diff --git a/README.md b/README.md
index bde565f..af0d175 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ Every file answers one question: **which controls from framework X address vulne
 | **<!-- stats:frameworks-mapped -->26<!-- /stats -->** frameworks | Compliance · Governance · Threat modeling · Testing · OT/ICS · Identity · Secure SDLC · Financial |
 | **<!-- stats:mapping-files -->77<!-- /stats -->** mapping files | Every source list entry × every applicable framework |
 | **Mapping review state** | <!-- stats:frameworks-draft -->2 of 26 carry candidate DRAFT rows only — CoSAI · EU AI Act Code of Practice<!-- /stats --> — see [docs/SCHEMA_V2_MIGRATION.md](docs/SCHEMA_V2_MIGRATION.md) |
-| **Framework freshness** | <!-- stats:freshness -->3 current · 2 behind upstream · 21 unchecked<!-- /stats --> — see [docs/FRESHNESS_SLA.md](docs/FRESHNESS_SLA.md) |
+| **Framework freshness** | <!-- stats:freshness -->4 current · 1 behind upstream · 21 unchecked<!-- /stats --> — see [docs/FRESHNESS_SLA.md](docs/FRESHNESS_SLA.md) |
 | **21** implementation recipes | Production-ready Python patterns |
 | **70+** open-source tools | Catalogued and organised by function |
 | **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries |
diff --git a/agentic-top10/Agentic_ASVS.md b/agentic-top10/Agentic_ASVS.md
index 28b688e..3bf204b 100644
--- a/agentic-top10/Agentic_ASVS.md
+++ b/agentic-top10/Agentic_ASVS.md
@@ -1,7 +1,7 @@
 <!--
   OWASP GenAI Crosswalk
   Source list : OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10)
-  Framework   : OWASP Application Security Verification Standard (ASVS) 4.0.3
+  Framework   : OWASP Application Security Verification Standard (ASVS) 5.0.0
   Version     : 2026-Q1
   Maintained by: OWASP GenAI Data Security Initiative — https://genai.owasp.org
   License     : CC BY-SA 4.0
@@ -17,12 +17,16 @@ to the
 the framework for testing and verifying web application and API
 security, organised into 14 chapters with three verification levels.
 
-> **Mapped against ASVS 4.0.3.** ASVS **5.0.0** is released and renumbered the
-> requirements, so the V-numbers below do not reliably denote the same
-> requirement in 5.0. These mappings are **not** current for 5.0 and have not
-> been re-mapped: doing so is expert work, tracked in
-> [issue #22](https://github.com/GenAI-Security-Project/crosswalk/issues/22).
-> Treat the requirement identifiers here as 4.0.3 identifiers.
+> **Mapped against ASVS 5.0.0.** The identifiers below were translated from 4.0.3
+> using the ASVS project’s own mapping file, [`mapping_v4.0.3_to_v5.0.0.yml`][asvs-map],
+> and the requirement text is 5.0.0’s own. The translation is mechanical: the
+> **relationship, rationale type and confidence on every row read `DRAFT`** and
+> await an ASVS-leadership reviewer ([#22][issue-22], STRAT-04). Requirements
+> 5.0.0 deleted rather than renumbered keep their 4.0.3 identifier and carry a
+> DRAFT marker naming the official disposition.
+
+[asvs-map]: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml
+[issue-22]: https://github.com/GenAI-Security-Project/crosswalk/issues/22
 
 ---
 
@@ -128,13 +132,13 @@ vulnerability class fully covered by V5.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify all user input validated against allowlist | V5.1.1 | L1 | All inputs to agents validated — indirect injection through processed content equally in scope |
-| Verify output encoding prevents injection | V5.2.1 | L1 | Agent responses encoded before passing to downstream renderers — outputs treated as untrusted |
-| Verify application protects against OS command injection | V5.2.5 | L1 | Agent-generated instructions not executed in system context without validation |
-| Threat modelling of all data flows | V1.1.2 | L2 | All agent input sources threat-modelled — every indirect injection path documented |
-| Verify business logic limits prevent function abuse | V11.1.2 | L2 | Business logic controls prevent injection from redirecting agent goal |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | V15.3.7 | L1 | All inputs to agents validated — indirect injection through processed content equally in scope | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | V1.3.1 | L1 | Agent responses encoded before passing to downstream renderers — outputs treated as untrusted | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | V1.3.7 | L1 | Agent-generated instructions not executed in system context without validation | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Threat modelling of all data flows | V1.1.2 | L2 | All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Business logic controls prevent injection from redirecting agent goal | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -184,13 +188,13 @@ least privilege (V4.1.3) applies to every agent tool integration.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify access control enforces least privilege | V4.1.3 | L1 | Agent tool access scoped to minimum required operations — read-only by default, write access formally approved |
-| Verify all sensitive functions have access control | V4.1.1 | L1 | All destructive tool operations require explicit authorisation — not inheritable from agent session |
-| Verify all business logic decisions logged | V7.2.2 | L2 | All tool invocations logged — tool identity, parameters, agent session, timestamp |
-| Verify business logic abuse scenarios identified | V11.1.2 | L2 | Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified |
-| Verify API rate limiting | V13.1.1 | L1 | Tool API endpoints rate-limited — anomalous invocation frequency detected |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | Agent tool access scoped to minimum required operations — read-only by default, write access formally approved | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | V8.3.1 | L1 | All destructive tool operations require explicit authorisation — not inheritable from agent session | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself). | V16.3.2 | L2 | All tool invocations logged — tool identity, parameters, agent session, timestamp | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify API rate limiting | V1.5.3 | L1 | Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks. | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -240,13 +244,13 @@ agent credential management.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify credentials not in source code | V2.1.1 | L1 | Agent credentials not hardcoded — secret manager required |
-| Verify access control enforces least privilege | V4.1.3 | L1 | Agent credential scope minimum required — no over-privileged NHIs |
-| Verify sensitive data encrypted at rest | V6.1.1 | L2 | Agent credentials encrypted at rest — no cleartext in config or agent memory |
-| Verify access control decisions logged | V7.2.1 | L2 | All credential usage logged — issuance, access, expiry detectable |
-| Verify secrets not in source code | V14.2.3 | L2 | Agent credentials not committed to source control |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended. | V6.2.1 | L1 | Agent credentials not hardcoded — secret manager required | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | Agent credential scope minimum required — no over-privileged NHIs | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | V14.1.1 | L2 | Agent credentials encrypted at rest — no cleartext in config or agent memory | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected. | V16.3.1 | L2 | All credential usage logged — issuance, access, expiry detectable | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource. | V3.6.1 | L2 | Agent credentials not committed to source control | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -293,12 +297,12 @@ govern agent components as software supply chain elements.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify third-party components current and free of vulnerabilities | V10.2.1 | L2 | All agent component libraries scanned for CVEs — ML SBOM maintained and monitored |
-| Verify only minimal approved external libraries | V10.2.2 | L2 | Approved component list — unsigned or unverified agent components rejected |
-| Verify build pipelines include security checks | V14.2.2 | L2 | CI/CD pipeline for agent components includes integrity verification and CVE scanning |
