AI gateway vendor's admin console governs every model the firm uses
- Organization
- Halden & Marsh LLP
- Vendor / dependency
- GateKeep AI Gateway
- Industry
- Generic business
- Run time
- 64 min 38 s · 38 agent calls
Headline · class 6
8.3HIGH
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:A/CR:M/IR:H/AR:H/S:N/AU:Y/R:U/V:C/RE:H/U:AmberAgent-assigned metrics, deterministically scored; not expert-reviewed.Download walkthrough (Markdown)Ratings by hazard class
The headline is the worst class, as CVSS reports the worst finding, not a sum
| Class | Carried by | Score | Rating | Load-bearing metrics |
|---|---|---|---|---|
| 1 Whose AI brain is this, really? | 1.3 Model update / versioning control | 8.2 | HIGH | ACATPRUIVISIEAUVRE |
| 2 What are we feeding it? | 2.1 Prompts / user inputs | 8.3 | HIGH | AVACATPRUIVASISAAUVRE |
| 3 What does it create from our data: and where does THAT go? | 3.5 Telemetry / usage logs | 7.5 | HIGH | ACATPRVCVIVAAURVRE |
| 4 Who's deciding what the AI sees and does? | 4.4 Guardrail / safety filter layer | 9.0 | HIGH | AVACATUIVCVIVASIESAUVRE |
| 5 Which humans are actually looking at our stuff? | 5.3 Support / debugging access | 7.4 | HIGH | AVACATUIVCV |
| 6 Who's holding the steering wheel? ◆ | 6.1 Centralized control plane / admin console | 8.3 | HIGH | AVACATUIVIVASISAEAUVRE |
| 7 How many companies are really in this chain: and did we agree to it? | 7.1 Downstream subprocessors | 9.3 | HIGH | ACATPRUIVIVASCSISAESAUVRE |
Findings
What we found per class, in the auditor's language; open the evidence to see each metric's rationale
- HIGH8.2
1 Whose AI brain is this, really?
1.3 Model update / versioning control · also 1.1Halden & Marsh has no contract with any of the three model providers that actually produce its AI output; GateKeep contracts them, holds all the provider keys and decides which providers are supported. GateKeep can change the supported providers and the default policies for every customer at once, and has done so twice in the past year, publishing release notes only on the day each change took effect. Either GateKeep or one of the model providers can therefore change the behaviour of the AI the firm's lawyers rely on, with no advance notice, no approval step for the firm and no ability to stay on a known version. The firm has no way to re-test output quality before a change is live, and every drafting and review workload inherits the change at the same moment.
Rating HIGH. The firm cannot tell in advance when the AI underneath its work product will start behaving differently, so any assurance it gives clients about consistent, validated AI behaviour is unsupported.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:A/CR:M/IR:H/AR:H/S:N/AU:Y/R:U/V:C/RE:H/U:Amber Score 8.2 (High)
Ask the vendor Whose AI model is actually answering our questions, yours, or one you're renting from someone else? · If we stopped paying you tomorrow, could we take this AI capability somewhere else, or does it just disappear? · Can the AI's behavior change overnight without you telling us?
Metric Value Prior Source Rationale AV Access Path A N agent · override OVERRIDE of prior N. The rubric defines AV:N as 'vendor-direct API access, no intermediary' and AV:A as 'subprocessor-mediated access'. For dimension 1.3 the dependency being assessed is the model and its version, and the firm does not reach any model directly: all generative-AI usage is routed through GateKeep, which fronts three model providers, holds every provider API key and decides which providers are 'supported'. The model-update path therefore runs through an intermediary and its subprocessor chain (the firm only learned of the console/config jurisdiction split from GateKeep's subprocessor list), which is the textbook Adjacent case. The questionnaire's N is correct for the primary dependency (the gateway API itself) but not for this category's own exposure. AC Compulsion Complexity L L agent CONFIRM. AC:L is 'a standard ToS clause or routine legal process suffices'. Nothing technical or contractual stands between GateKeep (or an upstream provider) and a behaviour-affecting model change: the vendor has already changed console behaviour, default policies and supported providers twice in the last year under its standard terms, with no advance-notice guarantee, no customer approval gate and no version-pinning or customer-managed barrier described. The firm holds no model weights or pinned artefacts that would have to be overcome. AT Trigger Conditions N N agent CONFIRM. AT:N is 'control can be exercised at vendor discretion at any time'. The rubric lists AT as a primary exploitability metric for 1.3, and the scenario is explicit: 'GateKeep can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year.' No sanctions designation, litigation hold or incident is needed — the demonstrated history of discretionary changes is direct evidence that no triggering condition is required. PR Position Required N L agent · override OVERRIDE of prior L. PR:L requires that only 'the primary contracted vendor' can exercise the control; PR:N is 'any party already in the subprocessor chain has sufficient standing'. For model update/versioning, standing is shared: GateKeep can unilaterally change which providers are supported and how requests are routed, AND each of the three fronted model providers — subprocessors with whom the firm has no contract — can swap or deprecate a model version behind its own endpoint, with the change flowing straight through the gateway. SR 11-7 notes that vendor-model internals are opaque to the consuming organisation and that modifications are made by the vendor over time, so the firm cannot gate either actor. No compromise of the firm's own admin credentials is needed, so H is excluded. UI Org Action Required N N agent CONFIRM, and this is the metric the rubric says carries dimension 1.3. UI:N is 'vendor/subprocessor can act unilaterally (silent model swap, ToS change)' — the named example matches this scenario exactly. GateKeep changes supported providers and default policies for all customers at once, publishing release notes only on the day the change takes effect (Vendor Notice Posture = concurrent disclosure), so the firm takes no affirmative action, does not opt in and cannot accept or reject the update; it merely discovers it afterwards. Per the rubric note, every downstream consumer then inherits an un-notified behaviour change. VC Primary Dependency Impact -- Confidentiality L L agent Confirms the questionnaire prior. For dimension 1.3 the confidentiality effect of a unilateral model/provider change is real but indirect: when GateKeep alters its set of 'supported providers', the firm's prompts — including client-confidential professional-services material — can begin flowing to a model provider the firm never evaluated or contracted with, and it learns this only on the day of change. The firm's DLP rules and audit logging remain in force at the gateway, so this is partial/indirect exposure (a changed recipient and changed retention/training posture) rather than total loss of the confidential corpus. The rubric does not list VC as a primary impact axis for 1.3 (it lists VI only), which supports Low rather than High. Citations: sovereignty_cvss_rubric_1.json (dimension 1.3 definition and primary_impact_axis ['VI']). VI Primary Dependency Impact -- Integrity H H agent Confirmed and strongly supported. The rubric names VI as the single primary impact axis for dimension 1.3 and notes that 'every downstream consumer of the model inherits an un-notified behavior change'. The scenario is the textbook pattern: the firm never contracts the three model providers directly, GateKeep holds all keys and routing, and GateKeep can change default policies and supported providers for all customers at once — which it has done twice in the past year with release notes published only on the day the change took effect (U = Amber notice posture in the rubric's supplemental set). The firm therefore has no pre-change veto, no version pinning, and no ability to re-validate behaviour before it is live; the questionnaire confirms 'behaviour can be changed silently and materially' at the dependency. That is total loss of control over the integrity of model behaviour, so High. Citations: sovereignty_cvss_rubric_1.json (1.3 note on un-notified behaviour change; U/Vendor Notice Posture value definitions). VA Primary Dependency Impact -- Availability L H agent · override Override of the questionnaire prior (H). The prior reflects the firm's PRIMARY dependency — the GateKeep console and configuration store, whose unavailability stops every AI workload simultaneously (that total-withdrawal reasoning belongs to the Control Plane category, rubric 6.3/6.4). Assessed on its own axis, dimension 1.3 concerns who decides when the underlying model changes behaviour. Here the realistic availability consequence of a unilateral versioning decision is deprecation or removal of one of the three fronted providers/model versions: the firm loses the specific validated model it built and tested against, but generative-AI capability persists because the gateway can route to the remaining providers. The rubric reinforces this by listing VA as a primary impact axis for 1.2 (weight custody) but not for 1.3. That is partial, not total, loss of availability at this dependency, hence Low. Citations: sovereignty_cvss_rubric_1.json (1.3 vs 1.2 primary_impact_axis; 6.3 gateway-outage note attributing total availability loss to the control plane). SC Downstream Blast-Radius Impact -- Confidentiality L L agent Confirmed. A unilateral change to 'supported providers' means client-confidential prompt content can be redirected to a model provider the firm never selected or vetted, under that provider's own retention and training terms, and the firm learns of it only on the day of change. That is real but partial/indirect downstream confidentiality loss at a third party (a provider the firm never contracted directly), not a total disclosure of the firm's client matter corpus: the gateway's DLP rules still apply and no bulk store is exposed by a version/provider swap alone. This matches the rubric's treatment of SC for dimensions where impact lands on a party that 'was never the org's contracted AI vendor' (e.g. 3.1) while keeping it below the flagship-H level. The questionnaire's own 'Beyond this dependency... Partial' answer is consistent. SI Downstream Blast-Radius Impact -- Integrity H H agent Confirmed, and this is the axis that carries the finding. The rubric states for dimension 1.3: 'Every downstream consumer of the model inherits an un-notified behavior change -- textbook Subsequent Integrity impact.' Here GateKeep can change supported providers and default policies for all customers at once, has done so twice in the last year, and publishes release notes only on the day the change takes effect — so every one of the firm's AI workloads (drafting, review, client-facing work product for a 900-person professional-services firm) silently begins acting on outputs from a different model with different behaviour, with no pre-change window to re-validate. The questionnaire confirms 'downstream systems act on altered outputs without detection', i.e. near-total loss of assurance over downstream output integrity. SA Downstream Blast-Radius Impact -- Availability L H agent · override Override H -> L for this dimension. The prior 'Full / downstream workloads stop' answer describes the primary dependency — the hosted console and configuration store, whose unavailability the scenario says would affect every AI workload simultaneously. The rubric assigns that pattern to the Control Plane dimensions (6.1 'a console compromise or outage affects every downstream AI workload', 6.3 'a gateway outage takes down access'), not to 1.3, whose primary impact axis is VI. Assessed on its own terms, an un-notified model/provider change withdraws or deprecates one of three fronted providers: workloads pinned to that provider or to version-specific prompt scaffolding break or degrade until re-routed, while the remaining providers keep serving — partial, recoverable downstream availability loss. Not S: professional-services document work has no physical or safety-relevant failure mode. E Precedent Maturity A P agent · override Override of the questionnaire prior (P). For dimension 1.3 the relevant 'control being exercised' is a unilateral, behaviour-affecting change to the model/version surface the organisation consumes. The scenario states this has already happened twice in the last year: GateKeep changed console behaviour, default policies and *supported providers* for all customers at once, with release notes published only on the day the change took effect. That is not a research demonstration against a comparable org — it is a documented, realised exercise of exactly this control against this firm's own stack, which satisfies the rubric's definition of A ('documented real-world cases of this control being exercised against comparable orgs'; here, stronger than that). The questionnaire's 'demonstrated in research/incident reports, not confirmed against our stack' answer describes the primary dependency (the gateway/console as a whole) and the precedent for silent model-version swaps generally; it understates this category's own exposure, where the precedent is first-party and recurring. Corpus support for the same pattern independent of the firm: ATLAS AML.T0109 'AI Supply Chain Rug Pull' is rated Maturity *Realized* and the ATLAS README maps Realized/Incident → CASE Precedent Maturity E:A, with incident case study AML.CS0053 (Postmark MCP, 2025-09-01) showing adopters inheriting an altered component version through a routine update with no case-by-case decision — the un-notified behaviour change every downstream consumer inherits that the rubric flags as the 1.3 note. The two historical GateKeep changes also propagated to all customers simultaneously (AU-style trigger), so there is no basis for U and no basis for X. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence N N agent Confirming the prior. For dimension 1.3 the triggering event is a behaviour-affecting model/provider change pushed without prior notice. The firm is a deployer, not a provider, and the retrieved EU AI Act text places the substantial-modification/conformity-reassessment and notification duties on providers and notified bodies, not on a customer whose gateway vendor swaps a backend model; nothing in Title III makes that swap independently reportable by the firm. Caveat for the reviewer: a change to 'supported providers' can introduce a new processing party for client data, which would engage GDPR Art. 28(2) prior-authorisation/objection rights -- that is a real but contingent and contractual trigger (and belongs more naturally to the subprocessor dimension), so S remains Negligible here rather than Present. Confidence reduced because the corpus returned no GDPR Art. 28 text to test this directly. AU Silent/Automatic Trigger Y Y agent Confirmed, and this is the metric the rubric names as dimension 1.3's supplemental hook. The scenario states GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year'. That is a fleet-wide, no-case-by-case-decision change: the firm never contracts the three model providers directly, so a provider/version change propagates to every Halden & Marsh workload automatically. ATLAS AML.T0109 (AI Supply Chain Rug Pull, maturity Realized) documents the same mechanism -- a trusted component pushing a behaviour-altering update to its whole installed base after adoption. R Portability / Exit Recovery U U agent Confirmed. The capability at stake in 1.3 is control over which model version/provider serves the firm's traffic. It can be reconstituted -- by contracting the model providers directly or standing up another gateway with pinned versions -- but not automatically: the firm holds no offline copy of its routing and policy configuration and 'rebuilding it with another gateway would take a significant project'. That is manual migration effort, not loss-free reconstitution (A) and not dependence on the original vendor (I), since the underlying models remain commercially available from the three providers. V Blast-Radius Concentration C C agent Confirmed. GateKeep is the firm's single shared control plane: 'all of its generative-AI usage' is routed through it, it holds every provider API key, and 'every AI workload in the firm would be affected simultaneously'. The rubric's definition of Concentrated explicitly instances a shared control plane. An un-notified model/provider change therefore lands in the critical path of all AI workloads at once rather than one narrow workload. RE Exit / Mitigation Effort H H agent Confirmed. Mitigating un-notified model change cannot be done by configuration: because the firm never contracts the providers directly, obtaining version pinning or advance-notice guarantees requires re-contracting (either with GateKeep or with the three providers), and escaping the gateway requires re-architecting routing, DLP and the audit log that underpins the firm's client-confidentiality assurances, with no offline configuration backup to migrate from. That matches 'High -- requires re-architecture, re-contracting'. U Vendor Notice Posture Amber Amber agent Confirmed. GateKeep has made fleet-wide changes twice in the past year 'with release notes published on the day of change' -- disclosure concurrent with the change taking effect, which is the rubric's Amber. Not Red, because disclosure does occur; not Green or Clear, because there is no advance notice and no contractual notice guarantee (the vendor's right to change supported providers is a standing discretionary right). Reinforcing evidence of weak transparency: the firm learned the console's jurisdiction only by reading the subprocessor list itself. - HIGH8.3
2 What are we feeding it?
2.1 Prompts / user inputsEvery prompt typed by any of the firm's 900 staff passes through GateKeep's hosted service in readable form, because reading prompt content is how the gateway applies the firm's data-loss-prevention rules and writes the audit log. The prompts are then forwarded to three model providers the firm does not contract with, and the console and configuration store that govern this handling sit in a jurisdiction the firm did not select for inference. Nothing technical or contractual stops GateKeep, its hosting subprocessor, or legal process in that jurisdiction from reaching prompt content; the firm holds no keys of its own and has no residency protection over this tier. GateKeep can also loosen a redaction rule or re-point traffic to a different provider for all customers at once, and the firm would learn of it only on the day it happened.
