Docs / Pattern Provenance
Every pattern, and what stands behind it.
166 governance patterns across 11 families, each with the mechanism that evaluates it, the tests that name it and the benchmark suite that exercises its family. The stronger the number, the stronger the evidence needs to be: this table is derived from the pattern registry and the source tree on every change, it is re-verified on every commit, and the machine reads the same thing at /patterns.json.
What the columns mean
A pattern can carry more than one mechanism. Strongest first: content scanner on the authorize path; a runtime detector bound to the pattern; a runtime monitor method that exists in the runtime; the sandbox test harness that evaluates a family against submitted inputs; a published detection method, blocking condition and test protocol; a detection expression published; and a deployment-surface mapping that informs cross-deployment learning. Tests counts the test files that name the pattern or its monitor. The suite column names the GovernanceBench suite whose scenarios carry the family, with its scenario count.
| Across the registry | Patterns |
|---|---|
| Loaded by the runtime | 166 |
| Evaluated by a runtime mechanism (scanner, detector or monitor) | 82 |
| Evaluated by the sandbox test harness | 53 |
| Detection method, blocking condition and test protocol published | 82 |
| Detection expression published | 26 |
| Deployment-surface mapping entries | 5 |
| Named by at least one test file | 74 |
| Family exercised by a benchmark suite | 125 |
prompt injection (INJ, 53)
Exercised by the ipi suite (5 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| INJ001 | direct_override | critical | sandbox test harness | 7 |
| INJ002 | direct_override | critical | sandbox test harness | 3 |
| INJ003 | direct_override | critical | sandbox test harness | 1 |
| INJ004 | direct_override | critical | sandbox test harness | 0 |
| INJ005 | direct_override | high | sandbox test harness | 0 |
| INJ006 | identity_attack | critical | sandbox test harness | 0 |
| INJ007 | identity_attack | high | sandbox test harness | 0 |
| INJ008 | identity_attack | high | sandbox test harness | 0 |
| INJ009 | identity_attack | critical | sandbox test harness | 0 |
| INJ010 | prompt_extraction | high | sandbox test harness | 1 |
| INJ011 | prompt_extraction | high | sandbox test harness | 0 |
| INJ012 | prompt_extraction | medium | sandbox test harness | 0 |
| INJ013 | privilege_escalation | critical | sandbox test harness | 0 |
| INJ014 | encoding_evasion | high | sandbox test harness | 0 |
| INJ015 | encoding_evasion | medium | sandbox test harness | 0 |
| INJ016 | exfiltration | critical | sandbox test harness | 1 |
| INJ017 | exfiltration | critical | sandbox test harness | 0 |
| INJ018 | multi_turn | medium | sandbox test harness | 0 |
| INJ019 | context_manipulation | medium | sandbox test harness | 0 |
| INJ020 | identity_suppression | critical | runtime detector bound to the pattern; sandbox test harness | 1 |
| INJ021 | capability_escalation_via_prompt | critical | sandbox test harness | 0 |
| INJ022 | memory_state_poisoning | high | sandbox test harness | 0 |
| INJ023 | context_reset | medium | sandbox test harness | 0 |
| INJ025 | zero_width | high | sandbox test harness | 0 |
| INJ026 | agent_prompt_self | critical | sandbox test harness | 0 |
| INJ027 | role_confusion | high | sandbox test harness | 0 |
| INJ024 | trace_poisoning | critical | sandbox test harness | 5 |
| INJ028 | governance_bypass | critical | sandbox test harness | 4 |
| INJ029 | sovereign_override_cache_bypass | critical | sandbox test harness | 2 |
| INJ030 | cross_model_filter_bypass | critical | runtime detector bound to the pattern; sandbox test harness | 3 |
| INJ031 | capability_escalation_autonomous | critical | runtime detector bound to the pattern; sandbox test harness | 1 |
| INJ032 | monitor_obfuscation | critical | runtime detector bound to the pattern; sandbox test harness | 3 |
| INJ033 | reckless_escalation | critical | runtime detector bound to the pattern; sandbox test harness | 1 |
| INJ034 | evaluation_awareness | high | runtime detector bound to the pattern; sandbox test harness | 1 |
| INJ035 | reward_hack_detection | high | runtime detector bound to the pattern; sandbox test harness | 4 |
| INJ036 | PERSISTENT_MEMORY_UNAUDITED | critical | sandbox test harness | 1 |
| INJ037 | SPAWNED_AGENT_GOVERNANCE_BYPASS | critical | sandbox test harness | 0 |
| INJ038 | SSE_STREAM_INJECTION | high | sandbox test harness | 0 |
| INJ039 | MODEL_ALIGNMENT_REMOVAL | critical | runtime detector bound to the pattern; sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ040 | ENVIRONMENT_DECEPTION | high | sandbox test harness | 0 |
| INJ041 | HUMAN_SUPERVISOR_MANIPULATION | high | sandbox test harness | 0 |
| INJ042 | QUANTUM_CRYPTOGRAPHIC_VULNERABILITY | medium | runtime detector bound to the pattern; sandbox test harness | 0 |
| INJ043 | CORPUS_INFERENCE_DETECTION | medium | sandbox test harness | 0 |
| INJ044 | BOUNDARY_PROBING_DETECTION | medium | sandbox test harness | 0 |
