Informative translation. The Spanish text is authoritative. If the two differ, the Spanish version prevails.
Status: in force since ASILO 0.1 (28 Sep 2026; editorial revision 0.1.1). Read the
normative language first and see the version history.
ASILO deals with what a system built with AI assistance may do, who can stop it and how to
verify that it respected its limits. The requirements below are agnostic:
they do not depend on language, framework or provider. TypeScript contracts, concrete validators and
ring numbering belong to profiles.
What these requirements do not promise. Meeting them does not make a system secure, private, free of
hallucinations or compliant with OWASP, NIST, MITRE or ISO. Each requirement names its residual risk.
External references are used to cross-check the design; see external frameworks.
A model's output (text, tool call, code) is executed or stored as if it were a valid order. A direct or indirect injection turns it into an action of the attacker.
Scope
Every point where content generated by a model, or external data that a model reads, can produce an effect: write, tool call, send, code execution, permission change.
Responsible actor
Technical owner of the system that integrates the model.
Applicability condition
Whenever there is at least one effect point fed by a model.
Verifiable statement
The system MUST document its trust boundaries and, for each effect point, the contract it accepts (shape, allowed values, version). The model's output MUST be treated as untrusted data: before the effect it MUST be validated against the contract and authorized against the permissions of the person or service that originated the request. Shape validation MUST NOT be presented as authorization or as verification of truthfulness. The model SHOULD NOT receive the list of privileged operations it does not need.
Expected evidence
Boundary diagram or table; versioned contracts; tests that show rejection of malformed output and of well-formed but unauthorized output.
Exception
Systems without effect points (they only show text to a person) record that condition; if it changes, the requirement applies.
Residual risk
An injection can produce a valid, authorized intent that the attacker wants; neither the contract nor the authorization detects malicious intent inside what is permitted.
ASILO-R-002 — Declared layer model and dependency direction¶
Field
Content
Class
Agnostic requirement (the numbering and names of rings belong to the profile) · derives from ASILO-P-01
Status
accepted — ASILO 0.1 (28 Sep 2026)
Problem
High-risk code (secrets, external effects, third-party dependencies) is mixed with logic that should be pure; nobody can say which layer trusts which.
Scope
Software architecture of systems that apply ASILO.
Responsible actor
Architect or technical owner.
Applicability condition
Systems with more than one module or package that declare that they apply ASILO.
Verifiable statement
The system MUST declare its model of layers or rings (name, contents of each layer and originating profile) and the dependency rule between them. The dependency rule SHOULD be checked automatically in continuous integration when the profile allows it. The method MUST NOT require a specific numbering or a specific number of layers.
Expected evidence
Model document; configuration and result of the automatic check; recorded exceptions.
Exception
Single-module systems record the condition.
Residual risk
Respecting the dependency direction does not prevent failures inside a layer; the compiler or linter only prove what they check.
External references
OWASP LLM03:2025 Supply Chain; OWASP ASI04 Agentic Supply Chain Vulnerabilities; NIST AI 600-1 Value Chain and Component Integration.
Agnostic requirement (the concrete interface belongs to the profile) · derives from ASILO-P-03
Status
accepted — ASILO 0.1 (28 Sep 2026)
Problem
An agent receives “the whole repo” or the whole history: cost increases, relationships get confused, data it did not need is exposed, and the surface for injected instructions or poisoned memory grows.
Scope
Each task in which an agent or model receives context from the system or its users.
Responsible actor
Owner of the agent system.
Applicability condition
Tasks with access to internal sources, personal data or persistent memory.
Verifiable statement
Each task MUST have a declared context budget with: allowed sources, excluded paths, maximum data classification admitted, size limit and expiry. A budget MUST NOT be reused across different tasks. Data in the two highest classifications of the exposure scale (confidential and critical) MUST NOT enter an external model without recorded human approval or verified anonymization. Content retrieved from external sources MUST be treated as untrusted (ASILO-R-001).
Expected evidence
Budgets per task; record of what actually entered the context; approvals.
Exception
Tasks without internal data or memory (for example, drafting over text supplied by the person).
Residual risk
A minimal context may still contain malicious instructions or wrong data; anonymizing does not guarantee that there is no re-identification.
External references
OWASP LLM02:2025 Sensitive Information Disclosure, LLM07:2025 System Prompt Leakage, LLM08:2025 Vector and Embedding Weaknesses; OWASP ASI06 Memory & Context Poisoning; MITRE ATLAS AML.T0080 AI Agent Context Poisoning.
ASILO-R-004 — Minimal and revocable permissions for agents¶
An agent inherits all the permissions of whoever launches it, or more; if it is compromised or diverted, its blast radius is that of the whole account.
Scope
Agents, subagents and tools that execute actions.
Responsible actor
Owner of the agent system.
Applicability condition
Any agent with access to tools or data.
Verifiable statement
Each agent MUST have its own identity and a declared scope before operating: allowed operations, accessible data, action limit and delegation depth. The scope MUST NOT be broader than that of whoever invokes it. The scope MUST NOT be widened at runtime; changing it SHOULD imply a new identity. The system MUST be able to revoke an agent and SHOULD check revocation before each action.
Expected evidence
Versioned scope declarations; grant log; test of rejection outside scope; revocation test.
Exception
None for agents with external effects.