Rating HIGH. Client-confidential and potentially privileged material entered as prompts is fully visible to the vendor and its chain, and the controls meant to redact it can be changed without the firm's agreement.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:H/SA:H/E:P/CR:M/IR:H/AR:H/S:N/AU:Y/R:U/V:C/RE:H/U:Amber Score 8.3 (High)
Ask the vendor What do our employees actually type into this thing, and does it include customer or confidential information? · Did we upload or connect any of our own internal documents for it to search? · Can this AI take real actions, look things up, change things, or does it only talk?
Metric Value Prior Source Rationale AV Access Path N N agent Confirming N. Every prompt and user input from the firm's 900 staff is submitted over the network to GateKeep's hosted service, which runs in the vendor's own cloud and reads prompt content directly in order to apply the firm's DLP rules and write the audit log. For the most severely positioned exercising party (the gateway vendor itself) there is no intermediary between it and the plaintext prompt stream, which is the rubric's definition of 'Network -- vendor-direct API access, no intermediary'. Subprocessor-mediated paths also exist (three downstream model providers, plus the console/configuration store hosted in a different jurisdiction per GateKeep's subprocessor list), which would be AV:A, but CVSS scoring takes the most severe reachable path, so N is retained. AC Compulsion Complexity L L agent Confirming L. Nothing technical or contractual has to be overcome to reach prompt content: inspecting prompts is the product's advertised function (DLP enforcement, audit logging), GateKeep holds the API keys for all three providers rather than the firm, and there is no customer-managed-key or data-residency carve-out protecting prompt handling - indeed the console and configuration store sit in a jurisdiction the firm did not choose for inference. A standard ToS clause or routine legal process against the gateway vendor therefore suffices, matching the rubric's 'Low'. AT Trigger Conditions N N agent Confirming N. Prompt inspection is continuous and standing, not event-contingent: all generative-AI usage is routed through the gateway at all times, and GateKeep can change default policies, routing and supported providers for all customers at its discretion (it did so twice in the last year). No sanctions designation, litigation hold or incident is needed for prompt content to be visible or redirected, so Trigger Conditions = None. PR Position Required N L agent · override Override of the questionnaire's L. The prior answer ('only the primary vendor we contract with') is scoped to the primary dependency, the gateway control plane. For this category's own exposure, prompt content does not stop at GateKeep: the gateway fronts three model providers that each receive forwarded prompts, and the console/configuration store - the place where policy, routing and audit artefacts (including flagged-prompt handling) live - is operated in another jurisdiction by a party on GateKeep's subprocessor list. Any party already in that subprocessor chain therefore has sufficient standing to see prompt data it is handed, which is the rubric's PR:N ('any party already in the subprocessor chain has sufficient standing'), rather than PR:L which would require being the primary contracted vendor. UI Org Action Required N N agent Confirming N. Although prompt exposure is realised through ordinary use (which alone would be P), the material change in exposure can be made unilaterally: GateKeep can alter console behaviour, default policies and the set of supported providers for all customers simultaneously, with release notes published only on the day the change takes effect. A silently loosened DLP rule or re-pointed route would send firm prompts to a different provider or in un-redacted form with no affirmative action, acceptance or opt-in by the firm - the rubric's 'vendor/subprocessor can act unilaterally'. VC Primary Dependency Impact -- Confidentiality L L agent Confirmed. Every prompt from the 900-person firm transits GateKeep and is parsed in the clear by its DLP engine before reaching any of the three providers, so the gateway vendor is structurally positioned to see internal business and client-matter content. The rubric's node 2.1 names VC as the primary impact axis for prompts/user inputs with gap severity Medium and only partial coverage via vendor ToS (sovereignty_cvss_rubric_1.json, node 2.1), and the questionnaire rates confidentiality loss at the dependency as 'partial: limited or indirect exposure (metadata, fragments, aggregates)'. Loss is partial rather than total: inference remains in the firm's chosen jurisdiction, it is the console/configuration store (not the prompt corpus) that sits in the other jurisdiction, and the audit log plus DLP redaction constrain what is retained or forwarded. Hence L, not H. VI Primary Dependency Impact -- Integrity L H agent · override Override of the questionnaire's H. The H prior describes the primary dependency (GateKeep's control plane, taxonomy node 6.1), where the vendor can silently change console behaviour, default policies and supported providers for all customers at once. Assessed at this category's own exposure -- the prompt/user-input stream -- the loss is partial: a silent policy or routing change can alter how inputs are redacted, augmented with policy preambles and which provider they are sent to, but the user-authored prompt content itself is not fabricated or wholesale rewritten by the vendor, and the rubric does not list VI among the primary impact axes for node 2.1 (it reserves VI/VC pairing for 2.2 RAG ingestion and 2.4 tool-call parameters). The full, undetectable alteration the questionnaire points to lands downstream (SI: 'downstream systems act on altered outputs without detection') rather than on the integrity of the inputs at this node. Lower confidence recorded because an inline gateway is technically capable of arbitrary prompt transformation, which would argue for H. VA Primary Dependency Impact -- Availability H H agent Confirmed. GateKeep is the sole path for all generative-AI usage: it holds every provider API key and enforces routing, so if the hosted console or its configuration store is unavailable or altered, no prompt can be submitted anywhere in the firm and 'every AI workload in the firm would be affected simultaneously'. The firm keeps no offline copy of its routing and policy configuration and rebuilding on another gateway is a significant project, matching the questionnaire's 'full: the capability can be removed outright' and the high exit-effort/blast-radius answers. This is near-total loss of the prompt-submission capability at the dependency, i.e. H. SC Downstream Blast-Radius Impact -- Confidentiality L L agent Confirming the prior. For dimension 2.1 the subsequent-confidentiality path is exactly the one the rubric names: 'Flagged prompts routed to human review (Category 5) become Subsequent Confidentiality impact' (sovereignty_cvss_rubric_1.json, node 2.1). In this scenario every prompt from 900 staff transits GateKeep and is inspected by the firm's DLP rules, so prompt content and prompt-derived metadata/audit records reach parties beyond the inference provider the firm chose: GateKeep's hosted console and configuration store in a different jurisdiction, GateKeep's listed subprocessors, and three fronted model providers. That is genuine multi-hop exposure (rubric: subsequent impact exists to express 'loss propagating beyond the named dependency', and nodes 7.1/3.1 treat exposure at a party that was never the contracted AI vendor as textbook SC). The loss is nonetheless partial rather than total: what propagates is flagged/sampled prompt fragments, DLP hit metadata and audit log entries, not the firm's whole client-confidential matter corpus, and the questionnaire itself rates confidentiality beyond the dependency as 'Partial'. Hence L, not H. SI Downstream Blast-Radius Impact -- Integrity H H agent Confirming the prior. GateKeep can change console behaviour, default policies and supported providers for all customers at once (and did so twice last year, with release notes only on the day of change), and the questionnaire records that behaviour can be changed 'silently and materially' with downstream systems acting on altered outputs 'without detection'. For prompts/user inputs this means the integrity of the whole input path can be rewritten upstream of every consumer: DLP redaction rules can be loosened or tightened, prompts re-routed to a different provider, or system/policy preamble altered, so every downstream workload and every lawyer relying on the output inherits an un-notified behavioural change. The rubric flags precisely this pattern as 'textbook Subsequent Integrity impact' where 'every downstream consumer inherits an un-notified behavior change' (node 1.3) and ties configuration/policy management to subsequent integrity (node 6.4); ATLAS AML.T0081 documents modification or disabling of security-relevant configuration as a realised technique. Because the firm holds no offline copy of its routing and policy configuration, it cannot even detect or diff an alteration, so the loss is near-total rather than partial: H. SA Downstream Blast-Radius Impact -- Availability H H agent Confirming the prior as H (not S). All generative-AI usage is routed through this one gateway, which holds every provider API key; if the console or gateway were unavailable, no prompt could be submitted and 'every AI workload in the firm would be affected simultaneously'. The rubric states directly that 'a gateway outage takes down access to the underlying service -- Subsequent Availability' (node 6.3) and that a console outage 'affects every downstream AI workload the org runs -- pure Subsequent scope' (node 6.1). The questionnaire confirms 'Downstream workloads stop', full withdrawal of the capability, concentrated blast radius across many/all workloads, and high exit effort with no offline configuration backup, so downstream availability loss is total rather than partial. S is not warranted: Halden & Marsh is a professional-services firm with no physical-process or safety-relevant systems in the loop, and the questionnaire's own answer on harm identifies only stopped workloads, no potential for physical harm. E Precedent Maturity P P agent Confirming the questionnaire prior of Proof-of-Concept for the prompt/user-input exposure at GateKeep. The exposure here is that 100% of the firm's prompts (including client-confidential matter content) transit a third-party gateway whose console and configuration store sit in a different jurisdiction than the chosen inference region, where the vendor can inspect, retain or re-route prompt content and silently change DLP/routing defaults for all customers at once. The corpus grounds this class of prompt-content disclosure at the 'Demonstrated' level rather than 'Realized': ATLAS AML.T0057 (LLM Data Leakage) is rated 'Maturity: Demonstrated -> CASE Precedent Maturity E:P', and the intermediary/proxy-interception patterns closest to a gateway sitting in the inference path (AML.T0114 AI Service Web Interface, case study AML.CS0061 'AI in the Middle', an Exercise -> E:P) are research proofs-of-concept, not confirmed exercises against a contracted gateway of a comparable professional-services firm. Not A: the one clearly 'Realized -> E:A' corpus item involving AI proxies (AML.T0008.005 AI Service Proxies; AML.CS0030 LLM Jacking) is adversary abuse of stolen credentials to resell model access, not a documented case of a contracted gateway vendor exercising visibility over customer prompts against peer organisations; the scenario itself reports only published release-note changes to console behaviour and defaults, not an observed prompt-disclosure event. Not U: the risk is well beyond theoretical, with published research and incident reporting on prompt interception, leakage and vendor-side retention, plus the firm's own discovery of an out-of-jurisdiction subprocessor holding the configuration that governs prompt handling. Note that flagged prompts routed to human review (Category 5) extend the same demonstrated-but-not-org-confirmed precedent into subsequent confidentiality. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence N N agent Confirmed. The exposure at 2.1 is prompt content transiting GateKeep's inspection path, rated at partial confidentiality loss (metadata, fragments, aggregates) in the questionnaire and gap_severity Medium in the rubric. The jurisdictional mismatch the firm discovered concerns the hosted console and its configuration store, not the inference path — prompts are still processed in the jurisdiction the firm chose — so a compromise here does not by itself constitute an unauthorised transfer or an unauthorised-subprocessor breach that is independently reportable. Partial exposure of internal business prompts to a contracted processor acting under its own standard terms is a contractual and professional-confidentiality matter first; neither the EU AI Act reporting provisions nor the NYDFS 72-hour notice rule retrieved from the corpus is triggered by this fact pattern on its own. Confidence is moderate rather than high: for a 900-person professional-services LLP, prompts plausibly carry client-confidential and personal data, and if DLP-flagged prompts were ever routed to vendor human review in the console's jurisdiction (the rubric's own note on this dimension), the rating would escalate to P. No such human-review path is described in the scenario. AU Silent/Automatic Trigger Y Y agent Confirmed, and it holds on this category's own facts rather than only by inheritance from the primary category. GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year' — a single fleet-wide release changes how every prompt is inspected, policy-filtered and routed, with no per-customer or per-prompt decision. The rubric attaches the AU hook to exactly this pattern of un-notified fleet-wide change ('every downstream consumer inherits an un-notified behavior change'), and the questionnaire confirms no action by the firm is required: the vendor can act unilaterally. R Portability / Exit Recovery U U agent Confirmed. The prompt-handling capability (policy enforcement, DLP inspection, provider routing for all user inputs) is reconstitutable with a different gateway, so this is not Irrecoverable — the three model providers remain reachable directly and the function is a commodity control-plane capability. But it is not Automatic either: the firm holds no offline copy of its routing and policy configuration, GateKeep holds the provider API keys, and the scenario states rebuilding with another gateway 'would take a significant project', i.e. manual re-integration, policy re-authoring, key re-issuance and re-onboarding of users. That is the definition of R:U (manual migration effort), matching the questionnaire's own exit answer. V Blast-Radius Concentration C C agent Confirmed on this category's own exposure. 'All of its generative-AI usage' is routed through GateKeep, so every prompt and user input in a 900-person firm transits one shared control plane; 'if the console were unavailable or its configuration altered, every AI workload in the firm would be affected simultaneously'. The rubric classifies precisely this shape — API gateway (6.3) and configuration/policy management (6.4), both gap_severity High with no existing standard identified — and defines V:C as a dependency in the critical path for many/all AI workloads, e.g. a shared control plane. RE Exit / Mitigation Effort H H agent Confirmed. Mitigating the prompt-exposure path cannot be done by a trivial configuration or contractual tweak: because every prompt must traverse the gateway to reach any provider, reducing prompt exposure means re-architecting the inference path (direct provider integration or a replacement gateway), re-authoring the DLP and policy rule set from scratch with no offline copy, re-homing the audit log the firm's client-confidentiality assurances depend on, and re-contracting with the vendor and/or the three providers. The scenario's own characterisation — 'a significant project' — plus the rubric's High gap severity and absence of any applicable standard for gateway and policy-management layers support H over M. U Vendor Notice Posture Amber Amber agent Confirmed. The vendor changed console behaviour, default policies and supported providers twice in the last year 'with release notes published on the day of change' — disclosure concurrent with the change taking effect, which is the rubric's definition of Amber. It is not Red (changes are disclosed, not concealed) and not Green or Clear (no advance notice, and nothing in the scenario indicates a contractually guaranteed notice period for subprocessor, hosting or default-policy changes; the firm in fact learned of the console's jurisdiction only by reading the subprocessor list itself). This posture is directly relevant to 2.1 because a same-day default-policy change can alter how prompts are inspected and where they are routed before the firm can react. - HIGH7.5
3 What does it create from our data: and where does THAT go?
3.5 Telemetry / usage logs · also 3.3The audit log the firm relies on as evidence for its client-confidentiality assurances is created, formatted, stored and retained entirely by GateKeep, in the console's out-of-jurisdiction configuration store. The firm keeps no independent copy and no parallel record, so it cannot verify the log, detect a change to what is logged, or reconstruct a period if retention is shortened or access is withdrawn. In aggregate the log is itself sensitive: it shows which matters are active, for which clients, by whom and at what tempo. Unlike the gateway service, which could be rebuilt elsewhere with effort, a lost or altered history of past events cannot be recreated by any replacement vendor.