-| Verify threat model covers all data flows | V1.1.2 | L2 | Supply chain threat model documents all agent component sources and trust levels |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify third-party components current and free of vulnerabilities | V10.2.1 | L2 | All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify only minimal approved external libraries | V10.2.2 | L2 | Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended. | V13.4.5 | L2 | CI/CD pipeline for agent components includes integrity verification and CVE scanning | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify threat model covers all data flows | V1.1.2 | L2 | Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -347,13 +351,13 @@ without validation.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify output encoding of untrusted data in HTML context | V5.2.1 | L1 | Agent code output encoded before rendering in any context |
-| Verify application does not use eval or dynamic code | V5.2.4 | L1 | No eval or exec of agent-generated code — absolute prohibition enforced in code review |
-| Verify output encoding in OS command context | V5.2.5 | L1 | Agent-generated commands validated before any shell execution |
-| Verify output encoding in SQL context | V5.3.5 | L1 | No raw agent output in SQL context — parameterised execution only |
-| Verify business logic limits | V11.1.2 | L2 | Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | V1.3.1 | L1 | Agent code output encoded before rendering in any context | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed. | V1.3.2 | L1 | No eval or exec of agent-generated code — absolute prohibition enforced in code review | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | V1.3.7 | L1 | Agent-generated commands validated before any shell execution | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures. | V1.2.4 | L1 | No raw agent output in SQL context — parameterised execution only | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -403,12 +407,12 @@ access control.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify all user input validated against allowlist | V5.1.1 | L1 | All content entering agent memory validated — injection patterns rejected at write boundary |
-| Verify access control enforces least privilege | V4.1.3 | L1 | Memory write access restricted to minimum required sources — only agent and authorised administrators can write |
-| Verify sensitive data encrypted at rest | V6.1.1 | L2 | Agent memory stores encrypted at rest — embeddings, long-term memory |
-| Verify file upload malware scanning | V12.1.1 | L2 | Content entering agent memory scanned — adversarial content, injection patterns detected before write |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | V15.3.7 | L1 | All content entering agent memory validated — injection patterns rejected at write boundary | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | Memory write access restricted to minimum required sources — only agent and authorised administrators can write | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | V14.1.1 | L2 | Agent memory stores encrypted at rest — embeddings, long-term memory | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack. | V5.2.1 | L2 | Content entering agent memory scanned — adversarial content, injection patterns detected before write | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -457,12 +461,12 @@ session integrity.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify TLS used for all client connectivity | V9.1.1 | L1 | All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages |
-| Verify anti-replay tokens in state-changing operations | V3.3.1 | L1 | Replay protection on all A2A messages — nonces, timestamps, sequence numbers |
-| Verify access control enforces identity | V4.1.3 | L1 | A2A channels enforce sender identity — unauthenticated messages rejected |
-| Verify all security controls logged | V7.2.1 | L2 | All A2A messages logged — sender identity, content hash, schema validation results |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications. | V12.2.1 | L1 | All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key. | V7.4.1 | L1 | Replay protection on all A2A messages — nonces, timestamps, sequence numbers | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | A2A channels enforce sender identity — unauthenticated messages rejected | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected. | V16.3.1 | L2 | All A2A messages logged — sender identity, content hash, schema validation results | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -507,12 +511,12 @@ cascade prevention as business logic abuse and API resilience.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify business logic assumptions documented | V11.1.1 | L2 | Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted |
-| Verify business logic limits prevent abuse | V11.1.2 | L2 | Circuit breakers as business logic controls — cascade propagation limited by design |
-| Verify API rate limiting | V13.1.1 | L1 | Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited |
-| Verify error handling does not expose sensitive data | V7.4.1 | L1 | Cascade errors handled gracefully — no sensitive system information in error responses |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps. | V2.3.1 | L2 | Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Circuit breakers as business logic controls — cascade propagation limited by design | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify API rate limiting | V1.5.3 | L1 | Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks. | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens. | V16.5.1 | L1 | Cascade errors handled gracefully — no sensitive system information in error responses | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -561,12 +565,12 @@ decision-making process.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify business logic assumptions documented | V11.1.1 | L2 | AI advisory limitations documented as business logic assumptions — verification requirements per domain |
-| Verify outputs encoded before rendering | V5.2.1 | L1 | Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content |
-| Verify all security controls logged | V7.4.1 | L1 | Agent-influenced operator decisions logged — aggregate patterns detectable |
-| Verify API rejects large unexpected payloads | V13.1.3 | L1 | Approval flows independent of agent interface — no state-changing approvals via agent chat |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps. | V2.3.1 | L2 | AI advisory limitations documented as business logic assumptions — verification requirements per domain | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | V1.3.1 | L1 | Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens. | V16.5.1 | L1 | Agent-influenced operator decisions logged — aggregate patterns detectable | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token. | V14.2.1 | L1 | Approval flows independent of agent interface — no state-changing approvals via agent chat | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -618,12 +622,12 @@ Without complete audit trails, rogue behaviour cannot be detected.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify access control decisions logged | V7.2.1 | L2 | All agent actions logged — no production deployment without complete observability |
-| Verify all business logic decisions logged | V7.2.2 | L2 | All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis |
-| Verify business logic limits prevent abuse | V11.1.2 | L2 | Scope constraints as business logic controls — rogue agent cannot exceed permission envelope |
-| Verify API rate limiting | V13.1.1 | L1 | Rate limiting prevents rogue agent from amplifying impact through API exhaustion |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected. | V16.3.1 | L2 | All agent actions logged — no production deployment without complete observability | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself). | V16.3.2 | L2 | All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Scope constraints as business logic controls — rogue agent cannot exceed permission envelope | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify API rate limiting | V1.5.3 | L1 | Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks. | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -711,10 +715,10 @@ Without complete audit trails, rogue behaviour cannot be detected.