| INJ045 | MULTI_TURN_CUMULATIVE_SUPPRESSION | HIGH | runtime detector bound to the pattern; sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ046 | UNAUTHORIZED_AUTONOMOUS_RECON | high | sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ047 | AUTHORIZED_TOOL_IMPERSONATION | critical | runtime detector bound to the pattern; sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ048 | RECON_ESCALATION_WITHOUT_APPROVAL | high | sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ049 | CLOAK_INJECTION | critical | sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ050 | FEATURE_FLAG_BYPASS | high | sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ051 | MEMORY_POISONING | high | runtime detector bound to the pattern; sandbox test harness; detection method, blocking condition and test protocol published | 0 |
| INJ053 | CROSS_HARNESS_SESSION_EXFILTRATION | high | runtime detector bound to the pattern; sandbox test harness; detection method, blocking condition and test protocol published | 2 |
| INJ054 | ENCODING_RELAY_INJECTION | critical | runtime detector bound to the pattern; sandbox test harness; detection method, blocking condition and test protocol published | 0 |
supply chain (SC, 27)
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| SC001 | hook_network_call | high | detection expression published | 6 |
| SC002 | mcp_broad_permission | high | detection expression published | 1 |
| SC003 | settings_bash_wildcard | critical | detection expression published | 2 |
| SC004 | claude_md_override_attempt | critical | detection expression published | 0 |
| SC005 | skill_external_load | high | detection expression published | 0 |
| SC006 | hook_env_exfil | critical | detection expression published | 0 |
| SC007 | anthropic_base_url_override | critical | detection expression published | 0 |
| SC008 | mcp_auto_trust | high | detection expression published | 0 |
| SC009 | community_skill_unverified_link | medium | detection expression published | 0 |
| SC010 | dangerously_skip_permissions | critical | detection expression published | 0 |
| SC011 | async_hook_side_channel | medium | detection expression published | 0 |
| SC012 | agent_persona_injection | high | detection expression published | 0 |
| SC013 | axios_rat_compromised_version | critical | detection expression published | 0 |
| SC014 | rat_dropper_package | critical | detection expression published | 0 |
| SC015 | c2_beacon_domain | critical | detection expression published | 0 |
| SC016 | compromised_openclaw_package | critical | detection expression published | 0 |
| SC017 | c2_high_port_beacon | high | detection expression published | 0 |
| SC018 | caret_range_in_dependency | high | detection expression published | 0 |
| SC019 | postinstall_script | medium | detection expression published | 0 |
| SC020 | identity_suppression_injection | critical | detection expression published | 0 |
| SC021 | typosquatting_detection | high | detection expression published | 3 |
| SC022 | maintainer_takeover_signal | high | detection expression published | 0 |
| SC023 | native_addon_binary | medium | detection expression published | 0 |
| SC024 | obfuscated_payload | high | detection expression published | 0 |
| SC025 | dns_exfiltration | high | detection expression published | 0 |
| SC026 | dependency_confusion | high | detection expression published | 3 |
| SC027 | supply_chain_dependency_injection | critical | runtime detector bound to the pattern | 0 |
algorithmic trading (ALGO, 12)
Exercised by the algo-trading suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| ALGO-001 | runaway_order_velocity | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (order_velocity) | 2 |
| ALGO-002 | position_concentration | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (position_concentration) | 7 |
| ALGO-003 | strategy_drift | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (strategy_drift) | 3 |
| ALGO-004 | spoofing_pattern | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (spoofing_pattern) | 3 |
| ALGO-005 | cross_venue_exposure | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (cross_venue_exposure) | 3 |
| ALGO-006 | fat_finger_order | critical | runtime monitor method; detection method, blocking condition and test protocol published (order_velocity) | 2 |
| ALGO-007 | model_version_swap | critical | runtime monitor method; detection method, blocking condition and test protocol published (strategy_drift) | 3 |
| ALGO-008 | fictitious_offset | critical | runtime monitor method; detection method, blocking condition and test protocol published (position_concentration) | 7 |
| ALGO-009 | liquidity_withdrawal | high | runtime monitor method; detection method, blocking condition and test protocol published (cross_venue_exposure) | 2 |
| ALGO-010 | circuit_breaker_override | critical | runtime monitor method; detection method, blocking condition and test protocol published (order_velocity) | 2 |
| ALGO-011 | drawdown_breach | critical | runtime monitor method; detection method, blocking condition and test protocol published (position_concentration) | 7 |