Rating HIGH. The firm's own compliance evidence is held and controlled by the party it is meant to hold accountable, and it is not recoverable if it is changed, truncated or cut off.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/CR:M/IR:H/AR:H/S:N/AU:Y/R:I/V:C/RE:H/U:Amber Score 7.5 (High)
Ask the vendor Does this turn our documents into some kind of derived file (an “embedding”) so it can search them faster? · If so, who stores that derived file, you, or a completely different company? · Do you keep a copy of everything the AI said back to us, a log of how we used it, or a record of when we said the answer was wrong?
Metric Value Prior Source Rationale AV Access Path A N agent · override Override N → A. For the primary (control-plane) dependency, vendor-direct network access is right. But the derivative assessed here — GateKeep's audit log and routing telemetry — physically resides in the hosted console and its configuration store, which the firm discovered is hosted in a jurisdiction different from the one it chose for inference, a fact visible only on GateKeep's subprocessor list. Reach to the log record is therefore mediated by a hosting subprocessor (and that subprocessor's legal regime), not solely by the contracted vendor's own API: the rubric defines the exploitability actor as 'the vendor itself, a subprocessor, or a government/legal party compelling access', and 'A = Adjacent -- subprocessor-mediated access' fits a log store sitting in subprocessor-operated infrastructure outside the elected residency. Confidence is moderate because the scenario does not state whether GateKeep operates the store itself on leased infrastructure or the subprocessor operates it. AC Compulsion Complexity L L agent Confirm L. There is no technical or contractual barrier protecting the telemetry derivative: the firm holds no customer-managed keys over the log store (GateKeep holds every provider API key and generates the logs itself), and the data-residency choice the firm made applies to inference only — the console and configuration store, where the audit log and routing telemetry live, sit in a different jurisdiction with no carve-out. Access, retention change or disclosure therefore requires nothing beyond standard terms of service or routine legal process in the hosting jurisdiction. This matches provider practice documented for system-generated logs, where retention periods, scrubbing and access are set unilaterally by the provider for its own operational purposes, and the EU AI Act's framing of automatically generated logs as kept by the provider 'to the extent such logs are under their control'. AT Trigger Conditions N N agent Confirm N. No triggering event is needed. Telemetry and audit records are written continuously as a by-product of operation and are retained under provider-set retention policy, so the vendor (or its hosting subprocessor) is in a position to read, re-scope, truncate or alter them at any moment. The scenario's demonstrated pattern — console behaviour and default policies changed for all customers at once, twice in a year, with notice published only on the day of change — shows the vendor exercises standing discretion over console-side behaviour rather than acting only on sanctions, litigation hold or incident. Provider-side log retention and scrubbing being a standing provider decision is corroborated by the EU Data Boundary log-handling description and EU AI Act Art. 19. PR Position Required N L agent · override Override L → N. The questionnaire's 'only the primary vendor' answer is about the gateway control plane. For this derivative, standing is broader: the audit log and routing telemetry are stored in the console/configuration store hosted outside the elected inference jurisdiction by an entity appearing on GateKeep's subprocessor list, so any party already in that subprocessor chain — the infrastructure host, and legal authorities with jurisdiction over it — has sufficient position to reach the records without being the contracted vendor. The rubric's definition of N ('any party already in the subprocessor chain has sufficient standing') and its explicit inclusion of subprocessors and compelling legal parties as actors support this. Moderate confidence, as the exact division of operational access between GateKeep and its host is not stated. UI Org Action Required P N agent · override Override N → P. The rubric designates UI as the primary exploitability metric for node 3.5 precisely because usage telemetry is created by use itself: every generative-AI request in the firm passes through GateKeep, is routed, DLP-screened and written to the audit log, so the exposure accrues through 'routine, ordinary use of the service' with no affirmative firm action and no discrete vendor act required to bring it into being. That passive accrual is what makes the supplemental V finding bite — each event is low-value, but the aggregate (per-matter, per-practice-group usage metadata for a 900-person law firm) is itself client-confidential. ATLAS AML.M0024/AML.T0114 likewise treat AI-service and gateway telemetry as an automatic by-product of normal service traffic, and provider log documentation confirms such logs are generated by user interaction with the service. P rather than N: the vendor's unilateral capability is scored under AT (standing discretion) and under the integrity/availability impact axes, whereas the mechanism that puts the derivative in the vendor's hands is the firm's own ordinary traffic. VC Primary Dependency Impact -- Confidentiality H L agent · override Override of the questionnaire's 'L'. The prior describes the primary dependency (hosted console/config store), where confidentiality loss is partial. For dimension 3.5 the asset is the gateway's audit log and routing telemetry itself, and the vendor's access to that asset is total, not partial: all generative-AI traffic for a 900-person firm passes through GateKeep, which generates and retains the complete record (user, timestamp, provider routed to, plus DLP hit records that capture the very client-content fragments that tripped a rule). The rubric for 3.5 assigns the per-event diffuseness to the supplemental metric V ('diffuse per-event, concentrated in aggregate'), so VC must score the aggregate, not the single event; for a professional-services firm the aggregate (which matters are active, for which clients, at what tempo) is itself the client-confidentiality fact. Exposure requires no action by the firm, is available under standard ToS or routine legal process, and the log/config estate sits in a jurisdiction the firm did not choose and learned of only via subprocessor review. Microsoft's EU Data Boundary documentation confirms that system-generated logs of this type necessarily contain person-identifying fields and that access/retention scope is set provider-side. VI Primary Dependency Impact -- Integrity H H agent Confirmed. The firm relies on this log as the evidentiary basis for client-confidentiality assurances, but GateKeep controls what is logged, its schema, and its retention, and has twice changed console behaviour and default policies for all customers simultaneously with release notes published only on the day the change took effect. Because the firm keeps no offline copy of routing/policy configuration and has no independent telemetry stream, a changed DLP or logging default silently and materially changes the record with no means of reconciliation or detection ('behaviour can be changed silently and materially'). EU AI Act Art. 19 and Art. 26(6) bind log-keeping duties only 'to the extent such logs are under [the party's] control', which is precisely the integrity gap here: the record the firm is accountable for is not the record it controls. Near-total loss of trustworthiness of the derivative. VA Primary Dependency Impact -- Availability H H agent Confirmed. Availability of the telemetry derivative means the firm's ability to generate, hold and query it, and all three are vendor-controlled: the questionnaire records a standing unilateral right under which 'the capability can be removed outright', and the Microsoft EU Data Boundary material shows that retention windows and log scrubbing are provider prerogatives even at vendors with published boundary commitments. Console unavailability removes log access and export for every AI workload at once, and a shortened retention window or terminated access destroys history irrecoverably: unlike inference capacity, which the firm could re-contract with migration effort, a missing audit period cannot be reconstituted because the gateway is the sole choke point and no parallel log stream exists. Single-tenant-independent, all-customers-at-once exercise is possible per the questionnaire. SC Downstream Blast-Radius Impact -- Confidentiality L L agent Confirmed. The telemetry/audit-log derivative does propagate beyond GateKeep itself: the console and configuration store (and hence the log and routing telemetry plane) sit in a different jurisdiction from the chosen inference region, on a subprocessor list the firm only discovered on review, and routing metadata is necessarily shared with the three fronted model providers. Parties the firm never contracted with can therefore see per-matter usage metadata, and such logs are held to contain personal/identifying data even when nominally 'system-generated' (Microsoft EU Data Boundary discussion of system-generated logs: usage data that identifies or can identify persons, only pseudonymised, not anonymised). The exposure is nonetheless indirect: what leaks downstream is metadata, aggregates and routing records rather than matter content or client documents, which matches the questionnaire's 'Partial' answer for confidentiality beyond the dependency and the rubric's characterisation of 3.5 as 'diffuse per event, concentrated in aggregate'. Partial, not total loss on this axis => L. SI Downstream Blast-Radius Impact -- Integrity L H agent · override Override of the questionnaire's H. The H prior reflects the primary dependency (the gateway/console silently altering routing, policies and completions - dimensions 3.3 and 6.4, where the rubric does mark subsequent integrity relevant). For dimension 3.5 the rubric explicitly records 'subsequent_impact_relevant: false', with the finding carried by VC and the supplemental V (value density) hook. Assessed on its own terms, corrupted, pruned or silently re-scoped audit/telemetry records do propagate: the firm's client-confidentiality assurances, internal policy-enforcement reviews and any downstream compliance reporting are built on records whose integrity and retention the vendor controls unilaterally and whose changes are disclosed only on the day they take effect, so false assurances could be issued undetected (cf. EU AI Act Arts. 12/19 - deployer log-keeping only 'to the extent such logs are under their control'; NYDFS 23 NYCRR 500.6 requiring audit trails reconstructible for five years). But no downstream production system or client deliverable executes on log data; the corruption affects assurance and evidentiary artefacts, not matter work or automated decisions. That is partial, not near-total, downstream integrity loss => L. SA Downstream Blast-Radius Impact -- Availability L H agent · override Override of the questionnaire's H ('downstream workloads stop'). That answer correctly describes the console/gateway control plane (rubric 6.3/6.4: 'a gateway outage takes down access to the underlying service'), not the telemetry derivative assessed here. If logging or log access is withdrawn or degraded, inference itself keeps flowing through GateKeep; what stops is the firm's ability to evidence its client-confidentiality undertakings and to meet retention expectations for AI usage records (EU AI Act Art. 19 minimum six-month retention of logs 'to the extent such logs are under their control'; NYDFS 500.6(b) five-year audit-trail retention), which for a 900-person professional-services firm can force voluntary suspension of AI use on confidentiality-sensitive matters and cannot be reconstituted from an offline copy the firm does not hold. That is a real but partial downstream availability loss => L. Not S: no physical or safety-relevant failure path exists in this scenario. E Precedent Maturity P P agent Confirmed at Proof-of-Concept. The control in question for dimension 3.5 is a vendor's ability to read, alter, re-scope the retention of, or withhold the gateway's audit log and routing telemetry — the record Halden & Marsh relies on for client-confidentiality assurances. Evidence for the *mechanism* is strong but evidence of it being *exercised against telemetry/audit logs at comparable firms* is not documented in the corpus: (1) the rubric itself records dimension 3.5 as gap_severity High with the only existing standard being 'NIST IR 8596 (preliminary, inventory recommendation only)' (sovereignty_cvss_rubric_1.json) — i.e. the field has an inventory recommendation, not a body of documented exercise cases; (2) MITRE ATLAS treats AI telemetry only as a defensive mitigation (AML.M0024, cited by AML.T0114/T0085/T0051) and its log-related incident, AML.CS0030 'LLM Jacking', concerns adversarial credential abuse observed *in* CloudTrail logs, not a provider exercising control over a customer's audit record — so no ATLAS *Incident* case study supports E:A for this dimension (per atlas/README.md, only Incident/Realized entries give documentary grounds for E:A); (3) provider-side handling of system-generated logs is documented as a standing, provider-governed capability — Microsoft's EU Data Boundary paper states retention periods are set by the provider, that provider personnel access these logs for service operations, and that such logs contain personal data — which demonstrates the capability and its routine use, but as vendor-defined practice rather than a reported loss-of-control incident against a client-confidentiality audit trail. The scenario's own facts sit at the same level: GateKeep has twice changed console behaviour and default policies for all customers with same-day release notes, which is a demonstrated exercise of unilateral change at the control plane (3.3/6.4), but there is no indication it has yet touched the audit log's content, integrity or retention. Note the boundary: if compelled legal process is counted, E:A would be arguable, since 18 U.S.C. §2713 obliges a provider to 'preserve, backup, or disclose ... any record or other information pertaining to a customer or subscriber' regardless of storage location, and the DOJ CLOUD Act white paper documents such orders actually being issued and litigated (Microsoft Ireland) — aggravated here because the console/configuration store, and therefore plausibly the log store, sits in a different jurisdiction from the chosen inference region. I keep P rather than A because that statutory route establishes standing and reachability (AV/PR/UI) rather than documented exercise against this specific derivative, and because the firm itself reports the control as demonstrated in research/incident reports but not confirmed against its stack. Confidence is moderate: this is a genuine A/P boundary call. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence N N agent Confirming the prior, though narrowly. Loss of control over the gateway's audit log and routing telemetry degrades the firm's *accountability evidence* rather than itself constituting a reportable event: the EU AI Act log-retention duties (Arts. 19, 26(6)) bite only 'to the extent such logs are under [the operator's] control', and a law firm using a gateway is in any case unlikely to be a high-risk deployer. The cross-border element is real — the Microsoft EU Data Boundary material confirms system-generated usage logs normally contain personal data, and GateKeep's console/config store sits outside the firm's chosen inference jurisdiction — but that transfer is disclosed on the subprocessor list and would be papered by the Art. 28 processor terms, so it is a diligence/transfer-assessment finding rather than an independent Art. 28 or Chapter V violation triggered by the compromise. Confidence is held low because a vendor-side disclosure of per-matter usage metadata under third-country legal process would convert this to Present (reportable personal-data breach plus professional-secrecy exposure). AU Silent/Automatic Trigger Y Y agent Confirmed. The scenario states GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year'. Log schema, retention and routing-telemetry handling are properties of that same multi-tenant console, so a change to what is logged, how long it is kept, or where it is stored propagates fleet-wide with no per-customer decision and no action by the firm (questionnaire: 'the vendor or subprocessor can act unilaterally'). The Microsoft EU Data Boundary material reinforces that system-generated logs are governed by the provider's own operational regime, not per-customer configuration. R Portability / Exit Recovery I U agent · override Overriding U to I for this derivative specifically. The questionnaire's 'manual migration' answer describes the gateway *capability* (routing, policy, DLP), which can indeed be rebuilt elsewhere. But the asset this dimension concerns is the accumulated audit log the firm relies on for client-confidentiality assurances, and a historical event record is not reconstitutable by any successor vendor: no competing gateway can regenerate last year's per-matter routing and policy-enforcement events. The scenario confirms the firm holds no offline copy of its gateway state and mentions no log export, and the EU AI Act framing ('to the extent such logs are under their control') underscores that custody, not capability, is the binding constraint. The rubric also flags this family as a High gap with no portability standard. Forward-going logging would be recoverable with manual effort (U); the existing evidentiary record would not, which is what drives the value. V Blast-Radius Concentration C C agent Confirmed, and this is the metric the rubric itself nominates as dimension 3.5's supplemental hook with the gloss 'diffuse per-event, concentrated in aggregate'. Halden & Marsh routes *all* generative-AI usage for 900 people through one gateway fronting three providers, so a single vendor-side store aggregates every prompt event, routing decision and DLP verdict across every workload. Any one log line is low-value metadata; the aggregate is a per-matter map of the firm's client work and is the sole artefact underwriting its confidentiality assurances — the textbook concentrated case, sitting on a shared control plane rather than a narrow workload. RE Exit / Mitigation Effort H H agent Confirmed. Removing the exposure means ending the vendor's custody of the telemetry, which cannot be done without replacing the gateway itself: the scenario states rebuilding routing and policy configuration on another gateway 'would take a significant project', and the firm has no offline copy to migrate from. Re-contracting would also be needed to pin log location, retention and integrity, and the Microsoft EU Data Boundary precedent shows providers treat system-generated logs and configuration data as outside ordinary customer-data commitments, so a purely contractual fix is not trivial. Confidence is moderated because a partial mitigation — streaming a copy of the audit log to firm-controlled storage — would be Moderate effort if GateKeep offers export; that would reduce integrity/retention risk but not the vendor's own out-of-jurisdiction copy. U Vendor Notice Posture Amber Amber agent Confirmed. GateKeep made two fleet-wide changes in the last year with 'release notes published on the day of change' — disclosure concurrent with effect, not in advance, and with no contractual guarantee of a notice period. The firm learned of the console/config-store jurisdiction only by reading the subprocessor list rather than through a notification, which points toward Red; Amber is retained because the information was in fact published and the release-note practice is consistent and same-day rather than absent. - HIGH9.0
