Skip to content
Open Intent Schema

12. Security and privacy considerations

This section is normative.

OIS records are evidence, so their main risks are forgery, tampering and leaking personal data.

12.1 Privacy

Section titled “12.1 Privacy”
  • Records MUST NOT contain personal data, apart from actor names and identifiers.
  • Human actors SHOULD be identified by pseudonyms that only the operating organization can resolve.
  • Test data MUST be referenced as dataset artifacts by location and digest, never embedded. Criterion statements and examples MUST NOT contain real personal data.
  • Datasets that contain personal data MUST be classified as production or anonymized, so that policies can detect them.

The identity of a human actor MUST be pseudonymous. OIDC identities that expose an e-mail address or a real name MUST NOT be recorded; organizations map pseudonymous subjects to people outside OIS.

12.2 Threats and mitigations

Section titled “12.2 Threats and mitigations”
Threat Mitigation
Forged evidence from an unknown recorder Consumers SHOULD only rely on evidence from signed bundles or passports, and SHOULD check that recordedBy is a known actor.
Actor impersonation, for example an agent posing as a human Actor identity SHOULD be bound to a credential such as a workload identity or a Sigstore OIDC identity. Level 3 requires this.
Self-declared context that hides what an agent saw context SHOULD be recorded by the runtime that ran the producer (contextRecordedBy), not by the producer itself. Validators flag self-declared context (R12).
Backdated or false timestamps Level 3 producers SHOULD record signatures in a transparency log, which gives an independent time and order (section 8.3).
Artifact changed after evidence was recorded Consumers SHOULD recompute artifact digests where the artifact is reachable and treat a mismatch as a failed check.
Replay of old evidence for a new intent version Evidence is bound to an intent version and criterion digest; the stale evidence rule applies (section 6.3).
Instructions hidden in criterion text Consumers that pass statements, rationales or extensions to AI models MUST treat them as untrusted data, not as instructions.
Leaking internal information through passports Producers SHOULD review what a passport reveals before sharing it outside the organization. Access control is out of scope.