 
 | Phase | ASI entries | ASVS level | Priority requirements |
 |---|---|---|---|
-| 1 — L1 baseline | ASI01, ASI02, ASI05, ASI08 | L1 | V5.1.1, V4.1.3, V5.2.4, V13.1.1 |
-| 2 — L1 complete | ASI03, ASI07, ASI09 | L1 | V2.1.1, V9.1.1, V3.3.1, V5.2.1 |
-| 3 — L2 standard | ASI04, ASI06, ASI10 | L2 | V10.2.1, V7.2.1/V7.2.2, V6.1.1 |
-| 4 — L2 complete | ASI08, ASI09 | L2 | V11.1.1, V11.1.2 |
+| 1 — L1 baseline | ASI01, ASI02, ASI05, ASI08 | L1 | V15.3.7, V8.2.1, V1.3.2, V1.5.3 |
+| 2 — L1 complete | ASI03, ASI07, ASI09 | L1 | V6.2.1, V12.2.1, V7.4.1, V1.3.1 |
+| 3 — L2 standard | ASI04, ASI06, ASI10 | L2 | V10.2.1, V16.3.1/V16.3.2, V14.1.1 |
+| 4 — L2 complete | ASI08, ASI09 | L2 | V2.3.1, V2.4.2 |
 | 5 — L3 advanced | All | L3 | Adversarial testing, red team, chaos engineering |
 
 ---
diff --git a/data/backlinks.json b/data/backlinks.json
index a8afcc9..e5f09bb 100644
--- a/data/backlinks.json
+++ b/data/backlinks.json
@@ -30526,31 +30526,6 @@
       }
     ]
   },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V1 Architecture",
-    "control_name": "V1.1.4 — Trust boundaries documented and enforced",
-    "entries": [
-      {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      },
-      {
-        "id": "DSGAI16",
-        "name": "Endpoint and Browser Overreach",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
   {
     "framework": "OWASP ASVS 4.0.3",
     "control_id": "V1.1.2",
@@ -30563,7 +30538,7 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM data flows threat-modelled — all injection paths identified and documented"
+        "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
         "id": "ASI01",
@@ -30572,7 +30547,7 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All agent input sources threat-modelled — every indirect injection path documented"
+        "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
         "id": "ASI04",
@@ -30581,175 +30556,200 @@
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Supply chain threat model documents all agent component sources and trust levels"
+        "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
+      },
+      {
+        "id": "DSGAI16",
+        "name": "Endpoint and Browser Overreach",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V10 Malicious Code",
-    "control_name": "V10.2.1 — Application only uses official repositories",
+    "control_id": "V1.1.4",
+    "control_name": "Trust boundaries documented and enforced",
     "entries": [
       {
-        "id": "DSGAI04",
-        "name": "Data Model and Artifact Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": null
-      },
-      {
-        "id": "DSGAI20",
-        "name": "Model Exfiltration and IP Replication",
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V10.2.1",
-    "control_name": "Verify third-party components are current and free from vulnerabilities",
+    "control_id": "V1.2.4",
+    "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
     "entries": [
       {
-        "id": "LLM04",
-        "name": "Supply Chain",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained"
+        "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context"
       },
       {
-        "id": "LLM05",
-        "name": "Data and Model Poisoning",
-        "source_list": "LLM-Top10-2026",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
+        "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Training pipeline components scanned — compromised dependencies rejected"
+        "notes": "No raw agent output in SQL context — parameterised execution only"
       },
       {
-        "id": "ASI04",
-        "name": "Agentic Supply Chain",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "High",
+        "id": "DSGAI12",
+        "name": "Unsafe Natural Language Data Gateways",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
         "tier": "Foundational",
-        "scope": "Both",
-        "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored"
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V10.2.2",
-    "control_name": "Verify only minimal approved external libraries are used",
+    "control_id": "V1.3.1",
+    "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
     "entries": [
       {
-        "id": "LLM04",
-        "name": "Supply Chain",
+        "id": "LLM01",
+        "name": "Prompt Injection",
         "source_list": "LLM-Top10-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected"
+        "notes": "LLM output encoding before passing to downstream renderers or interpreters"
       },
       {
-        "id": "ASI04",
-        "name": "Agentic Supply Chain",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM07",
+        "name": "Misinformation",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approved component list — unsigned or unverified agent components rejected"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11 Business Logic",
-    "control_name": "V11.1.4 — Business logic limits on repeated actions",
-    "entries": [
+        "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source"
+      },
       {
-        "id": "DSGAI06",
-        "name": "Tool Plugin and Agent Data Exchange",
-        "source_list": "DSGAI-2026",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "LLM responses rendered in browser contexts encoded against XSS"
       },
       {
-        "id": "DSGAI16",
-        "name": "Endpoint and Browser Overreach",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI01",
+        "name": "Agent Goal Hijack",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted"
       },
       {
-        "id": "DSGAI17",
-        "name": "Data Availability and Resilience Failures",
-        "source_list": "DSGAI-2026",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Agent code output encoded before rendering in any context"
+      },
+      {
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content"
       },
       {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
+        "id": "DSGAI05",
+        "name": "Data Integrity and Validation Failures",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
+        "tier": "Foundational",
+        "scope": "Build",
         "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11.1.1",
-    "control_name": "Verify business logic assumptions documented",
+    "control_id": "V1.3.2",
+    "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
     "entries": [
       {
-        "id": "LLM07",
-        "name": "Misinformation",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined"
+        "notes": "No eval or dynamic code execution of LLM-generated content"
       },
       {
-        "id": "ASI08",
-        "name": "Cascading Agent Failures",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted"
-      },
+        "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review"
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V1.3.5",
+    "control_name": "Output encoding for context",
+    "entries": [
       {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "High",
+        "id": "DSGAI01",
+        "name": "Sensitive Data Leakage",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain"
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V1.3.6",
+    "control_name": "Defined output structure",
+    "entries": [
+      {
+        "id": "DSGAI10",
+        "name": "Synthetic Data and Anonymization Pitfalls",
+        "source_list": "DSGAI-2026",
+        "severity": "Medium",
+        "tier": "Hardening",
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11.1.2",
-    "control_name": "Verify business logic limits prevent abuse of LLM functions",
+    "control_id": "V1.3.7",
+    "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
     "entries": [