4 Who's deciding what the AI sees and does?
4.4 Guardrail / safety filter layer · also 4.2GateKeep's filtering layer inspects every prompt and every completion in full, before the firm's own logging sees it, which is how the firm's data-loss-prevention and usage rules are enforced. That means the single point with complete visibility of client-confidential content is vendor-operated, administered from a console in another jurisdiction, and reachable under ordinary terms of service. GateKeep can change the default policies behind that layer for all customers at once without the firm acting or agreeing, as it has already done twice. If the rules are silently loosened, confidential content flows out un-redacted; if they are tightened too far, or the layer is unavailable, the firm has no fallback path because it holds none of the provider keys itself.
Rating HIGH. The control the firm points to as proof that client confidentiality is protected is owned, configured and changeable by the vendor, and the firm cannot independently confirm what it is doing.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:A/CR:M/IR:H/AR:H/S:P/AU:Y/R:U/V:C/RE:H/U:Amber Score 9.0 (Critical)
Ask the vendor Who decides which of our documents actually get shown to the AI when it answers a question? · Who runs the safety filter that sees every question and answer, and can we see its rules? · If the AI takes an action on our behalf, where does that action actually happen, in your systems, ours, or a third location?
Metric Value Prior Source Rationale AV Access Path N N agent The guardrail/DLP layer is not a separate appliance in Halden & Marsh's estate: it is a function of GateKeep's vendor-hosted gateway, which every prompt and output traverses in-line, and it is administered through GateKeep's hosted console and configuration store. Per the rubric, AV:N is 'Network -- vendor-direct API access, no intermediary' (sovereignty_cvss_rubric_1.json). The firm reaches the filter only over the vendor's service and the vendor reaches the firm's prompt/response content directly, with no customer-managed enclave in between, so N is confirmed. The fact that the console/config store sits in a third jurisdiction on a disclosed subprocessor was weighed as an argument for A, but the data path for the filter itself is vendor-direct, so A would understate exposure. AC Compulsion Complexity L L agent There is no technical or contractual barrier to overcome at this layer. GateKeep holds the API keys for all three providers itself, so there is no customer-held-key carve-out; the firm has no data-residency guarantee for the console/configuration tier (it is in a different jurisdiction than the chosen inference region); and GateKeep has already changed default policies for all customers twice in a year under its ordinary release process. That matches AC:L, 'a standard ToS clause or routine legal process suffices' (rubric). Prior confirmed. AT Trigger Conditions N N agent No triggering event is needed. The scenario records two fleet-wide changes to console behaviour, default policies and supported providers in the last year, announced only on the day of effect — i.e. a standing, at-will right exercised at vendor discretion. That is AT:N, 'control can be exercised at vendor discretion at any time' (rubric); AT:P would require a sanctions designation, litigation hold or incident, none of which gates a default-policy or filter-rule change. Prior confirmed. PR Position Required L L agent Changing default DLP/usage-policy behaviour for all customers at once is a capability of GateKeep as the primary contracted vendor and its console control plane — not something any arbitrary party in the chain can do, and not something that requires compromising Halden & Marsh's own admin credentials (the firm's administrators only author rules; the vendor owns their enforcement semantics). That is PR:L, 'requires being the primary contracted vendor' (rubric). Confidence is moderate rather than high because the console and configuration store are hosted by a disclosed subprocessor in a third jurisdiction, which gives a non-primary party latent read/alter standing over the policy configuration and is an argument for PR:N; on the evidence available the authoritative actor for filter behaviour remains GateKeep, so the prior is confirmed. UI Org Action Required N N agent This is the metric that carries dimension 4.4 here. No affirmative act by the firm is needed: GateKeep altered default policies and supported providers unilaterally twice, with release notes published the day the change took effect, so a guardrail can be weakened (under-blocking, confidentiality leakage past the firm's DLP rules) or tightened (over-blocking, availability loss) before the firm's own audit log reflects any change. That is UI:N, 'vendor/subprocessor can act unilaterally (silent model swap, ToS change...)' (rubric). UI:P would apply only if ordinary use were the trigger; here ordinary use is continuous and the change is vendor-initiated, so P understates it. Corpus support for the technical plausibility of silent safety-control modification is indirect (ATLAS AML.T0081 'modify or disable a configuration setting related to security controls', and AML.T0057 noting guardrails are the control that detects sensitive data/PII in outputs), i.e. the firm's confidentiality assurance depends entirely on a control whose configuration it does not own. Prior confirmed. VC Primary Dependency Impact -- Confidentiality H L agent · override OVERRIDE of the questionnaire's 'partial / metadata, fragments, aggregates'. That answer fits the primary dependency as the firm framed it (the hosted console and its configuration store, where vendor visibility is largely over config and routing metadata). Dimension 4.4 is a different access point: per the rubric/classifier definition, vendor-managed content filters 'see every prompt and output, often before the customer's own logging and monitoring does'. GateKeep applies the firm's DLP rules to every prompt and completion, which is only possible with full cleartext inspection of the content itself — and for a 900-person professional-services firm that content is client-confidential, potentially privileged material. DLP enforcement additionally implies matching, flagging and typically retaining/quarantining the very excerpts that are most sensitive, and the console/configuration store sits in a jurisdiction other than the one chosen for inference, so this inspection point is also the firm's weakest jurisdictional link (cf. 18 USC 2523 / CLOUD Act routine-legal-process exposure for data held by a provider). Exposure here is therefore total or near-total on the confidentiality axis at this dependency, not partial. Corpus support is indirect: the ATLAS material confirms guardrails operate by inspecting full input/output content and detecting sensitive data and PII in model outputs (AML.M0020, AML.T0057), but the corpus contains no sovereignty-specific case study on guardrail-layer confidentiality, hence confidence below 0.9. VI Primary Dependency Impact -- Integrity H H agent CONFIRM High. The scenario states GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year with release notes published on the day of change', and the questionnaire records that behaviour 'can be changed silently and materially' with notification only at the time the change takes effect. At the guardrail layer this means the effective DLP and usage-policy ruleset — what is redacted, blocked, rewritten or allowed through — can be altered unilaterally and without prior notice, in either direction (silently weakened, so confidential content reaches providers; or silently tightened, so outputs are truncated/over-blocked). The same layer produces the audit log the firm relies on for its client-confidentiality assurances, so the integrity of the evidence of correct enforcement is controlled by the same party that can change enforcement. ATLAS treats modification or disabling of security-control configuration as a full integrity compromise of the agent/system (AML.T0081), and the rubric's analogous configuration/policy-management dimension (6.4) names VI as its primary impact axis. Total loss of integrity assurance at this dependency. VA Primary Dependency Impact -- Availability H H agent CONFIRM High. The filter layer is synchronous and in-line: every prompt and every output passes through it, so it is a hard availability chokepoint for all generative-AI usage at the firm. Two distinct full-loss paths exist. (1) Withdrawal/unavailability: the questionnaire records that the capability 'can be removed outright' at the vendor's discretion, and the scenario states that if the console or its configuration were unavailable or altered, 'every AI workload in the firm would be affected simultaneously', with no offline copy of the routing and policy configuration. (2) Over-blocking: a unilaterally changed default policy that is too aggressive renders the service functionally unusable even while technically 'up' — the guardrail layer's characteristic failure mode, since guardrails are designed to refuse and block (AML.M0020/M0021). The rubric's gateway dimension (6.3) likewise notes that 'a gateway outage takes down access to the underlying service'. Rated H rather than L because there is no bypass path: the firm holds no provider keys of its own (GateKeep holds the API keys for all three providers), so there is no degraded-but-working mode. SC Downstream Blast-Radius Impact -- Confidentiality L L agent Confirming the prior. The guardrail/DLP layer inside GateKeep is the point where the firm's confidentiality controls are applied before anything reaches the three model providers or the firm's own audit log. If the vendor silently relaxes default policies (it has changed defaults for all customers twice in a year, with same-day release notes), client-confidential fragments that the firm believes were redacted flow onward to downstream parties — the three providers and GateKeep's own configuration/filter infrastructure hosted in a different jurisdiction than the chosen inference region. That is real but partial propagation: the downstream providers already receive prompts under contract, so what is additionally lost is fragments, metadata and un-redacted snippets rather than a bulk corpus. The questionnaire likewise reports downstream confidentiality loss as 'Partial'. The rubric notes that for dimension 4.4 the primary impact axis is VC and subsequent impact is generally not the carrying axis (sovereignty_cvss_rubric_1.json, dimension 4.4 entry), so L rather than H. SI Downstream Blast-Radius Impact -- Integrity H H agent Confirming the prior, with the caveat that the rubric marks subsequent impact as not the usual carrier for 4.4. The guardrail layer sits upstream of the firm's own logging, so a vendor-side change to default filter/DLP policy alters what every downstream consumer receives — lawyer work product, client deliverables and, critically, the audit log the firm relies on for client-confidentiality assurances — with no independent means of detecting the change (notification only 'at the time the change takes effect'; no offline copy of policy configuration). The questionnaire states downstream systems act on altered outputs without detection, and the scenario states every AI workload is affected simultaneously because this is a shared control plane. Silent, undetectable alteration of the content and of the compliance record that attests to it is a near-total integrity loss on the downstream side, so H. Confidence is moderate because part of this effect is properly attributed to the routing/orchestration logic (4.2) and the hosted console (control plane) rather than the filter layer alone. SA Downstream Blast-Radius Impact -- Availability L H agent · override Overriding the prior H down to L for this category. The questionnaire's 'downstream workloads stop' outcome is driven by the hosted console and configuration store becoming unavailable — i.e. the gateway/control-plane dimensions — whereas the exposure being scored here is the guardrail/safety filter layer, whose characteristic failure mode is a policy change that over-blocks or mis-classifies a class of prompts and outputs. That degrades downstream workflows selectively (certain matter types, document classes or providers blocked) rather than removing the capability outright, which is partial downstream availability loss. The rubric records dimension 4.4 as having subsequent impact not relevant and the finding carried by VC plus the supplemental Safety/Regulatory hook, supporting a conservative value here rather than near-total loss (sovereignty_cvss_rubric_1.json, dimension 4.4). 'S' is not applicable: Halden & Marsh is a professional-services firm with no physical or safety-relevant process depending on these outputs, and the questionnaire reports no one could be harmed. E Precedent Maturity A P agent · override Override of the questionnaire's P. The prior ("demonstrated in research or incident reports, not confirmed against our stack") was answered about the primary dependency (the hosted console / control plane), but for dimension 4.4 the scenario records the control having actually been exercised against this very firm: GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year with release notes published on the day of change.' Default policies are precisely the DLP/usage-policy guardrail layer that dimension 4.4 covers ('vendor-managed content filters that see every prompt and output... a distinct, usually invisible, data-access point'), so these two realized fleet-wide changes are documented real-world exercises of exactly this control, not merely a demonstrated possibility — the rubric's definition of A ('documented real-world cases of this control being exercised against comparable orgs', sovereignty_cvss_rubric_1.json threat.E). Same-day release notes mean the firm learned after the fact, which is the silent weaken/over-block mode the dimension flags. Corroborating, the corpus shows guardrail layers being materially exercised/defeated in confirmed incidents against comparable cloud-AI customers (ATLAS AML.CS0057 Storm-2139 Azure OpenAI Guardrail Bypass, Incident 2024-12-01, referenced from AML.T0012), so even absent the firm's own history this dimension would sit at the upper end of precedent maturity. Confidence is not higher because the published release notes do not state that the two changes altered filter strictness specifically rather than other console behaviour. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence P N agent · override OVERRIDE of the questionnaire's 'N'. The prior was given for the primary dependency (the gateway/control plane as a whole); this dimension is specifically the layer that applies the firm's DLP rules and usage policies to every prompt and output, and the rubric explicitly designates S as the supplemental hook that carries dimension 4.4. For a 900-person professional-services firm, GateKeep's filter layer *is* the mechanism by which it discharges client-confidentiality and data-protection obligations: the scenario states the firm relies on it (plus its audit log) for client-confidentiality assurances. Two independent regulatory triggers follow from a compromise or silent change at this layer alone: (a) the guardrail/DLP inspection and its configuration store sit in a jurisdiction other than the one the firm chose for inference, discovered only via the subprocessor list — i.e. processing of all prompt/output content by a processor outside the authorised location, which is squarely the GDPR Art. 28(2)-(3) authorisation/instruction and Art. 44 transfer problem the rubric names as the exemplar of S=P, and a jurisdiction whose routine legal process can reach that content (DOJ CLOUD Act white paper); (b) a vendor-side weakening of default policies silently disables the filter that ATLAS treats as the control preventing PII/secret disclosure in outputs (AML.M0020), so privileged client material reaches three model providers unfiltered — a reportable confidentiality/personal-data breach rather than a mere service-quality issue. Confidence is moderate because the scenario does not state the firm's regulatory regime explicitly; it is inferred from the client-confidentiality assurance role and the cross-jurisdiction subprocessor finding. AU Silent/Automatic Trigger Y Y agent CONFIRMED. The scenario states GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year'. A change to default guardrail/DLP policy is therefore a fleet-wide, no-case-by-case-decision event; the questionnaire likewise records that the vendor can act unilaterally with no action by the firm and that the loss event could hit all customers simultaneously. This matches the rubric's AU=Y definition exactly, and is the mechanism the classifier identified for this dimension (UI-driven silent weakening or over-blocking). R Portability / Exit Recovery U U agent CONFIRMED. The guardrail/DLP ruleset is the firm's own policy content, so it is reconstitutable on another gateway or self-hosted filter stack — not vendor-unique model weights, so not Irrecoverable. But recovery is not automatic: the firm holds no offline copy of its routing and policy configuration, so the policy set would have to be re-authored from scratch, re-tested against three providers and re-integrated, and the scenario calls rebuilding with another gateway 'a significant project'. That is the rubric's R=U ('manual migration effort required'). No corpus passage covered gateway portability specifically, so this rests on the scenario text. V Blast-Radius Concentration C C agent CONFIRMED. The filter layer is inline on every prompt and every output of every generative-AI workload in the firm — 'all of its generative-AI usage' is routed through GateKeep, fronting three providers — and the scenario states that if the console or its configuration were altered, every AI workload would be affected simultaneously. This is precisely the rubric's V=C archetype ('critical path for many/all AI workloads, e.g. a shared control plane'), and the questionnaire independently records 'many or all: shared control plane, gateway'. RE Exit / Mitigation Effort H H agent CONFIRMED. Mitigating exposure at this layer cannot be done contractually or by a trivial swap: the firm would have to re-architect its inspection path (replace or front the vendor filter with a customer-controlled DLP/guardrail stage), re-author policy without an offline configuration baseline, re-home the configuration store into the chosen jurisdiction, take custody of and rotate the API keys for three providers, and re-contract with GateKeep or a successor. The rubric reserves RE=H for exactly this 're-architecture, re-contracting' class of remediation, and the rubric notes no existing standard covers dimension 4.4, so no off-the-shelf assurance route shortens the work. U Vendor Notice Posture Amber Amber agent CONFIRMED. Observed behaviour, not just contractual posture: GateKeep changed console behaviour and default policies twice in the last year 'with release notes published on the day of change'. Disclosure is therefore concurrent with the change taking effect — the rubric's Amber. Not Green or Clear, since there is no advance window and no contractually guaranteed notice (the questionnaire records the vendor's right as standing and at-will, and the different-jurisdiction hosting of the console was not proactively disclosed at all but found by the firm in the subprocessor list). Not Red, because changes are in fact published rather than never disclosed. - HIGH7.4