| ALGO-012 | deployment_gate | critical | runtime monitor method; detection method, blocking condition and test protocol published (order_velocity) | 2 |
autonomous vehicle fleet (AV, 10)
Exercised by the av-fleet suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| AV-001 | odd_violation | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (odd_violation) | 5 |
| AV-002 | perception_degradation | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (perception_degradation) | 2 |
| AV-003 | emergency_response_failure | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (emergency_response_failure) | 3 |
| AV-004 | pedestrian_detection_gap | critical | detection method, blocking condition and test protocol published (pedestrian_detection_gap) | 0 |
| AV-005 | fleet_cascade_failure | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (fleet_cascade) | 2 |
| AV-006 | school_zone_violation | critical | detection method, blocking condition and test protocol published (school_zone_violation) | 0 |
| AV-007 | construction_zone_breach | high | detection method, blocking condition and test protocol published (construction_zone_breach) | 0 |
| AV-008 | sgo_reporting_delay | high | detection method, blocking condition and test protocol published (sgo_reporting_delay) | 0 |
| AV-009 | weather_adaptation_failure | high | detection method, blocking condition and test protocol published (weather_adaptation_failure) | 0 |
| AV-010 | remote_intervention_timeout | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (remote_intervention_timeout) | 2 |
cloud infrastructure (CLOUD, 10)
Exercised by the cloud-infrastructure suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| CLOUD-001 | metadata_endpoint_probe | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (metadata) | 118 |
| CLOUD-002 | iam_privilege_escalation | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (iam_escalation) | 1 |
| CLOUD-003 | storage_enumeration | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (storage_enumeration) | 1 |
| CLOUD-004 | kubernetes_api_abuse | critical | runtime detector bound to the pattern; detection method, blocking condition and test protocol published (kubernetes_api) | 0 |
| CLOUD-005 | credential_exfiltration | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (cloud_credential_exfiltration) | 2 |
| CLOUD-006 | action_boundary_violation | critical | runtime monitor method; detection method, blocking condition and test protocol published (iam_escalation) | 1 |
| CLOUD-007 | blast_radius_systemic_action | critical | runtime monitor method; detection method, blocking condition and test protocol published (storage_enumeration) | 1 |
| CLOUD-008 | credential_scope_overbroad | high | runtime monitor method; detection method, blocking condition and test protocol published (iam_escalation) | 1 |
| CLOUD-009 | privilege_scope_drift | high | runtime monitor method; detection method, blocking condition and test protocol published (iam_escalation) | 1 |
| CLOUD-010 | cross_account_boundary_crossing | high | runtime monitor method; detection method, blocking condition and test protocol published (storage_enumeration) | 1 |
industrial control systems (ICS, 10)
Exercised by the industrial-iot suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| ICS-001 | process_variable_deviation | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (process_variable_deviation) | 2 |
| ICS-002 | unauthorized_setpoint_change | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (unauthorized_setpoint_change) | 2 |
| ICS-003 | controller_firmware_tampering | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (controller_firmware_tampering) | 2 |
| ICS-004 | plc_command_injection | critical | detection method, blocking condition and test protocol published (plc_command_injection) | 0 |
| ICS-005 | safety_system_override | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (safety_system_override) | 2 |
| ICS-006 | network_segmentation_breach | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (network_segmentation_breach) | 2 |
| ICS-007 | unscheduled_maintenance_window | high | detection method, blocking condition and test protocol published (unscheduled_maintenance_window) | 0 |
| ICS-008 | sensor_data_manipulation | critical | detection method, blocking condition and test protocol published (sensor_data_manipulation) | 0 |
| ICS-009 | cascading_shutdown_propagation | critical | detection method, blocking condition and test protocol published (cascading_shutdown_propagation) | 0 |
| ICS-010 | air_gap_violation | critical | detection method, blocking condition and test protocol published (air_gap_violation) | 0 |
medical device (MED, 10)
Exercised by the medical-device suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| MED-001 | algorithm_drift | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (algorithm_drift) | 2 |
| MED-002 | population_shift | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (population_shift) | 2 |
| MED-003 | dosage_boundary_violation | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (dosage_boundary) | 6 |