       {
         "id": "LLM01",
@@ -30758,16 +30758,16 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions"
+        "notes": "LLM-generated content validated before execution in any shell or interpreter context"
       },
       {
-        "id": "LLM03",
-        "name": "Excessive Agency",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls preventing tool misuse through prompt manipulation"
+        "notes": "LLM-generated commands validated — never raw output in shell context"
       },
       {
         "id": "ASI01",
@@ -30776,25 +30776,50 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls prevent injection from redirecting agent goal"
+        "notes": "Agent-generated instructions not executed in system context without validation"
       },
       {
-        "id": "ASI02",
-        "name": "Tool Misuse and Exploitation",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Agent-generated commands validated before any shell execution"
+      },
+      {
+        "id": "DSGAI09",
+        "name": "Multimodal Cross-Channel Leakage",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V1.5.3",
+    "control_name": "Verify API rate limiting",
+    "entries": [
+      {
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
       },
       {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
+        "id": "ASI02",
+        "name": "Tool Misuse and Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
       },
       {
         "id": "ASI08",
@@ -30803,7 +30828,7 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Circuit breakers as business logic controls — cascade propagation limited by design"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
       },
       {
         "id": "ASI10",
@@ -30812,108 +30837,110 @@
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
+      },
+      {
+        "id": "DSGAI12",
+        "name": "Unsafe Natural Language Data Gateways",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11.1.4",
-    "control_name": "Verify business logic rate limits",
+    "control_id": "V10.2.1",
+    "control_name": "Verify third-party components are current and free from vulnerabilities",
     "entries": [
       {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
+        "id": "LLM04",
+        "name": "Supply Chain",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V12 Files/Resources",
-    "control_name": "V12.1.1 — File upload size limits",
-    "entries": [
+        "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
+      },
       {
-        "id": "DSGAI04",
-        "name": "Data Model and Artifact Poisoning",
-        "source_list": "DSGAI-2026",
+        "id": "LLM05",
+        "name": "Data and Model Poisoning",
+        "source_list": "LLM-Top10-2026",
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI09",
-        "name": "Multimodal Cross-Channel Leakage",
-        "source_list": "DSGAI-2026",
+        "id": "ASI04",
+        "name": "Agentic Supply Chain",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI13",
-        "name": "Vector Store Platform Security",
+        "id": "DSGAI04",
+        "name": "Data Model and Artifact Poisoning",
         "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
+        "severity": "Critical",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V12.1.1",
-    "control_name": "Verify file uploads scanned for malware",
+    "control_id": "V10.2.2",
+    "control_name": "Verify only minimal approved external libraries are used",
     "entries": [
       {
-        "id": "LLM05",
-        "name": "Data and Model Poisoning",
+        "id": "LLM04",
+        "name": "Supply Chain",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
+        "severity": "High",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "Training data uploads scanned before ingestion — adversarial content detected"
+        "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "LLM09",
-        "name": "Vector and Embedding Weaknesses",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Medium",
+        "id": "ASI04",
+        "name": "Agentic Supply Chain",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
+      },
+      {
+        "id": "DSGAI04",
+        "name": "Data Model and Artifact Poisoning",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Content validation on all vector store ingestion — adversarial content detected"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI20",
+        "name": "Model Exfiltration and IP Replication",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V13 API",
-    "control_name": "V13.1.1 — API protection against enumeration",
+    "control_id": "V11.1.7",
+    "control_name": "Anti-automation controls",
     "entries": [
-      {
-        "id": "DSGAI12",
-        "name": "Unsafe Natural Language Data Gateways",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
-      },
       {
         "id": "DSGAI17",
         "name": "Data Availability and Resilience Failures",
@@ -30921,88 +30948,70 @@
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V13.1.1",
-    "control_name": "Verify API rate limiting",
+    "control_id": "V12.2.1",
+    "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
     "entries": [
       {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key"
+        "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum"
       },
       {
-        "id": "ASI02",
-        "name": "Tool Misuse and Exploitation",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
         "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected"
+        "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages"
       },
       {
-        "id": "ASI08",
-        "name": "Cascading Agent Failures",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
+        "id": "DSGAI06",
+        "name": "Tool Plugin and Agent Data Exchange",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited"
-      },
-      {
-        "id": "ASI10",
-        "name": "Rogue Agents",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion"
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V13.1.3",
-    "control_name": "Verify API rejects large unexpected payloads",
+    "control_id": "V13.1.2",
+    "control_name": "API throttling",
     "entries": [
       {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway"
-      },
-      {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI17",
+        "name": "Data Availability and Resilience Failures",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V14 Configuration",
-    "control_name": "V14.1.4 — All components inventoried",
+    "control_id": "V13.2.1",
+    "control_name": "Integration secrets not hardcoded",
     "entries": [
       {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
+        "id": "DSGAI02",
+        "name": "Agent Identity and Credential Exposure",
         "source_list": "DSGAI-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
         "notes": null
@@ -31011,8 +31020,8 @@
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V14.2.2",
-    "control_name": "Verify build pipelines include security checks",
+    "control_id": "V13.4.5",
+    "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
     "entries": [
       {
         "id": "LLM04",
@@ -31036,17 +31045,26 @@
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V14.2.3",
-    "control_name": "Verify secrets not in source code",
+    "control_id": "V14.1.1",
+    "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
     "entries": [
       {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "System prompts not hardcoded in source code — stored in secret management system"
+        "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy"
+      },
+      {
+        "id": "LLM09",