5 Which humans are actually looking at our stuff?
5.3 Support / debugging accessNo human review, annotation or labelling of the firm's content by vendor staff is described, so this is the narrowest of the seven exposures. What remains is routine support and troubleshooting access: GateKeep's own engineers can reach the hosted console, the configuration store that holds the API keys for all three providers, and the audit and trace logs, under nothing more than standard terms of service. There is no access-approval gate, no per-request justification requirement and no screened-personnel commitment described, so such access does not depend on the firm raising a ticket. The scenario does not state that this access actually occurs or how often, so this finding reflects an unconstrained possibility rather than an observed practice.
Rating HIGH. Vendor support staff can, if they choose, read the firm's provider credentials and its complete AI usage record without asking, and the firm would have no record that they did.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N/E:P/CR:M/IR:H/AR:H/S:N/AU:N/R:U/V:C/RE:M/U:Amber Score 7.4 (High)
Ask the vendor Does a real person at your company, or a contractor of yours, ever read our conversations or our data? · If a conversation gets flagged, does it go somewhere else to be reviewed or labeled? · When your support engineers debug a problem for us, what can they see?
Metric Value Prior Source Rationale AV Access Path N N agent Confirms prior. The residual 5.3 path is GateKeep's own support/engineering staff reaching GateKeep's hosted console, configuration store and audit/trace logs. These are vendor-operated SaaS components reached over the network with no intermediary standing between GateKeep and the data — the rubric's 'N = Network -- vendor-direct API access, no intermediary'. Nothing is resident in a firm-managed environment (no offline copy of routing/policy config exists), so L and P are excluded. A ('subprocessor-mediated') was considered because the console and configuration store are hosted in a different jurisdiction per GateKeep's subprocessor list, but for support/debugging access the reach is the vendor's own, not mediated by the subprocessor; the subprocessor hosting is an argument affecting PR/jurisdictional compulsion rather than the access path itself. AC Compulsion Complexity L L agent Confirms prior, and AC is one of the two metrics the rubric flags as carrying dimension 5.3. No barrier of the type the rubric requires for H exists: GateKeep holds the API keys for all three providers (no customer-managed keys), the firm's chosen inference residency is not mirrored by the console/config-store hosting (so no effective data-residency carve-out), and the firm holds no offline configuration copy. The scenario and questionnaire state that access requires 'nothing beyond its standard terms of service or routine legal process'. Google's sovereign-controls documentation shows that constraining support access (data-access controls, screened personnel, Access Approval with per-request justification and programmatic blocking) is an explicit add-on control set; absent any such commitment from GateKeep, ordinary support terms suffice — Low. AT Trigger Conditions N N agent Confirms prior, with explicit uncertainty. The firm has no Access Approval / access-transparency gate described, so support reach into the console and audit logs is a standing capability exercisable at GateKeep's discretion rather than one conditioned on a designated external event (sanctions, litigation hold). The contrast case in the corpus — where 'administrative access to customer data and workloads is ... permitted only under predefined conditions' — is a purchased control the scenario does not mention. P was genuinely plausible, since real support access is often ticket- or incident-gated; the scenario is silent on whether such access occurs at all (the classifier notes this is a low-confidence residual path), so confidence is held at 0.5. PR Position Required L L agent Confirms prior; PR is the rubric's primary exploitability metric for 5.3. The party with standing to use the support/debugging path is GateKeep itself — the primary contracted vendor whose engineers administer the hosted console and configuration store. That is precisely 'L = requires being the primary contracted vendor'. H is wrong: no compromise of Halden & Marsh's own admin credentials is needed, since GateKeep operates the console. N was weighed seriously, because the console and configuration store sit with a hosting subprocessor in a third jurisdiction (discovered via the subprocessor list), which gives that subprocessor and its local authorities positional reach over config and audit data at rest; the questionnaire however states only the primary vendor is positioned to exercise this control, and the scenario does not establish that subprocessor personnel have operational access to console internals. Kept at L; a reviewer who treats the out-of-jurisdiction hosting subprocessor as having standing should read this as N. UI Org Action Required N N agent Confirms prior. Support/debugging reach into the hosted console, configuration store and audit/trace logs requires no affirmative act by the firm and no customer-raised ticket as a precondition: with no access-approval or request-justification mechanism in place, GateKeep can view or alter configuration unilaterally — consistent with its demonstrated ability to change console behaviour, default policies and supported providers for all customers at once with same-day release notes. P was considered (the firm's routine use of the console is what places policy config, DLP rules and audit logs in the vendor's environment), but the rubric reserves P for exposures that ordinary use *triggers*, whereas here the vendor's own action is sufficient. A is excluded outright. VC Primary Dependency Impact -- Confidentiality H L agent · override Override L -> H. The rubric makes VC the sole primary impact axis for node 5.3, so the question is how much confidentiality is lost at exactly the artifacts a support/debugging session reaches: GateKeep's hosted console, its configuration store and the audit/trace logs. Per the scenario, that configuration store 'holds the API keys for every provider' and encodes the firm's DLP rules and routing policy, and the audit log is the very record 'the firm relies on for client-confidentiality assurances' for a 900-person professional-services firm. ATLAS AML.T0083 / AML.T0002.002 establish that configuration holdings of exactly this shape (API keys, tokens, policy/system-prompt material) constitute total credential compromise rather than fragmentary exposure, and Microsoft's EU Data Boundary discussion of system-generated logs confirms such logs record the type, content and time of transactions and identify persons. Access under 'nothing beyond its standard terms of service' with no access-justification or access-approval gate (contrast Google Cloud Sovereign Controls, where technical support access is explicitly limited by data-access controls and logged/approved) means a GateKeep engineer sees the complete secret material and the complete usage record. The questionnaire's 'partial (metadata, fragments, aggregates)' answer was given for the gateway as a whole, where prompt content merely transits; it understates the support path, where the credential and audit corpus is read in full. Confidence held at moderate because the scenario does not state that support access actually occurs or that trace logs retain prompt bodies. VI Primary Dependency Impact -- Integrity L H agent · override Override H -> L. The prior 'behaviour can be changed silently and materially' describes GateKeep's product-level standing right to 'change console behaviour, default policies and supported providers for all customers at once' - that is the Control Plane exposure the rubric assigns to nodes 6.1 (admin console) and 6.2 (VI primary axis), not the support/debugging path, for which the rubric lists only VC as a primary impact axis. Residual integrity loss on this path is real but partial: an engineer troubleshooting in the console inherently holds write capability over routing rules, policies and key rotation, and could alter or prune entries in the audit log the firm treats as its confidentiality evidence, but such changes are incidental to a support session rather than a wholesale silent redefinition of the service. L records that partial, undocumented-change exposure without double-counting the control-plane right. VA Primary Dependency Impact -- Availability L H agent · override Override H -> L. The prior 'the capability can be removed outright' is the vendor's contractual power to withdraw or degrade the gateway, which the rubric locates at nodes 6.1/6.3 ('a gateway outage takes down access'); node 5.3 does not carry availability as a primary impact axis and is marked subsequent_impact_relevant: false. Support/debugging access is not a mechanism for withdrawing the capability. However it is not zero either: because the firm keeps no offline copy of its routing and policy configuration and every AI workload depends on this one console, an erroneous or disruptive change made during a vendor support session is a plausible partial availability event at the dependency. L is therefore the defensible value; N would assert no availability consequence at all from console-level support access, which the scenario's own 'if the console were unavailable or its configuration altered, every AI workload... would be affected simultaneously' contradicts. SC Downstream Blast-Radius Impact -- Confidentiality L L agent Confirmed at L. Support/debugging access reaches the hosted console, configuration store and audit/trace logs; for a 900-person professional-services firm those artefacts carry client-matter content and the audit trail the firm relies on for client-confidentiality assurances, so exposure lands partly on parties beyond the gateway itself (the firm's clients and the three fronted model providers' key/routing metadata). The rubric marks 5.3's primary impact axis as VC and subsequent impact as not relevant, and comparable vendor disclosures describe support/operational log access as bounded by data-access controls, pseudonymisation, minimisation and purpose limitation (Google Sovereign Controls: 'Technical support access is limited by underlying data access controls'; Microsoft EU Data Boundary on system-generated logs). That makes downstream loss partial/indirect, not total — L, not H. Low confidence: the scenario never states that support access is actually exercised. SI Downstream Blast-Radius Impact -- Integrity L H agent · override Override H -> L. The questionnaire's 'downstream systems act on altered outputs without detection' describes GateKeep's standing contractual right to change console behaviour and default policies for all customers at once — which the rubric scores under the control-plane dimensions it flags as subsequent-impact-relevant (6.1 admin console, 6.4 configuration and policy management), not under 5.3, where 'subsequent_impact_relevant' is false and the only primary axis is VC. The residual 5.3 path is engineer read/troubleshoot access; because any support-side touch of routing or DLP configuration would be inherited by every AI workload in the firm, some undetected downstream integrity effect is plausible, but it is incidental, case-by-case and bounded by vendor access controls and logging rather than a silent, all-customer behaviour change. Partial, not total: L. Low confidence given no evidence that write-capable support access exists or is used. SA Downstream Blast-Radius Impact -- Availability N H agent · override Override H -> N. The 'every AI workload affected simultaneously / capability removed outright' availability loss in the scenario and questionnaire is a control-plane and gateway-outage exposure, which the rubric routes to 6.1 ('a console compromise or outage affects every downstream AI workload') and 6.3 ('a gateway outage takes down access to the underlying service -- Subsequent Availability'). Support/debugging access confers visibility and assistance, not the ability to withdraw or degrade the capability, and the rubric sets subsequent impact as not relevant for 5.3; on this path alone no downstream capability is removed. S (Safety) is also excluded: the questionnaire states only that 'downstream workloads stop' with no physical or safety-relevant harm in a professional-services context. E Precedent Maturity P P agent Confirming the questionnaire prior. The scenario gives GateKeep a standing, low-barrier route to firm-side data for support/debugging purposes (hosted console, configuration store and the audit log the firm relies on for client-confidentiality assurances, reachable under 'nothing beyond its standard terms of service or routine legal process'), but it never states that such access has actually been exercised against this firm or against comparable professional-services firms. Under CASE's documented mapping convention (ATLAS README: Incident -> E:A, Exercise/Demonstrated -> E:P, Feasible -> E:U), E:A would require an Incident-type precedent for this specific control path, and none was retrieved. What the corpus does supply is Exercise-type demonstrations of exactly this access path: AML.CS0060, where the target of value is a human support agent's console session and the resulting ability to view customer conversations, and AML.CS0039, where a support engineer's routine debugging workflow becomes the privileged route into customer data. Both are typed in-corpus as 'Exercise -> CASE Precedent Maturity E:P'. The provider-side compromise incidents that were retrieved (AML.CS0068, AML.CS0023, AML.CS0069) are adversarial intrusions into provider infrastructure rather than the contractual/operational support-access path that dimension 5.3 covers, so they do not transfer as E:A precedent here. The two changes GateKeep made in the last year were product and default-policy changes (dimension 6.1 control-plane territory), not support access to firm data, so they do not lift this dimension's precedent either. P is therefore the correct value: demonstrated in research/incident reports, not confirmed against this org's own stack. Confidence is moderate rather than high because, as the classifier notes, the scenario does not affirmatively state that support or debugging access occurs at all. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence N N agent Confirms the questionnaire prior. Dimension 5.3's primary impact axis is confidentiality only (sovereignty_cvss_rubric_1.json, dimension 5.3: primary_impact_axis ['VC'], subsequent_impact_relevant false), and the rubric notes 'None identified' as an existing standard for this dimension — i.e. no regulatory instrument currently attaches a reportable obligation to vendor support/debugging access as such. The scenario describes no personal-data-specific processing, no high-risk AI Act use case and no stated DPA breach; GateKeep operating under 'standard terms of service or routine legal process' means support access would be contractually sanctioned processor activity rather than an independent reportable violation. Residual professional-secrecy exposure for a law firm exists (client confidentiality assurances rest on the audit log), but the scenario gives no basis for an automatic regulatory report, so N rather than P. AU Silent/Automatic Trigger N Y agent · override Override of the prior Y. The prior Y is correct for the primary dependency (GateKeep can change console behaviour, default policies and supported providers 'for all customers at once'), but this category's residual path is support/debugging access by GateKeep engineers reaching the hosted console, configuration store and audit/trace logs. Rubric AU requires that 'the sovereignty-loss event can occur simultaneously across all customers with no case-by-case decision'; support access is inherently per-ticket and per-tenant — an individual engineer opens a specific customer's console or logs, a 'discrete, case-by-case action'. Productised controls for this path (justification-bound access requests, access transparency/approval logging) are likewise per-request, confirming the per-case nature of the event. R Portability / Exit Recovery U U agent Confirms the prior. If the firm had to remove GateKeep engineers' reach by leaving the product, it can reconstitute gateway, policy, DLP and audit-log capability on another gateway, but only with manual effort: the firm has 'no offline copy of its routing and policy configuration and rebuilding it with another gateway would take a significant project', and the questionnaire states reconstitution is possible 'with manual migration effort'. That matches 'U -- User: manual migration effort required'; not A (loss of configuration and historical audit trail) and not I (nothing is uniquely vendor-held, three model providers remain reachable directly). V Blast-Radius Concentration C C agent Confirms the prior and holds for this category on its own facts. Support/debugging access at GateKeep reaches the single hosted console, configuration store and the audit log through which all firm generative-AI traffic is routed and policed; 'If the console were unavailable or its configuration altered, every AI workload in the firm would be affected simultaneously'. That is precisely the rubric's example of C -- Concentrated: 'dependency sits in the critical path for many/all AI workloads (e.g., shared control plane)'. RE Exit / Mitigation Effort M H agent · override Override of the prior H, which measures exiting the whole GateKeep dependency. Scoped to 5.3, the exposure is vendor personnel reachability, and the standard mitigations are contractual/configuration-level rather than architectural: access-transparency and access-approval style commitments (justified, logged, customer-blockable support access, support staff restricted by underlying data-access controls, as productised in sovereign-controls offerings), plus streaming audit logs to firm-controlled storage and keeping an offline copy of routing/policy configuration. These are re-contracting negotiations with a specialist vendor and an engineering change to log/config export — more than a trivial swap-out (so not L), but short of the re-architecture or infrastructure replacement that H requires. Lower confidence because the scenario does not state whether GateKeep offers such terms; if it refuses, the only remedy becomes full exit and H would apply. U Vendor Notice Posture Amber Amber agent Confirms the prior. The only observed notice behaviour is concurrent: GateKeep 'has done so twice in the last year with release notes published on the day of change', and the firm learned of the divergent console/configuration-store jurisdiction only by reviewing the subprocessor list itself, not by vendor notification. That matches Amber -- 'discloses concurrently with the change taking effect'. Not Red (disclosure does happen, in release notes), and not Green/Clear (no advance, let alone contractually guaranteed, notice). Note the limit of this evidence for 5.3 specifically: nothing in the scenario indicates GateKeep notifies the firm when support engineers access the console, configuration store or audit logs, which would argue toward Red for that sub-path; Amber is retained as the documented vendor-wide posture. - HIGH8.3
6 Who's holding the steering wheel?Headline
6.1 Centralized control plane / admin console · also 6.4, 6.3GateKeep's hosted console is the only place the firm can set routing, usage policy, data-loss-prevention rules and key rotation, and that console and its configuration store sit in a jurisdiction different from the one the firm chose for inference, a fact the firm found only by reading the subprocessor list. The firm's inference residency choice gives it no protection over the place where its controls are actually configured. GateKeep holds a standing right to change console behaviour and defaults for every customer simultaneously, exercised twice in the past year with same-day notice, so the settings the firm believes are in force can be redefined without warning. The firm holds no offline copy of its routing and policy configuration, so it cannot detect drift against a baseline, cannot restore a known-good state, and if the console were unavailable or altered every AI workload in the firm would stop or change at once; moving to another gateway is a project, not a failover.