Residual risk
Within its legitimate scope, an agent can still cause harm; the minimal scope bounds it, not eliminates it.
An effect that is hard to reverse (payment, deletion, permission change, publication, decision about a person) happens without anyone seeing it; or, at the other extreme, approval is requested for everything and the person approves without reading.
Scope
Effects that the owner classifies as critical and decisions in an ambiguity zone.
Responsible actor
System owner (defines the catalog); approving person (decides).
Applicability condition
When an action belongs to the catalog of critical effects or the system cannot decide with its rules.
Verifiable statement
The system MUST maintain an explicit catalog of critical effects, which MUST consider at least payments or transfers, data deletion, permission changes, publication or sending to third parties, and decisions that affect people. Before executing one, it MUST obtain confirmation from an authorized person who sees what will be applied (diff, recipient, amount or affected object). The confirmation MUST be recorded with identity, date and approved object, and MUST NOT be reusable for another action. When the rules do not decide, the case SHOULD go to human review instead of being resolved with a default value. The requirement MUST NOT be presented as human review of all actions.
Expected evidence
Versioned catalog; approval records; proof that the action does not run without approval; metric of approval volume per person.
Exception
An emergency may authorize a critical effect without prior review only if the owner defined it beforehand and the review happens afterwards, recorded.
Residual risk
The person may approve out of fatigue, overconfidence or deception; an agent may present the action persuasively. Human review does not guarantee a good decision.
Agnostic requirement (applicable laws belong to the jurisdictional profile) · derives from ASILO-P-03
Status
accepted — ASILO 0.1 (28 Sep 2026)
Problem
Secrets or personal data enter the prompt, memory or logs; a model reveals them or a third party receives them without a basis.
Scope
Personal data, data of minors, credentials and confidential data that the system processes.
Responsible actor
System owner; person responsible for the data.
Applicability condition
Whenever the system processes any of that data.
Verifiable statement
Each data set MUST have classification, purpose, applicable basis or consent, retention, revocation and deletion mechanism, and owner. Credentials and keys MUST NOT enter a model's context; if it is necessary to act on someone's behalf, a single-use, minimal-scope credential SHOULD be used. Data of minors SHOULD be treated as sensitive. Detecting and blocking data MUST NOT be presented as anonymization.
Expected evidence
Data inventory; tests that secrets do not reach the model; retention policy; access log for the highest classification.
Exception
None for credentials. For personal data, the one established by the applicable legal basis, recorded.
Residual risk
Incomplete classification, inference of sensitive data from non-sensitive data, and re-identification. This requirement does not replace legal review.
External references
OWASP LLM02:2025 Sensitive Information Disclosure; OWASP ASI03; NIST AI 600-1 Data Privacy.
A looping or manipulated agent consumes tokens, money or actions without limit; when it is stopped, the state or the evidence of what it did is lost.
Scope
Agent runs and model calls with cost or effect.
Responsible actor
Owner of the agent system.
Applicability condition
Any automated run with cost or effects.
Verifiable statement
Each run MUST have declared limits on cost or tokens, number of actions and time. When a limit is exhausted, the run MUST stop or move to human review, never continue silently. The system MUST have a stop mechanism with a defined owner, tested in the environment where it is claimed to work. When stopped, it MUST preserve the log of what was executed and SHOULD allow resumption without repeating effects already applied.
Expected evidence
Limits per run; consumption log; stop test in the declared environment; resumption test.
Exception
Purely local runs with no cost or external effects.
Residual risk
Limits do not prevent the harm done before they are reached; a stop tested in simulation does not prove the stop in production.
It is claimed that a system “does not hallucinate,” “resists injections” or “avoids sycophancy” because it uses roles, a reviewer or a filter, without having measured it; errors that escape are not recorded.
Scope
Systems that use models to produce content, decisions or actions that others will use.
Responsible actor
System owner; assurance owner.
Applicability condition
Before claiming publicly or to a customer that the system is fit for its purpose, and at each relevant change of model or configuration.
Verifiable statement
The system MUST have an evaluation plan that covers, where applicable: (a) confabulation or hallucination; (b) direct and indirect prompt injection; (c) sycophancy under pressure from the person or from other agents; (d) multi-agent failures, if there is more than one agent. Each evaluation MUST record model and version, configuration, set of cases, method, result and residual risk. A system document MUST NOT claim that a risk on this list is eliminated or guaranteed by a control, role or architecture. Errors that escape the controls SHOULD be recorded in a log and feed the next evaluation. Edition 0.1 does not set numeric thresholds.
Internal prototypes without external users, marked as such; they cannot support public claims.
Residual risk
An evaluation covers the cases tested, not all possible ones; results change with the model. Sycophancy, confabulation and injection remain possible after any known control.
External references
NIST AI 600-1 Confabulation, Information Integrity, Human-AI Configuration; OWASP LLM01:2025, LLM09:2025 Misinformation; OWASP ASI07 Insecure Inter-Agent Communication, ASI08; MITRE ATLAS AML.T0051, AML.T0062 Discover LLM Hallucinations. Research: Sharma et al. 2023 (arXiv:2310.13548); Kalai et al. 2025 (arXiv:2509.04664); Cemri et al. 2025 (arXiv:2503.13657); preprints on sycophancy in multi-agent debate arXiv:2509.23055 and arXiv:2605.12991.