+        "name": "Vector and Embedding Weaknesses",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Medium",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "All vector store content encrypted at rest"
       },
       {
         "id": "ASI03",
@@ -31055,18 +31073,20 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent credentials not committed to source control"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V2 Authentication",
-    "control_name": "V2.1.1 — Passwords minimum 12 characters",
-    "entries": [
+        "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory"
+      },
       {
-        "id": "DSGAI02",
-        "name": "Agent Identity and Credential Exposure",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory"
+      },
+      {
+        "id": "DSGAI01",
+        "name": "Sensitive Data Leakage",
         "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Foundational",
@@ -31074,37 +31094,98 @@
         "notes": null
       },
       {
-        "id": "DSGAI19",
-        "name": "Human-in-Loop and Labeler Overexposure",
+        "id": "DSGAI07",
+        "name": "Data Governance and Lifecycle",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
+      },
+      {
+        "id": "DSGAI10",
+        "name": "Synthetic Data and Anonymization Pitfalls",
         "source_list": "DSGAI-2026",
         "severity": "Medium",
+        "tier": "Hardening",
+        "scope": "Build",
+        "notes": null
+      },
+      {
+        "id": "DSGAI13",
+        "name": "Vector Store Platform Security",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
         "notes": null
+      },
+      {
+        "id": "DSGAI18",
+        "name": "Inference and Data Reconstruction",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V2.1.1",
-    "control_name": "Verify credentials not in source code",
+    "control_id": "V14.1.2",
+    "control_name": "Data transferred using current TLS",
     "entries": [
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI02",
+        "name": "Agent Identity and Credential Exposure",
+        "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent credentials not hardcoded — secret manager required"
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V14.1.4",
+    "control_name": "All components inventoried",
+    "entries": [
+      {
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V3 Session Management",
-    "control_name": "V3.1.1 — Session tokens unique and random",
+    "control_id": "V14.2.1",
+    "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
     "entries": [
+      {
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway"
+      },
+      {
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat"
+      },
       {
         "id": "DSGAI11",
         "name": "Cross-Context Conversation Bleed",
@@ -31127,37 +31208,30 @@
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V3.3.1",
-    "control_name": "Verify anti-replay tokens in state-changing operations",
+    "control_id": "V14.2.2",
+    "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
     "entries": [
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4 Access Control",
-    "control_name": "V4.1.3 — Deny by default access control",
-    "entries": [
-      {
-        "id": "DSGAI01",
-        "name": "Sensitive Data Leakage",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection"
       },
       {
-        "id": "DSGAI02",
-        "name": "Agent Identity and Credential Exposure",
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "System prompts not stored in cleartext application configuration or source code"
+      },
+      {
+        "id": "DSGAI01",
+        "name": "Sensitive Data Leakage",
         "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Foundational",
@@ -31165,35 +31239,76 @@
         "notes": null
       },
       {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
+        "id": "DSGAI14",
+        "name": "Excessive Telemetry and Monitoring Leakage",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
+        "scope": "Build",
         "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V15.3.3",
+    "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.",
+    "entries": [
+      {
+        "id": "LLM01",
+        "name": "Prompt Injection",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "LLM API request validation — prompt structure, content type, and character set enforced"
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V15.3.7",
+    "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
+    "entries": [
+      {
+        "id": "LLM01",
+        "name": "Prompt Injection",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope"
       },
       {
-        "id": "DSGAI06",
-        "name": "Tool Plugin and Agent Data Exchange",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "LLM05",
+        "name": "Data and Model Poisoning",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Training data pipeline input validation — anomalous data rejected before training"
+      },
+      {
+        "id": "ASI01",
+        "name": "Agent Goal Hijack",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "All inputs to agents validated — indirect injection through processed content equally in scope"
       },
       {
-        "id": "DSGAI07",
-        "name": "Data Governance and Lifecycle",
-        "source_list": "DSGAI-2026",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "All content entering agent memory validated — injection patterns rejected at write boundary"
       },
       {
-        "id": "DSGAI11",
-        "name": "Cross-Context Conversation Bleed",
+        "id": "DSGAI05",
+        "name": "Data Integrity and Validation Failures",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
@@ -31208,16 +31323,14 @@
         "tier": "Foundational",
         "scope": "Build",
         "notes": null
-      },
-      {
-        "id": "DSGAI13",
-        "name": "Vector Store Platform Security",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      },
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V16.2.5",
+    "control_name": "No credential logging",
+    "entries": [
       {
         "id": "DSGAI14",
         "name": "Excessive Telemetry and Monitoring Leakage",
@@ -31226,49 +31339,56 @@
         "tier": "Foundational",
         "scope": "Build",
         "notes": null
-      },
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V16.3.1",
+    "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
+    "entries": [
       {
-        "id": "DSGAI15",
-        "name": "Over-Broad Context Windows",
-        "source_list": "DSGAI-2026",
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "scope": "Both",
+        "notes": "All access to system prompts logged — unauthorised access attempts detectable"
       },
       {
-        "id": "DSGAI16",
-        "name": "Endpoint and Browser Overreach",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "All credential usage logged — issuance, access, expiry detectable"
       },
       {
-        "id": "DSGAI19",
-        "name": "Human-in-Loop and Labeler Overexposure",
-        "source_list": "DSGAI-2026",
-        "severity": "Medium",
-        "tier": "Foundational",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "All A2A messages logged — sender identity, content hash, schema validation results"
       },
       {
-        "id": "DSGAI20",
-        "name": "Model Exfiltration and IP Replication",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI10",
+        "name": "Rogue Agents",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "All agent actions logged — no production deployment without complete observability"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4.1.1",