Rating HIGH. The firm has no independent ability to configure, verify, restore or continue operating its AI controls if the vendor changes them or the console goes away.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:A/CR:M/IR:H/AR:H/S:N/AU:Y/R:U/V:C/RE:H/U:Amber Score 8.3 (High)
Ask the vendor Where does the screen we'd use to configure or turn off this AI feature actually live? · Is our employee login system, or our credentials to other systems, now tied into a system this vendor controls? · Can settings change on us without anyone telling us?
Metric Value Prior Source Rationale AV Access Path N N agent Confirmed. GateKeep's admin console and its configuration store run in the vendor's own cloud and are reached directly over the vendor's hosted interface/API — 'Network -- vendor-direct API access, no intermediary' per the rubric's Access Path definition. The vendor needs no intermediary to alter console behaviour, default policies or supported providers; it did so twice in the past year. The subprocessor list is what revealed the console's jurisdiction, but that hosting relationship is below the vendor, not an intermediary the vendor must traverse to exercise control, so 'A -- subprocessor-mediated' understates the directness of the path. 'L' and 'P' are excluded because nothing is resident in a firm-managed environment: the firm holds no offline copy of its routing and policy configuration. AV is also the rubric's designated primary exploitability metric for 6.1. AC Compulsion Complexity L L agent Confirmed. No technical or contractual barrier stands between GateKeep and the firm's control plane: GateKeep holds the API keys for every provider, hosts the configuration store, and can change console behaviour and default policies for all customers under its standard terms. There is no customer-managed key, no data-residency carve-out covering the console (the console sits in a different jurisdiction from the inference region the firm chose), and no offline configuration copy that would have to be overcome. That matches 'Low -- a standard ToS clause or routine legal process suffices'. Note that legal process in the console's own jurisdiction is also routine and unconstrained by the firm's inference-region commitment. AT Trigger Conditions N N agent Confirmed. The questionnaire records a standing contractual right exercisable at the vendor's discretion at any time, and the scenario corroborates it empirically: GateKeep changed console behaviour, default policies and supported providers for all customers twice in the last year, with no triggering event — release notes were simply published on the day of change. No sanctions designation, litigation hold or incident is a precondition, so 'None -- control can be exercised at vendor discretion at any time' rather than 'Present'. PR Position Required L L agent Confirmed. Exercising this control requires standing as the primary contracted vendor: it is GateKeep that owns the hosted console, the configuration store and the vendor-wide change rights. The rubric's 'N' would require that any party already in the subprocessor chain had sufficient standing, which is not established here — the subprocessor list discloses where the console is hosted, but the scenario attributes policy/provider change rights to GateKeep alone. 'H' is wrong because no compromise of the firm's own administrative credentials is needed; the vendor can change defaults and supported providers above the firm's admins. Confidence is moderated because the console's foreign hosting jurisdiction means a hosting subprocessor or its local authority is a plausible secondary route that the questionnaire did not explore. UI Org Action Required N N agent Confirmed. The firm takes no affirmative step for the exposure to materialise: GateKeep changes console behaviour and default policies 'for all customers at once', with disclosure only at the moment the change takes effect (Amber notice posture in the rubric's terms). This is the rubric's 'None -- vendor/subprocessor can act unilaterally (silent model swap, ToS change...)'. 'P' understates it because the exposure does not depend on the firm's routine use — an unavailable or altered console hits every workload regardless — and 'A' is excluded since there is no opt-in or update acceptance gate. VC Primary Dependency Impact -- Confidentiality L L agent CONFIRM L. The vulnerable system in 6.1 is the hosted console and its configuration store, not the inference path. What it holds is configuration-class and metadata-class material: routing rules, DLP policy, the firm's provider API keys and the audit log the firm cites for client-confidentiality assurance. That is real but partial exposure — client prompt/response content itself is processed in the chosen inference region, so a console-side confidentiality loss yields keys, policy structure and usage metadata rather than total loss of the firm's confidential matter. This matches the questionnaire's 'Partial: limited or indirect exposure (metadata, fragments, aggregates)'. It is not N: AML.CS0048 shows provider API keys and connected-service credentials being readable straight from a gateway/agent control interface, and the vendor needs 'nothing beyond its standard terms of service or routine legal process' to reach the store — which sits in a different jurisdiction than the inference region, so routine legal process there reaches this material. Holding at L rather than H because the rubric treats 6.1's confidentiality weight as secondary (primary_impact_axis empty; the carry is Subsequent scope and Value Density), and because key material is rotatable, bounding the loss. VI Primary Dependency Impact -- Integrity H H agent CONFIRM H. The console is the sole authority for routing, usage policy, DLP rules and key rotation, and GateKeep holds a standing contractual right to change console behaviour, default policies and supported providers for all customers at once, unilaterally, with no action by the firm — it has done so twice in the past year with release notes published only on the day the change took effect. Control-plane integrity is therefore not partially but totally at the vendor's discretion: every security-relevant setting the firm believes it has configured can be redefined, and the firm learns after the fact. The questionnaire's own answer at this dependency is 'Full: behaviour can be changed silently and materially'. ATLAS AML.T0081 characterises exactly this class — modification or disabling of configuration settings governing security controls, producing 'long-term corruption', whose mitigation presumes change approval, integrity monitoring and 'restoration from trusted configurations'; the firm holds no offline copy of its routing and policy configuration, so it has neither a baseline to detect drift against nor a trusted state to restore, removing any residual integrity assurance that would justify L. VA Primary Dependency Impact -- Availability H H agent CONFIRM H. The rubric assigns 6.1 AV as the carrying exploitability metric precisely because 'a console compromise or outage affects every downstream AI workload' — availability is the axis the dimension is built around. There is a single hosted console with no self-hosted or offline administrative fallback; the questionnaire records that the capability 'can be removed outright' at the vendor's discretion, that the loss 'could happen to all of the vendor's customers at once, with no case-by-case decision', and that exit requires re-architecture. With no offline copy of the routing and policy configuration, an outage or withdrawal is not a degraded-but-usable state: the firm loses all ability to configure routing, policy and key rotation, and rebuilding on another gateway is a significant project rather than a failover. That is total loss on this axis at the vulnerable system, so H rather than L. SC Downstream Blast-Radius Impact -- Confidentiality L L agent CONFIRMED. The rubric models 6.1 as pure-subsequent with no primary impact axis, so the question is what a console compromise/alteration leaks at other systems. What the hosted console and its out-of-jurisdiction configuration store actually hold is routing rules, DLP policy, key material and the audit log — configuration and metadata about the firm's AI usage, not the privileged client documents themselves, which traverse the data plane (dimensions 2.1/6.3). That matches the firm's own answer of 'Partial: limited or indirect exposure (metadata, fragments, aggregates)' at the dependency and 'Partial' beyond it. Counter-argument considered: GateKeep holds the API keys for all three providers, and exposure of those keys or of the audit log to a foreign-jurisdiction store is a meaningful indirect confidentiality channel into every downstream provider account; that is why this is a high-side L rather than N, and why confidence is moderate rather than high. Total/near-total downstream confidentiality loss (H) would require the console itself to surface prompt and completion content, which the scenario does not state. Residual DLP-bypass confidentiality belongs to secondary 6.4. SI Downstream Blast-Radius Impact -- Integrity H H agent CONFIRMED. The console is the single place routing, usage policy, DLP rules and key rotation are defined for all generative-AI use at a 900-person firm. GateKeep can change console behaviour, default policies and supported providers for all customers at once (it has done so twice in a year, with release notes published only on the day of change), and the questionnaire records that behaviour 'can be changed silently and materially' and that 'downstream systems act on altered outputs without detection'. Altered configuration silently re-routes prompts to a different provider, weakens DLP masking, or corrupts the audit log the firm relies on for client-confidentiality assurances — i.e. every downstream workload inherits an un-notified behaviour change and the firm's integrity evidence itself becomes unreliable. The rubric flags exactly this pattern as textbook subsequent-integrity impact (see the analogous 1.3 note) and marks 6.1 subsequent-impact-relevant, with no change-control barrier (AC/AT: standard ToS, vendor discretion, no customer action required). Near-total loss on this axis. SA Downstream Blast-Radius Impact -- Availability H H agent CONFIRMED as H, and explicitly NOT S. The scenario states that if the console were unavailable or its configuration altered, every AI workload in the firm would be affected simultaneously; the gateway is the sole path to all three model providers and holds all provider keys, so loss of the control plane is a total withdrawal of AI capability, not a degradation. Aggravating factors: no offline copy of the routing and policy configuration, rebuilding on another gateway is 'a significant project' (questionnaire: high mitigation effort, manual migration), the loss can occur for all of the vendor's customers at once with no case-by-case decision, and the capability 'can be removed outright' at vendor discretion. This is the rubric's 'pure Subsequent scope' availability case for 6.1 (reinforced by secondary 6.3, 'a gateway outage takes down access to the underlying service -- Subsequent Availability'). S is rejected: Halden & Marsh is a professional-services firm with no cyber-physical or safety-relevant workload; the questionnaire answer is 'Downstream workloads stop' with no indication anyone could be physically harmed. E Precedent Maturity A P agent · override OVERRIDE of the questionnaire prior (P). The rubric defines E:A as 'documented real-world cases of this control being exercised against comparable orgs' (sovereignty_cvss_rubric_1.json, threat.metrics.E). For dimension 6.1 the 'control' is the vendor's standing ability to alter or withdraw the hosted console and its configuration — not an adversarial exploit — and the scenario records that this control has in fact been exercised: GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year with release notes published on the day of change.' Two fleet-wide, vendor-initiated changes in twelve months, documented by the vendor's own release notes, are first-party evidence of realised exercise against this org and every comparable GateKeep customer — stronger than the 'demonstrated in research, not confirmed against our stack' threshold that defines P. The corpus supports this reading of the maturity ladder: ATLAS 'Realized / Incident -> E:A (Attacked), Demonstrated / Exercise -> E:P' (atlas/README.md), and the same README anchors 'Modify AI Agent Configuration' to CASE 6.4, i.e. configuration/policy alteration is an established, catalogued technique rather than a theoretical one. The questionnaire respondent answered 'demonstrated in research or incident reports, not confirmed against our stack', which appears to address only the hostile-compromise/outage variant; it is inconsistent with the scenario's own account of two realised vendor-side configuration changes, and the scenario text is the more specific evidence. Supporting questionnaire answers reinforce that no barrier stands in the way of repetition: the vendor holds a standing contractual right to act at any time, needs nothing beyond its standard terms, requires no action by the firm, and the event can hit all customers simultaneously (AU=Yes) with notice only at the moment of effect. Residual uncertainty (hence confidence below 0.9): the corpus contains no sovereignty-specific case study of an AI-gateway console outage or unauthorised console alteration, so the E:A grounding rests on the scenario's documented vendor-change precedent rather than on an external incident report for the availability branch of 6.1. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence N N agent CONFIRM N. The console holds routing rules, DLP policy, provider keys and the audit log — but confidentiality loss *at* the console is scoped to metadata/fragments/aggregates (questionnaire), not bulk client content, and the rubric reserves P for compromises that *independently* trigger a reportable violation (GDPR Art. 28, EU AI Act Title III). A generative-AI gateway for a professional-services firm is not a Title III high-risk system, and the AI Act material retrieved concerns deployer/provider duties and serious-incident reporting for high-risk systems, not control-plane outages (eu-ai-act-2024-1689.md). The cross-jurisdiction console/configuration store is a genuine Art. 28/Chapter V transfer-governance concern, but it was disclosed on GateKeep's subprocessor list, so it is a contracting defect to remediate rather than an automatic reportable breach; a notifiable event would only arise if altered DLP rules subsequently caused a personal-data disclosure, which is a downstream consequence rather than an independent trigger. Moderate confidence: a supervisory authority could take a different view of silent policy alteration plus loss of audit-log integrity. AU Silent/Automatic Trigger Y Y agent CONFIRM Y. The scenario states GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year'. That is precisely the rubric's Y definition — the sovereignty-loss event occurring simultaneously across all customers with no case-by-case decision — and the questionnaire confirms the vendor holds a standing, at-its-discretion right requiring no action by the firm. Demonstrated twice already, so this is observed behaviour, not theory. R Portability / Exit Recovery U U agent CONFIRM U. The capability (policy enforcement, routing, DLP, audit logging in front of three providers) is reconstitutable on another gateway or in-house, but only through manual effort: the firm holds no offline copy of its routing and policy configuration, so the config must be re-derived, and keys re-issued and re-integrated across three providers — the scenario calls it 'a significant project'. That is 'User -- manual migration effort required', not Automatic. It does not reach I: nothing about the configuration is uniquely locked to GateKeep's possession, and the model providers behind the gateway are contracted capabilities the firm can address directly, so the capability can be reconstituted without the original vendor. The missing offline config copy is the factor that would tip this to I if the configuration itself (rather than the knowledge of it) were irretrievable. V Blast-Radius Concentration C C agent CONFIRM C — this is the metric the rubric names as the supplemental hook for 6.1 ('V (Value Density -- Concentrated)'), and the scenario is the textbook case. All generative-AI usage for a 900-person firm passes through one gateway whose hosted console is the single configuration point; the scenario states that if the console were unavailable or its configuration altered, 'every AI workload in the firm would be affected simultaneously', and the questionnaire answers 'Many or all: shared control plane'. The rubric's C definition explicitly cites a shared control plane as the exemplar. Blast radius is maximally concentrated. RE Exit / Mitigation Effort H H agent CONFIRM H. Mitigating the stated exposure — a console and configuration store in a jurisdiction other than the chosen inference region, with vendor-wide unilateral change rights — cannot be achieved by a trivial setting change or swap-out. It requires either re-contracting with GateKeep for a console in the inference jurisdiction and contractual change-notice/consent terms, or re-architecting onto a self-hosted/alternative gateway and rebuilding routing rules, DLP policy, key management and the audit-log pipeline for three providers without an offline copy of the existing configuration. That matches the rubric's H ('re-architecture, re-contracting'). Partial interim mitigations (exporting and version-controlling the configuration offline) are cheap, but they do not remove the exposure. U Vendor Notice Posture Amber Amber agent CONFIRM Amber. GateKeep changed console behaviour, default policies and supported providers twice in the past year 'with release notes published on the day of change' — disclosure concurrent with the change taking effect, which is the rubric's Amber definition exactly. It is not Red (changes are disclosed, and the subprocessor list disclosed the console's jurisdiction, which is how the firm found out), and not Green/Clear because there is no advance notice, let alone a contractually guaranteed notice period — the questionnaire records a standing right to act at the vendor's discretion with no action by the firm. - HIGH9.3