| MED-004 | unauthorized_model_update | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (unauthorized_model_update) | 2 |
| MED-005 | audit_gap | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (audit_gap) | 0 |
| MED-006 | alert_fatigue | high | detection method, blocking condition and test protocol published (alert_fatigue) | 0 |
| MED-007 | consent_boundary_violation | critical | detection method, blocking condition and test protocol published (consent_boundary) | 0 |
| MED-008 | interoperability_failure | high | detection method, blocking condition and test protocol published (interoperability_failure) | 0 |
| MED-009 | recall_response_failure | critical | runtime monitor method; detection method, blocking condition and test protocol published (recall_response) | 3 |
| MED-010 | validation_gap | high | detection method, blocking condition and test protocol published (validation_gap) | 0 |
payments and fintech (PAY, 10)
Exercised by the payments-fintech suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| PAY-001 | refund_limit_breach | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (refund_limit_breach) | 1 |
| PAY-002 | unauthorized_fund_movement | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (unauthorized_fund_movement) | 1 |
| PAY-003 | risk_rule_tampering | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (risk_rule_tampering) | 1 |
| PAY-004 | payment_velocity_anomaly | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (payment_velocity_anomaly) | 1 |
| PAY-005 | payout_destination_drift | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (payout_destination_drift) | 1 |
| PAY-006 | sanctions_screening_bypass | critical | runtime monitor method; detection method, blocking condition and test protocol published (risk_rule_tampering) | 0 |
| PAY-007 | chargeback_manipulation | high | runtime monitor method; detection method, blocking condition and test protocol published (risk_rule_tampering) | 0 |
| PAY-008 | card_account_enumeration | high | runtime monitor method; detection method, blocking condition and test protocol published (payment_velocity_anomaly) | 0 |
| PAY-009 | ledger_reconciliation_divergence | high | runtime monitor method; detection method, blocking condition and test protocol published (unauthorized_fund_movement) | 0 |
| PAY-010 | cross_merchant_credential_reuse | high | runtime monitor method; detection method, blocking condition and test protocol published (payout_destination_drift) | 0 |
RPA automation (RPA, 10)
Exercised by the rpa-governance suite (20 scenarios).
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| RPA-001 | bot_loop | critical | runtime monitor method; detection method, blocking condition and test protocol published (frequency_spike) | 6 |
| RPA-002 | unauthorized_system_access | critical | runtime monitor method; detection method, blocking condition and test protocol published (scope_escalation) | 4 |
| RPA-003 | credential_reuse | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (identity_drift) | 5 |
| RPA-004 | process_escalation | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (tier_escalation) | 4 |
| RPA-005 | data_exfiltration | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (external_destination) | 3 |
| RPA-006 | schedule_violation | medium | runtime monitor method; detection method, blocking condition and test protocol published (time_anomaly) | 0 |
| RPA-007 | configuration_drift | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (config_drift) | 2 |
| RPA-008 | lateral_movement | critical | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (lateral_movement) | 4 |
| RPA-009 | volume_anomaly | high | runtime monitor method; detection method, blocking condition and test protocol published (frequency_spike) | 6 |
| RPA-010 | unattended_spawning | high | runtime detector bound to the pattern; runtime monitor method; detection method, blocking condition and test protocol published (unattended_spawning) | 2 |
API key exposure (KEY, 9)
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| KEY001 | runtime detector bound to the pattern | 0 | ||
| KEY002 | runtime detector bound to the pattern | 0 | ||
| KEY003 | runtime detector bound to the pattern | 0 | ||
| KEY004 | runtime detector bound to the pattern | 0 | ||
| KEY005 | runtime detector bound to the pattern | 0 | ||
| KEY006 | runtime detector bound to the pattern | 0 | ||
| KEY007 | runtime detector bound to the pattern | 0 | ||
| KEY008 | runtime detector bound to the pattern | 0 | ||
| KEY009 | runtime detector bound to the pattern | 0 |
personal edge (PE, 5)
| Pattern | Type | Severity | Mechanism | Tests |
|---|---|---|---|---|
| PE001 | BEHAVIORAL_DATA_EXFILTRATION | critical | deployment-surface mapping | 2 |
| PE002 | BIOMETRIC_INFERENCE_ESCALATION | critical | deployment-surface mapping | 0 |
| PE003 | OBSERVATION_ZONE_BYPASS | high | deployment-surface mapping | 0 |
| PE004 | CONSENT_BOUNDARY_VIOLATION | critical | deployment-surface mapping | 0 |
| PE005 | PHYSICAL_SAFETY_OVERRIDE_FAILURE | critical | deployment-surface mapping | 1 |