-    "control_name": "Verify all sensitive functions have access control",
+    "control_id": "V16.3.2",
+    "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
     "entries": [
       {
         "id": "LLM03",
@@ -31277,7 +31397,7 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation"
+        "notes": "All LLM tool invocations logged with full context — every tool call auditable"
       },
       {
         "id": "ASI02",
@@ -31286,119 +31406,119 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4.1.3",
-    "control_name": "Verify access control decisions enforce least privilege",
-    "entries": [
+        "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp"
+      },
       {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
+        "id": "ASI10",
+        "name": "Rogue Agents",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access"
+        "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis"
       },
       {
-        "id": "LLM03",
-        "name": "Excessive Agency",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM tool access enforced at minimum required scope — read-only by default"
+        "notes": null
       },
       {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI08",
+        "name": "Non-Compliance and Regulatory Violations",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "System prompt access restricted to authorised personnel — read access logged"
-      },
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V16.5.1",
+    "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
+    "entries": [
       {
-        "id": "LLM09",
-        "name": "Vector and Embedding Weaknesses",
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
         "source_list": "LLM-Top10-2026",
-        "severity": "Medium",
-        "tier": "Hardening",
+        "severity": "High",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "RBAC on all vector store collections — no unauthenticated access"
+        "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses"
       },
       {
-        "id": "ASI02",
-        "name": "Tool Misuse and Exploitation",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
+        "id": "LLM07",
+        "name": "Misinformation",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved"
+        "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality"
       },
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
+        "id": "ASI08",
+        "name": "Cascading Agent Failures",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent credential scope minimum required — no over-privileged NHIs"
+        "notes": "Cascade errors handled gracefully — no sensitive system information in error responses"
       },
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write"
+        "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable"
       },
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI05",
+        "name": "Data Integrity and Validation Failures",
+        "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "A2A channels enforce sender identity — unauthenticated messages rejected"
+        "tier": "Foundational",
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4.2.2",
-    "control_name": "Verify anti-CSRF tokens in state-changing operations",
+    "control_id": "V16.5.3",
+    "control_name": "Access control failures logged",
     "entries": [
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "CSRF protection on endpoints where LLM output triggers state changes"
+        "notes": null
+      },
+      {
+        "id": "DSGAI07",
+        "name": "Data Governance and Lifecycle",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5 Validation",
-    "control_name": "V5.2.8 — Output encoding for context",
+    "control_id": "V2.2.1",
+    "control_name": "Input validation server-side",
     "entries": [
-      {
-        "id": "DSGAI01",
-        "name": "Sensitive Data Leakage",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      },
       {
         "id": "DSGAI04",
         "name": "Data Model and Artifact Poisoning",
@@ -31409,41 +31529,14 @@
         "notes": null
       },
       {
-        "id": "DSGAI05",
-        "name": "Data Integrity and Validation Failures",
+        "id": "DSGAI16",
+        "name": "Endpoint and Browser Overreach",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
-      },
-      {
-        "id": "DSGAI09",
-        "name": "Multimodal Cross-Channel Leakage",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Hardening",
         "scope": "Both",
         "notes": null
       },
-      {
-        "id": "DSGAI10",
-        "name": "Synthetic Data and Anonymization Pitfalls",
-        "source_list": "DSGAI-2026",
-        "severity": "Medium",
-        "tier": "Hardening",
-        "scope": "Build",
-        "notes": null
-      },
-      {
-        "id": "DSGAI12",
-        "name": "Unsafe Natural Language Data Gateways",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
-      },
       {
         "id": "DSGAI21",
         "name": "Disinformation via Data Poisoning",
@@ -31457,67 +31550,76 @@
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.1.1",
-    "control_name": "Verify all user input validated against an allowlist or rejected",
+    "control_id": "V2.3.1",
+    "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
     "entries": [
       {
-        "id": "LLM01",
-        "name": "Prompt Injection",
+        "id": "LLM07",
+        "name": "Misinformation",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope"
-      },
-      {
-        "id": "LLM05",
-        "name": "Data and Model Poisoning",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Training data pipeline input validation — anomalous data rejected before training"
+        "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined"
       },
       {
-        "id": "ASI01",
-        "name": "Agent Goal Hijack",
+        "id": "ASI08",
+        "name": "Cascading Agent Failures",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All inputs to agents validated — indirect injection through processed content equally in scope"
+        "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted"
       },
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "All content entering agent memory validated — injection patterns rejected at write boundary"
+        "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.1.2",
-    "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected",
+    "control_id": "V2.4.1",
+    "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.",
     "entries": [
       {
-        "id": "LLM01",
-        "name": "Prompt Injection",
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM API request validation — prompt structure, content type, and character set enforced"
+        "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies"
+      },
+      {
+        "id": "DSGAI06",
+        "name": "Tool Plugin and Agent Data Exchange",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
+      },
+      {
+        "id": "DSGAI21",
+        "name": "Disinformation via Data Poisoning",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.2.1",
-    "control_name": "Verify output encoding prevents injection attacks",
+    "control_id": "V2.4.2",
+    "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
     "entries": [
       {
         "id": "LLM01",
@@ -31526,34 +31628,34 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM output encoding before passing to downstream renderers or interpreters"
+        "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions"
       },
       {
-        "id": "LLM07",
-        "name": "Misinformation",
+        "id": "LLM03",
+        "name": "Excessive Agency",