7 How many companies are really in this chain: and did we agree to it?
7.1 Downstream subprocessors · also 7.3The real chain behind the firm's AI is Halden & Marsh to GateKeep, then to three model providers, then to their hosting infrastructure, plus a separate host for the console and configuration store in a third jurisdiction. The firm has a contract with only the first link, and discovered the jurisdiction mismatch only by going to look at the subprocessor list. GateKeep can change which providers are supported for all customers at once, meaning the composition of this chain can be altered at the vendor's discretion with notice on the day of effect. Because the out-of-jurisdiction configuration store holds the API keys for every provider and the enforcement rules, a problem at that single hop exposes the firm's accounts at all three providers and can switch off data-loss prevention for everyone at the same time.
Rating HIGH. Most of the parties handling the firm's AI traffic were never agreed to by the firm, their number can change without its consent, and exposure at any of them lands on the firm's clients.
Evidence: vector, score and 21 metric rationales
Vector SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:M/IR:H/AR:H/S:P/AU:Y/R:U/V:C/RE:H/U:Amber Score 9.3 (Critical)
Ask the vendor List every company standing between us and the raw computer running this AI. How long is that list, really? · Did we ever affirmatively choose to adopt AI here, or did it just arrive?
Metric Value Prior Source Rationale AV Access Path A N agent · override OVERRIDE of prior N. The prior describes the firm's direct relationship with GateKeep ('in the vendor's own cloud, reached directly over its API'), which is correct for the primary dependency but not for this category. Dimension 7.1 is about the chain firm → GateKeep → three model providers → their hosting infrastructure. The downstream parties (the three model providers, the hosting infrastructure under them, and the operator of the console/configuration-store jurisdiction) have no direct contractual or network path to the firm at all: GateKeep holds every provider API key and all traffic is mediated by the gateway. That is verbatim the rubric's A value, 'Adjacent -- subprocessor-mediated access' (sovereignty_cvss_rubric_1.json). The rubric further notes for Category 7 that 'sovereignty exposure compounds across the entire subprocessor chain rather than stopping at the primary vendor', and that the firm only discovered the console/inference jurisdiction mismatch by reading GateKeep's subprocessor list, i.e. the exposure is reachable only through the intermediary, never vendor-direct. AC Compulsion Complexity L L agent CONFIRM L. No technical or contractual barrier protects the chain: GateKeep holds the API keys for every provider (no customer-managed keys), and the firm's chosen data-residency preference is already not honoured for the console and configuration store, which sit in a different jurisdiction. A data-residency carve-out that is demonstrably not enforced across the subprocessor chain is not a barrier to overcome, so a standard ToS clause or routine legal process in the console's jurisdiction suffices, matching the rubric's L definition. The questionnaire independently reports 'nothing beyond its standard terms of service or routine legal process'. AT Trigger Conditions N N agent CONFIRM N. No specific triggering event is needed. GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year' — a standing, discretionary right exercised twice already. Changing 'supported providers' is precisely a change to the downstream subprocessor set, so the chain can be re-composed at vendor discretion at any time, which is the rubric's N ('control can be exercised at vendor discretion at any time') rather than P (sanctions designation, litigation hold, incident). PR Position Required N L agent · override OVERRIDE of prior L. The questionnaire answer 'only the primary vendor we contract with' is scoped to the primary dependency. For dimension 7.1 the exposed surface is the chain itself, and the rubric's N value is written for exactly this case: 'None -- any party already in the subprocessor chain has sufficient standing.' Here the chain demonstrably contains parties other than GateKeep — three model providers, their hosting infrastructure, and the authorities of the jurisdiction hosting the console and configuration store — each of whom can act on the firm's traffic, configuration or availability without being the firm's contracted vendor and without touching the firm's own admin credentials (so not H). The rubric's Category 7 note reinforces that impact here is measured relative to parties 'never the org's contracted AI vendor'. UI Org Action Required N N agent CONFIRM N. The firm takes no affirmative action and need not even consent: changes to default policies and supported providers were applied to all customers at once, with release notes 'published on the day of change' (questionnaire: 'disclosed at the time the change takes effect'). Notice contemporaneous with effect is not an opt-in or an accepted update, so neither A nor P applies; this is the rubric's N, 'vendor/subprocessor can act unilaterally (silent model swap, ToS change)'. The jurisdiction mismatch in the subprocessor list likewise arose without any firm action — the firm had to go looking for it. VC Primary Dependency Impact -- Confidentiality L L agent Confirming the prior. At the chain node named by 7.1 — GateKeep's hosted console and configuration store, plus the subprocessors in the jurisdiction the firm did not choose — what is exposed is configuration, routing/DLP policy, provider API keys and the audit log, not the inference payloads themselves (inference stays in the firm's chosen jurisdiction). That is partial/indirect confidentiality loss: policy and audit metadata that can reveal which client matters used which providers, obtainable under GateKeep's standard terms or routine legal process (questionnaire: AC=standard ToS/legal process, UI=none). The custody of every provider API key is a serious aggravator, but its effect is to unlock content held at the *downstream* model providers, which the rubric assigns to the Downstream Blast-Radius group (SC) rather than to VC. Hence L at the dependency itself, with the compounding effect captured downstream. VI Primary Dependency Impact -- Integrity H H agent Confirmed and strongly supported by the scenario. GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year with release notes published on the day of change' — so the integrity of the firm's routing rules, usage policy, DLP enforcement and the audit log it relies on for client-confidentiality assurances is entirely at the vendor's (and its out-of-jurisdiction hosting subprocessor's) discretion, with notification only at the moment of effect. Questionnaire corroborates: behaviour 'can be changed silently and materially', vendor can act unilaterally at any time. This is total loss of control on the integrity axis for the configuration/policy plane, matching rubric dimension 6.4 (configuration and policy management, primary_impact_axis VI) applied to a supply-chain node. VA Primary Dependency Impact -- Availability H H agent Confirmed. The console and configuration store are a single hosted chokepoint in a third jurisdiction; if they are unavailable, administrators cannot configure routing, policies or key rotation at all, and the firm holds no offline copy of the configuration. The questionnaire states the capability 'can be removed outright' by the exercising party and that a loss event can occur across all customers simultaneously, with exit requiring re-architecture and re-contracting. That is total or near-total availability loss at the dependency, consistent with the rubric's treatment of gateway/control-plane nodes as single points of failure (6.3: 'a gateway outage takes down access to the underlying service'). SC Downstream Blast-Radius Impact -- Confidentiality H L agent · override Override from L to H for this dimension. The subsequent systems in the 7.1 chain (firm → GateKeep → three model providers → their hosting) are reachable through artefacts GateKeep concentrates: it holds the API keys for every provider, applies the firm's DLP rules and produces the audit log the firm uses for client-confidentiality assurances — and the console plus its configuration store sit in a jurisdiction other than the one chosen for inference, reachable by that jurisdiction's routine legal process or by GateKeep's standard terms. Possession of all provider keys in a foreign-hosted config store means loss at that hop is not limited to 'metadata, fragments, aggregates': it enables near-total exposure of the firm's accounts at the three downstream providers, and a silent default-policy change (GateKeep can change default policies for all customers at once and has twice done so with same-day notice) can disable DLP so that privileged client content flows in full to providers the firm did not select. The rubric's own framing for this group is that 'sovereignty exposure compounds across the entire subprocessor chain rather than stopping at the primary vendor' (dimension 7.1 is 'definitionally what the Subsequent System Impact metric group was built to express'), which is precisely what the questionnaire's primary-dependency-scoped 'Partial' answer understates. Confidence is moderate because the firm's chosen inference jurisdiction still bounds normal-operation data flow; the H rests on the key/DLP/config concentration in the mismatched jurisdiction. SI Downstream Blast-Radius Impact -- Integrity H H agent Confirms the prior. GateKeep can unilaterally change console behaviour, default policies and the set of supported providers for all customers simultaneously, with release notes published only on the day the change takes effect — so routing can be re-pointed to a different downstream model provider, and policy/DLP enforcement altered, without the firm's prior knowledge or any action on its part. Every downstream workload then acts on outputs produced under silently changed routing and policy, and the audit log that the firm relies on as its integrity evidence is itself a GateKeep artefact, so detection is impaired. This matches the rubric's treatment of configuration/policy management and model-version control as textbook Subsequent Integrity impacts ('every downstream consumer inherits an un-notified behaviour change'), and the questionnaire answer 'downstream systems act on altered outputs without detection'. SA Downstream Blast-Radius Impact -- Availability H H agent Confirms H rather than S. Availability loss at any hop of the chain — the cloud infrastructure hosting the console and configuration store (the secondary 7.3 sub-layer), GateKeep itself, or withdrawal of a supported provider — stops every AI workload in the 900-person firm at once, because the gateway is the sole path to all three providers and holds all keys. The firm keeps no offline copy of its routing and policy configuration and re-platforming to another gateway is a significant re-architecture project, so the downstream loss is total rather than partial, and it can occur for all customers simultaneously with no case-by-case decision. The rubric notes for the gateway dimension that 'a gateway outage takes down access to the underlying service -- Subsequent Availability'. S (Safety) is not warranted: this is professional-services knowledge work with no physical-process or safety-relevant dependency, and the questionnaire reports only that 'downstream workloads stop' with no one harmed. E Precedent Maturity A P agent · override OVERRIDE of prior P. For dimension 7.1 the control at issue is unilateral vendor reconfiguration of the downstream subprocessor chain (firm -> GateKeep -> three model providers -> their hosting), not console compromise. The scenario states GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year with release notes published on the day of change' -- changing the supported-provider set is precisely an alteration of the downstream subprocessor set, and it has demonstrably been exercised, twice, against this firm and simultaneously against every comparable customer. That meets the rubric's E:A bar ('documented real-world cases of this control being exercised against comparable orgs') and exceeds E:P ('not confirmed against this org's own stack'). This is corroborated by MITRE ATLAS, which rates AI Supply Chain Compromise (AML.T0010) as Realized -> CASE Precedent Maturity E:A and names it the CASE anchor for the Subprocessor & Supply Chain category, with sub-techniques AI Software (.001) and AI Agent Tool (.005) also Realized -> E:A, and case study AML.CS0053 (postmark-mcp) documenting a real incident in which a procured third-party component silently changed behaviour for all downstream consumers via a routine vendor-pushed update. EU AI Act recitals 88-90 treat the multi-party AI value chain as an established, regulated exposure rather than a theoretical one. The questionnaire prior of P remains a reasonable reading of the firm's self-assessment and the jurisdiction-mismatch aspect (no documented case of the mismatched-jurisdiction console store being compelled), which is why confidence is 0.72 rather than higher; but the change-of-provider precedent is already realised, so U is clearly wrong and P understates it. CR Confidentiality Criticality (org context) M M questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. IR Integrity Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. AR Availability Criticality (org context) H H questionnaire Organization-profile answer (ADR-0005 §5 rule 1); never agent-assigned. S Regulatory Consequence P N agent · override OVERRIDE of the questionnaire's N. The prior answers the question for the primary dependency ('would a loss of control here, on its own, trigger a reportable violation'), but at dimension 7.1 the defect is not a hypothetical future loss event: it is the present state of the subprocessor chain. The firm chose an inference jurisdiction, yet GateKeep's hosted console and configuration store -- which hold the routing rules, DLP policies, every provider API key and the audit log the firm relies on for client-confidentiality assurances -- sit in a different jurisdiction, a fact discovered only by reading the subprocessor list rather than through disclosure. GateKeep also changed supported providers (i.e. the set of downstream subprocessors) for all customers at once with release notes published on the day of change, leaving no window to authorise or object. The rubric names GDPR Art. 28 as the exemplar for S:P, and Art. 28's controller-authorisation-and-notice-of-change structure plus Chapter V transfer requirements are exactly what an undisclosed off-jurisdiction subprocessor store and same-day provider substitution engage -- compounded for a 900-person professional-services firm under professional-secrecy duties to clients. Confidence held below 0.6 because the corpus did not return the Art. 28 text itself (retrieval surfaced EU AI Act notified-body provisions instead), and because the scenario does not state explicitly that client personal data, as opposed to policy configuration and audit metadata, resides in the off-jurisdiction store. AU Silent/Automatic Trigger Y Y agent CONFIRMED. The scenario states directly that GateKeep 'can change console behaviour, default policies and supported providers for all customers at once, and has done so twice in the last year.' That is a fleet-wide change to the composition of the downstream subprocessor chain with no case-by-case decision per customer, matching Y ('the