: verified registry + sandboxed execution
Supply Chain Vulns — Rust memory safety; plugin verification in registry
Data Poisoning — Training-time concern; outside runtime governance
Model Theft — Model security; outside governance scope
Prompt Leakage — Sovereign Viewport renders prompt text server-side. Even if the model leaks its system prompt, the user sees pixels — not parseable, not scrapeable. Programmatic extraction structurally prevented
Unbounded Consumption — Capability grants with rate/scope limits

Adversarial ML (MITRE ATLAS)

Adversarial techniques targeting ML across the attack lifecycle

Reconnaissance — Reciprocity enforcement; scanners are observable before they can observe
Resource Development — Attacker infrastructure; outside scope
Initial Access (API) — Ed25519 identity + capability grants
ML Attack Staging — GovernanceGate screens suspicious patterns
Exfiltration — Scoped access + audit trail detects extraction
Impact / Disruption — Kill switch + blast radius minimization
Evasion — Model-layer evasion; outside scope
Persistence — Capability expiry + revocation

Data Protection (NIST AI RMF · MANAGE)

Protecting data at rest, in transit, and during AI processing

Encryption at Rest — CredentialVault: ChaCha20-Poly1305
Access Controls — Capability grants govern who reads/writes what
Data Loss Prevention — Structural DLP: data cannot leak from clients because it is never there. Render node is the only system that materializes data, under sovereign control. GovernanceGate enforces content policies at the action layer
Training Data Security — Training-time concern
Privacy Preservation — Structural amnesia: relay retains no logs, state, or index (subpoena-proof by design). Scoped access + audit enables compliance

Infrastructure (NIST CSF · Protect)

Network, endpoint, and deployment infrastructure

Network Segmentation — Network infrastructure concern
TLS / Transport — DTLS-SRTP (WebRTC) + dual-backend transport. Rendered content never exists as parseable plaintext on the wire — pixel streaming carries encoded video, not structured data
Firewalls & IDPS — Network layer
Cross-Site Scripting (XSS) — Structurally eliminated. No DOM exists on the client — there is nothing to inject into
Cross-Site Request Forgery — Structurally eliminated. No session tokens or authenticated state on the client
Clickjacking — Structurally eliminated. No iframes, overlays, or DOM elements to redress
Browser Extension Scraping — Structurally eliminated. Extensions cannot read data — only decoded video frames
Client Cache Poisoning — Structurally eliminated. No application data cached on the client
Clipboard Exfiltration — Structurally eliminated. No application data reaches the endpoint
Man-in-the-Browser — Structurally eliminated. Browser processes only a video stream, not structured content
Runtime Model Protection — Model hosting concern
Canary Deployments — Deployment infrastructure concern

Edge Sovereignty (ZeroPoint · GOVERN)

Treating routers and network-edge devices as governed participants with identity, consent, and receipts

Device Identity — Ed25519 keypair per device; same identity primitive as agents and humans
Firmware Integrity — Attested boot chain + receipt of firmware state; requires open-firmware baseline
RF Sensing Governance — CSI extraction detection + consent boundary; governance layer over WiFi sensing
Telemetry Accountability — Receipt-gated telemetry export; no silent data exfiltration from edge devices
Physical Presence Consent — Structural requirement: occupants must consent before spatial sensing activates
Open Firmware Mandate — Policy rule requiring auditable firmware; non-compliant devices flagged in governance chain

MCP Protocol Security (OWASP MCP Top 10, 2025 beta)

Threats targeting Model Context Protocol tool interfaces — the transport layer ZeroPoint speaks natively

Tool Poisoning — zp-skills registry validates tool definitions; runtime input sanitization in progress
Rug Pull — Capability revocation + SovereigntyRule; tool version pinning planned
Server-Side Request Forgery — MCP server infrastructure concern — outside governance scope
Credential Theft via MCP — CredentialVault isolates secrets from tool context; MCP-specific access scoping in design
Supply Chain Compromise — Plugin registry verification; MCP-specific tool signing planned

Fleet & Settlement (ZeroPoint · GOVERN + SETTLE)

Threats arising from multi-agent orchestration, delegation chains, and financial settlement finality

Confused Deputy — Delegation depth limits + scoped capabilities; cross-chain deputy validation in design
Cascading Orchestration Failure — Kill switch + blast radius minimization; circuit breaker patterns planned
Settlement Anchor Integrity — Hash-chained receipts; external anchor verification in design
Finality Disputes — Arbitration surface defined in theory; dispute resolution protocol in design
Delegation Chain Verification — Receipt chain traces delegation hops; real-time chain monitoring planned

Cryptographic Resilience (NIST PQC · CNSA 2.0)

Post-quantum readiness and crypto agility — ensuring the trust layer survives the transition from classical to quantum-resistant primitives

Signature Migration — Ed25519 is quantum-vulnerable (Shor's algorithm). Candidate replacement: ML-DSA (Dilithium) — FIPS 204, lattice-based, NIST-finalized 2024
Key Encapsulation — Not yet applicable to core protocol. Candidate: ML-KEM (Kyber) — FIPS 203, lattice-based, for future encrypted transport channels
Hash-Based Fallback — Receipt chain already uses SHA-256 hashing (quantum-safe under Grover). Candidate backup signer: SLH-DSA (SPHINCS+) — FIPS 205, stateless hash-based
Harvest-Now-Decrypt-Later Defense — Wire-level HNDL structurally reduced: pixel streaming means captured traffic yields video, not structured data. ML-DSA hybrid signing (Phase 1 complete) protects receipt provenance post-quantum
Symmetric Posture — ChaCha20-Poly1305 (256-bit) — Grover reduces to 128-bit equivalent, well beyond brute-force. No migration needed
Crypto Agility — Protocol design separates signing algorithm from identity semantics; algorithm field in receipts planned to enable non-breaking primitive swaps

Sovereign Viewport (ZeroPoint · Pixel Streaming)

Threats targeting server-side rendering and pixel streaming transport — the trust boundary between sovereign data and untrusted endpoints

Render Node Isolation — Single-tenant headless browser per session. Process isolation via Puppeteer page contexts. No shared state between user sessions
Session Recording — WebRTC/WebSocket stream can be recorded if transport is compromised. DTLS-SRTP encrypts the channel. Render node runs on sovereign infrastructure
Input Injection — Injected WebSocket messages could simulate mouse clicks and keystrokes. Authenticated WebSocket with session tokens; per-message signing planned
Frame Analysis / OCR — Captured video frames can be OCR'd. Significantly harder than parsing JSON but not impossible. Data is pixelized, not destroyed
Render Node Compromise — The render node is the single point of trust. A compromised render node yields everything. Sovereign infrastructure, minimal attack surface, process isolation. One node to protect instead of N endpoints
Latency Side-Channel — Frame delivery timing could theoretically leak information about content type or activity patterns. Low practical risk

Authority Graph

A live view that makes delegation chains and arbitration surfaces visible — not implicit. Who authorized what, through whom, and where disputes resolve.

Coverage key: Green = directly addressed by ZeroPoint primitives. Yellow = partially addressed or enabled by framework data. Red = outside ZeroPoint's governance scope (infrastructure, model-layer, or training-time concerns).