         "source_list": "LLM-Top10-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source"
+        "notes": "Business logic controls preventing tool misuse through prompt manipulation"
       },
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
+        "id": "ASI01",
+        "name": "Agent Goal Hijack",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM responses rendered in browser contexts encoded against XSS"
+        "notes": "Business logic controls prevent injection from redirecting agent goal"
       },
       {
-        "id": "ASI01",
-        "name": "Agent Goal Hijack",
+        "id": "ASI02",
+        "name": "Tool Misuse and Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted"
+        "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified"
       },
       {
         "id": "ASI05",
@@ -31562,23 +31664,32 @@
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent code output encoded before rendering in any context"
+        "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis"
       },
       {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
+        "id": "ASI08",
+        "name": "Cascading Agent Failures",
         "source_list": "Agentic-Top10-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content"
+        "notes": "Circuit breakers as business logic controls — cascade propagation limited by design"
+      },
+      {
+        "id": "ASI10",
+        "name": "Rogue Agents",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.2.4",
-    "control_name": "Verify application does not use eval or dynamic code",
+    "control_id": "V3.5.1",
+    "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).",
     "entries": [
       {
         "id": "LLM10",
@@ -31587,116 +31698,132 @@
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "No eval or dynamic code execution of LLM-generated content"
+        "notes": "CSRF protection on endpoints where LLM output triggers state changes"
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V3.6.1",
+    "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
+    "entries": [
+      {
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "System prompts not hardcoded in source code — stored in secret management system"
       },
       {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review"
+        "notes": "Agent credentials not committed to source control"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.2.5",
-    "control_name": "Verify application protects against OS command injection",
+    "control_id": "V5.2.1",
+    "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
     "entries": [
       {
-        "id": "LLM01",
-        "name": "Prompt Injection",
+        "id": "LLM05",
+        "name": "Data and Model Poisoning",
         "source_list": "LLM-Top10-2026",
         "severity": "Critical",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "LLM-generated content validated before execution in any shell or interpreter context"
+        "notes": "Training data uploads scanned before ingestion — adversarial content detected"
       },
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
+        "id": "LLM09",
+        "name": "Vector and Embedding Weaknesses",
         "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
+        "severity": "Medium",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "LLM-generated commands validated — never raw output in shell context"
+        "notes": "Content validation on all vector store ingestion — adversarial content detected"
       },
       {
-        "id": "ASI01",
-        "name": "Agent Goal Hijack",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
         "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent-generated instructions not executed in system context without validation"
+        "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write"
       },
       {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI04",
+        "name": "Data Model and Artifact Poisoning",
+        "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent-generated commands validated before any shell execution"
+        "notes": null
+      },
+      {
+        "id": "DSGAI13",
+        "name": "Vector Store Platform Security",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.3.5",
-    "control_name": "Verify output encoding in SQL query context",
+    "control_id": "V5.2.4",
+    "control_name": "Malicious file detection on upload",
     "entries": [
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI09",
+        "name": "Multimodal Cross-Channel Leakage",
+        "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context"
-      },
-      {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "No raw agent output in SQL context — parameterised execution only"
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V6 Cryptography",
-    "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+    "control_id": "V6.2.1",
+    "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.",
     "entries": [
       {
-        "id": "DSGAI01",
-        "name": "Sensitive Data Leakage",
-        "source_list": "DSGAI-2026",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
+        "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Agent credentials not hardcoded — secret manager required"
       },
       {
-        "id": "DSGAI13",
-        "name": "Vector Store Platform Security",
+        "id": "DSGAI02",
+        "name": "Agent Identity and Credential Exposure",
         "source_list": "DSGAI-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
         "notes": null
       },
       {
-        "id": "DSGAI18",
-        "name": "Inference and Data Reconstruction",
+        "id": "DSGAI19",
+        "name": "Human-in-Loop and Labeler Overexposure",
         "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Hardening",
+        "severity": "Medium",
+        "tier": "Foundational",
         "scope": "Both",
         "notes": null
       }
@@ -31704,146 +31831,128 @@
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V6.1.1",
-    "control_name": "Verify all sensitive data encrypted at rest",
+    "control_id": "V7.4.1",
+    "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.",
     "entries": [
       {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest"
-      },
-      {
-        "id": "LLM09",
-        "name": "Vector and Embedding Weaknesses",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Medium",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "All vector store content encrypted at rest"
+        "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers"
       },
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
+        "id": "DSGAI11",
+        "name": "Cross-Context Conversation Bleed",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory"
-      },
+        "scope": "Build",
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V8.1.3",
+    "control_name": "Sensitive data not in session storage",
+    "entries": [
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI11",
+        "name": "Cross-Context Conversation Bleed",
+        "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory"
+        "tier": "Foundational",
+        "scope": "Build",
+        "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7 Logging",
-    "control_name": "V7.2.2 — Log entries contain required information",
+    "control_id": "V8.1.4",
+    "control_name": "Sensitive data minimisation",
     "entries": [
       {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
+        "id": "DSGAI07",
+        "name": "Data Governance and Lifecycle",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI05",
-        "name": "Data Integrity and Validation Failures",
+        "id": "DSGAI09",