sovereignty-loss event can occur simultaneously across all customers with no case-by-case decision'). The questionnaire's 'vendor or subprocessor can act unilaterally' answer corroborates it. This is the strongest-evidenced metric in the group: the trigger is not merely possible but demonstrated twice. R Portability / Exit Recovery U U agent CONFIRMED, though at the pessimistic end of U. The capability itself is reconstitutable without GateKeep: the three model providers exist independently and could be contracted and integrated directly, so this is not I ('cannot be reconstituted without the original vendor'). But it is well short of A: the firm holds no offline copy of its routing and policy configuration, GateKeep holds the provider API keys, and rebuilding on another gateway 'would take a significant project' -- squarely 'manual migration effort required'. I considered I because the accumulated audit-log history underpinning client-confidentiality assurances and the authored policy state are not retrievable elsewhere; the deciding factor for U is that the rubric anchors R to reconstituting the capability (primary_hook 1.2 model weight custody), not to recovering historical artefacts, and the capability can be rebuilt by hand. V Blast-Radius Concentration C C agent CONFIRMED. The firm 'routes all of its generative-AI usage through GateKeep', a single gateway that fans out to three providers and their hosting infrastructure; 'if the console were unavailable or its configuration altered, every AI workload in the firm would be affected simultaneously.' This is the rubric's own parenthetical example of C -- a shared control plane in the critical path for many/all AI workloads. The chain structure reinforces rather than dilutes the concentration: one contracted vendor is the single chokepoint through which all downstream subprocessor exposure is inherited. RE Exit / Mitigation Effort H H agent CONFIRMED. Exiting requires re-architecting the gateway layer, re-authoring routing/policy/DLP configuration from scratch (no offline copy), re-establishing and rotating keys with three providers, and re-contracting -- the scenario's 'significant project'. Critically for this category, the specific exposure cannot be fixed contractually at all by the firm acting alone: the off-jurisdiction console hosting sits with GateKeep's own subprocessor, a party the firm has no privity with, so the only levers are re-contracting with GateKeep for a residency carve-out or full replacement. That is the H band ('re-architecture, re-contracting, or physical infrastructure replacement'), not M. U Vendor Notice Posture Amber Amber agent CONFIRMED. Both observed changes came with 'release notes published on the day of change' -- disclosure concurrent with the change taking effect, which is the Amber definition, and there is no indication of any contractually guaranteed notice period (which Clear would require) or of advance notice (Green). I weighed Red, since the console/config jurisdiction mismatch was surfaced only by the firm's own review of the subprocessor list rather than proactively flagged; Amber is retained because GateKeep does maintain a published subprocessor list and does issue same-day release notes, so the posture is late-but-existent disclosure rather than non-disclosure. The practical effect for dimension 7.1 is nonetheless that the firm learns of downstream subprocessor changes only once they are already live.
What Halden & Marsh LLP should do next
Written by the narrative agent from the findings and mitigations
- Halden & Marsh should immediately require GateKeep, in writing, to give advance notice of any change to supported providers, default policies, console behaviour or logging, with a defined notice period and a documented option to stay on current behaviour while the firm re-validates.
- Halden & Marsh should begin exporting its own copy of the audit log and routing telemetry on a continuous schedule into firm-controlled storage, so its client-confidentiality evidence survives any retention change, access withdrawal or vendor outage.
- Halden & Marsh should take and regularly refresh an offline copy of its complete routing rules, usage policies, data-loss-prevention configuration and key inventory, so it has a baseline to detect silent change against and a trusted state to rebuild from.
- Halden & Marsh should contract the three model providers directly, or at minimum hold its own provider API keys, so it retains a working path to AI capability and to its own accounts if GateKeep's console is unavailable or the relationship ends.
- Halden & Marsh should obtain a binding commitment that the console and configuration store, not just inference, are hosted in the firm's chosen jurisdiction, and a written list of every subprocessor with a change-notification and objection right.
- Halden & Marsh should require GateKeep to constrain support and debugging access through per-request justification, customer-visible access logging and screened personnel, and should insist on evidence that such access is reviewable by the firm.
- Halden & Marsh should implement its own independent checks on prompts and outputs - sensitive-data and secret redaction, output review and a human approval step for client-facing work product - so confidentiality does not rest solely on a vendor-configured filter.
- Halden & Marsh should test the failure case before it happens: run a documented exercise covering console unavailability, a silent policy change and a provider substitution, and scope the cost and timeline of migrating to a second gateway or direct provider access.
Ranked mitigations
Retrieved from the mitigation library for the adverse metrics
10
| Relevance | Mitigation | Targets |
|---|---|---|
| 0.95 | Generative AI Guardrails (AML.M0020): place safety controls between users, tools and the model to evaluate prompts, retrieved context, model outputs and agent actions before they are accepted, executed or shown. Implement input moderation (harmful content, prompt injection, jailbreak, sensitive data, over-length/malformed inputs), output moderation, system-prompt and policy enforcement, tool/action guardrails validating tool calls, arguments and permissions, retrieval guardrails that filter untrusted or malicious retrieved documents, groundedness/factuality checks, sensitive-data and secret redaction, and structured output schema validation. Require human approval for high-impact, irreversible, privileged or externally visible actions. Guardrails must be continuously evaluated, red-teamed and updated, and all guardrail decisions logged.Directly hardens the two dimensions rated worst on integrity and availability (4.4 guardrail/safety filter layer and 2.1 prompts/user inputs) by adding an org-controlled enforcement layer that raises compulsion complexity and narrows trigger conditions. | ACATUIVISIVCSCVASAE |
| 0.88 | AI Telemetry Logging (AML.M0024): implement logging of inputs and outputs of deployed AI models, and for agents log intermediate steps of agentic actions and decisions, data access and tool use, installation commands and the agent identity. Monitor logs to detect security threats and mitigate impact; enabled logging also deters adversaries who wish to remain undetected. Telemetry supports detection of exfiltration via inference APIs, model inversion/extraction, unsafe prompts (direct, indirect and triggered injection), malicious tool invocations, requests to RAG databases and AI-service web-interface abuse.Organization-side telemetry over dimension 3.5 removes the silent/automatic character of triggers (AU:Y) and creates the evidentiary record needed to detect confidentiality loss and to reconstruct state during exit. | AUATVCSCVISIRE |
| 0.86 | Human In-the-Loop for AI Agent Actions (AML.M0029): require a user or other human stakeholder to approve agent actions before they are taken, with the approver being technical staff or business-unit SMEs depending on use case. Audit agents may assist but final adjudication must rest with a human decision-maker. Scale the policy to the degree of consequence: minor repetitive tasks need minimal oversight, while high-consequence systems may require approval from multiple stakeholders diversified across multiple organizations. Prevents automatic execution of tool invocations, exfiltration via tool invocation and data destruction via tool invocation.Inserting mandatory human adjudication converts silent, automatically triggered changes into gated events, which is the single most direct counter to AU:Y combined with UI:N across dimensions 1.3, 4.4 and 6.1. | AUUIATVISIV |
| 0.84 | AI Red Teaming (AML.M0035): continuously exercise the system as the threat landscape evolves and whenever components, intended use or deployment environment change. Attempt controlled modification or substitution of models, weights, adapters and configuration and remediate weaknesses in authorization, artifact integrity, deployment approval, monitoring and recovery. Test direct, indirect and triggered prompt injection through user input, retrieved data, documents, websites, images, metadata and tool output; test encoded, transformed, visually hidden, multilingual and multimodal obfuscation; exercise manual and automated jailbreaks and feed successful cases into guardrails, guidelines, alignment, monitoring and regression evaluations. Exercise introduction of untrusted software, data, models and agent tools through representative acquisition paths and remediate provenance, validation, approval, isolation and rollback gaps. Submit adversarial workloads and exercise dependency failures that could exhaust inference or supporting services.Regression-style red teaming repeated on every change is the control that builds the internal evidence base behind Precedent Maturity (E:A/E:P) and validates rollback and recovery paths before they are needed. | EACATVISIVASARE |
| 0.82 | Validate AI Model (AML.M0008): validate that models perform as intended by testing for backdoor triggers, potential data leakage and adversarial influence, and monitor the model for concept drift and training-data drift that may indicate tampering or poisoning. Ensure acquired or newly deployed models do not respond to potential backdoor triggers; robust evaluation increases confidence a model has not been manipulated or poisoned and can detect privacy concerns and leakage.Drift and behavioural validation applied to each incoming provider model version is the practical detection mechanism for unannounced model updates (dimension 1.3, VI:H/SI:H) where the organization cannot block the change itself. | VISIATAUERE |
| 0.74 | Control Access to AI Models and Data at Rest (AML.M0005): establish access controls on internal model registries and limit internal access to production models; limit training-data access to approved users. Restrict write access to model registries and AI artifact stores, restrict access to stored system prompts, prompt templates, configuration files and model metadata, and verify identities before granting access to registries so newly established accounts cannot automatically reach protected AI assets. Access controls prevent tampering with and unauthorized modification or copying of AI artifacts.Registry write-control and identity verification raise the position and privilege required to alter model versions or prompt configuration, targeting PR:N/AC:L on dimensions 1.3 and 6.1. | PRAVVISIVCAC |
| 0.72 | Control Access to AI Models and Data in Production (AML.M0019): use access controls, authentication and monitoring in production to prevent injection of malicious prompts, limit inference-API access used to build proxy datasets or reveal private information, prevent excessive querying that disables the system, and limit cost harvesting. Authenticate and monitor access to production models and configuration interfaces including stored system prompts; enforce authorization and monitor production AI API use for anomalous activity associated with replayed access tokens and application access tokens; authenticate AI service API callers and monitor queries for policy violations and misuse.Authentication and anomaly monitoring on production model and configuration interfaces addresses the network-reachable, low-privilege access paths (AV:N/PR:L) behind dimensions 2.1, 5.3 and 6.1. | AVPRACVCVASAAU |
| 0.70 | Input and Output Validation for AI Agent Components (AML.M0033): implement validation on the inputs and outputs of the tools and data sources used by AI agents, including enforcement of a common data format, schema validation, checks for sensitive or prohibited information leakage, and sanitization to remove injections or unsafe code. Validation should be performed external to the AI agent. This prevents compromises from spreading in AI-enabled systems and secures workflows where multiple components are chained together.Validation placed outside the provider-controlled component gives the organization an independent integrity checkpoint, containing downstream blast radius when a vendor guardrail or model version changes behaviour. | VISISCSAACAT |
| 0.66 | AI Bill of Materials (AML.M0023): maintain an AI BOM, including dataset provenance — a detailed history of the datasets used for AI applications covering the source and a complete record of any modifications. An AI BOM helps users identify untrustworthy components of their AI supply chain, untrustworthy binaries, model artifacts and software dependencies, and poisoned training data.Component- and provenance-level inventory is the prerequisite for seeing concentration across downstream subprocessors (dimension 7.1, SC:H/SI:H/SA:H) and for discharging regulatory disclosure duties (S:P). | VSCSISASREE |
| 0.60 | AI Agent Isolation and Segmentation (AML.M0032): where AI agents share infrastructure, isolate each agent's identity, credentials, state, storage, messaging, tools and network access to prevent undesired agent-to-agent communication or coordination, and run the highest-risk workloads in network-isolated or air-gapped environments. Segmentation stops an exposed service from revealing or providing reachability to additional internal components and prevents agentic workflows from affecting other components, collecting sensitive data from AI services or RAG databases, exfiltrating data or harvesting credentials.Segmenting identities, credentials and network reachability reduces blast-radius concentration (V:C) and limits how far a compromised control plane or support session can propagate. | VSCSISAAVPR |
Method
A plain-language walkthrough for GRC and compliance auditors, no technical background required
The seven questions above don't change from vendor to vendor, only the answers do. Any time your organization is told (or, more often, not told) that a piece of already-approved software just grew an AI feature, work through the same seven categories, in the same order, and rate what you find on the same three-colour scale. The scenario in this document exists to show you what that looks like done once, start to finish, the method itself travels.
- Rating scale
- LOW: Normal and contained. If something went wrong here, you'd find out quickly and fix it without much trouble. MEDIUM: Could cause a real problem, and you might not find out right away, worth tracking, not yet an emergency. HIGH: Could cause serious damage, a data leak, a regulatory violation, or losing the ability to operate, and by the time you noticed, it might already be too late to undo.
- Questionnaire priors
- AC:L AR:H AT:N AU:Y AV:N CR:M E:P IR:H PR:L R:U RE:H S:N SA:H SC:L SI:H U:Amber UI:N V:C VA:H VC:L VI:H
- Job
- eb752834-8389-43d0-97cf-3fd5498fdb2f