+        "name": "Multimodal Cross-Channel Leakage",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI08",
-        "name": "Non-Compliance and Regulatory Violations",
+        "id": "DSGAI15",
+        "name": "Over-Broad Context Windows",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
+        "scope": "Build",
+        "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI14",
-        "name": "Excessive Telemetry and Monitoring Leakage",
+        "id": "DSGAI20",
+        "name": "Model Exfiltration and IP Replication",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7.2.1",
-    "control_name": "Verify access control decisions logged",
+    "control_id": "V8.2.1",
+    "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
     "entries": [
       {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All access to system prompts logged — unauthorised access attempts detectable"
+        "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access"
       },
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM03",
+        "name": "Excessive Agency",
+        "source_list": "LLM-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All credential usage logged — issuance, access, expiry detectable"
+        "notes": "LLM tool access enforced at minimum required scope — read-only by default"
       },
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "All A2A messages logged — sender identity, content hash, schema validation results"
+        "notes": "System prompt access restricted to authorised personnel — read access logged"
       },
       {
-        "id": "ASI10",
-        "name": "Rogue Agents",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "All agent actions logged — no production deployment without complete observability"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7.2.2",
-    "control_name": "Verify all business logic decisions logged",
-    "entries": [
-      {
-        "id": "LLM03",
-        "name": "Excessive Agency",
+        "id": "LLM09",
+        "name": "Vector and Embedding Weaknesses",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "Medium",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "All LLM tool invocations logged with full context — every tool call auditable"
+        "notes": "RBAC on all vector store collections — no unauthenticated access"
       },
       {
         "id": "ASI02",
@@ -31852,67 +31961,35 @@
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp"
+        "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved"
       },
       {
-        "id": "ASI10",
-        "name": "Rogue Agents",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7.4.1",
-    "control_name": "Verify error handling does not expose sensitive data",
-    "entries": [
-      {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses"
-      },
-      {
-        "id": "LLM07",
-        "name": "Misinformation",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality"
+        "notes": "Agent credential scope minimum required — no over-privileged NHIs"
       },
       {
-        "id": "ASI08",
-        "name": "Cascading Agent Failures",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
         "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Cascade errors handled gracefully — no sensitive system information in error responses"
+        "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write"
       },
       {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
         "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V8 Data Protection",
-    "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters",
-    "entries": [
+        "notes": "A2A channels enforce sender identity — unauthenticated messages rejected"
+      },
       {
         "id": "DSGAI01",
         "name": "Sensitive Data Leakage",
@@ -31932,8 +32009,8 @@
         "notes": null
       },
       {
-        "id": "DSGAI07",
-        "name": "Data Governance and Lifecycle",
+        "id": "DSGAI13",
+        "name": "Vector Store Platform Security",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
@@ -31941,53 +32018,69 @@
         "notes": null
       },
       {
-        "id": "DSGAI08",
-        "name": "Non-Compliance and Regulatory Violations",
+        "id": "DSGAI15",
+        "name": "Over-Broad Context Windows",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
+        "scope": "Build",
         "notes": null
       },
       {
-        "id": "DSGAI09",
-        "name": "Multimodal Cross-Channel Leakage",
+        "id": "DSGAI16",
+        "name": "Endpoint and Browser Overreach",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
         "notes": null
       },
       {
-        "id": "DSGAI10",
-        "name": "Synthetic Data and Anonymization Pitfalls",
+        "id": "DSGAI19",
+        "name": "Human-in-Loop and Labeler Overexposure",
         "source_list": "DSGAI-2026",
         "severity": "Medium",
-        "tier": "Hardening",
-        "scope": "Build",
+        "tier": "Foundational",
+        "scope": "Both",
         "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V8.3.1",
+    "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
+    "entries": [
+      {
+        "id": "LLM03",
+        "name": "Excessive Agency",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation"
       },
       {
-        "id": "DSGAI11",
-        "name": "Cross-Context Conversation Bleed",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI02",
+        "name": "Tool Misuse and Exploitation",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "scope": "Both",
+        "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session"
       },
       {
-        "id": "DSGAI14",
-        "name": "Excessive Telemetry and Monitoring Leakage",
+        "id": "DSGAI06",
+        "name": "Tool Plugin and Agent Data Exchange",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Build",
+        "scope": "Both",
         "notes": null
       },
       {
-        "id": "DSGAI15",
-        "name": "Over-Broad Context Windows",
+        "id": "DSGAI11",
+        "name": "Cross-Context Conversation Bleed",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
@@ -31995,21 +32088,21 @@
         "notes": null
       },
       {
-        "id": "DSGAI18",
-        "name": "Inference and Data Reconstruction",
+        "id": "DSGAI12",
+        "name": "Unsafe Natural Language Data Gateways",
         "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Build",
         "notes": null
       },
       {
-        "id": "DSGAI19",
-        "name": "Human-in-Loop and Labeler Overexposure",
+        "id": "DSGAI14",
+        "name": "Excessive Telemetry and Monitoring Leakage",
         "source_list": "DSGAI-2026",
-        "severity": "Medium",
+        "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
+        "scope": "Build",
         "notes": null
       },
       {
@@ -32025,83 +32118,42 @@
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V8.1.1",
-    "control_name": "Verify sensitive data is not cached or exposed in logs",
-    "entries": [
-      {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection"
-      },
-      {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "System prompts not stored in cleartext application configuration or source code"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V8.3.4",
-    "control_name": "Verify PII is identified and protected",
-    "entries": [
-      {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V9 Communication",
-    "control_name": "V9.1.1 — TLS for all connections",
+    "control_id": "V8.3.10",
+    "control_name": "Personal data not kept longer than needed",
     "entries": [
       {
-        "id": "DSGAI06",
-        "name": "Tool Plugin and Agent Data Exchange",
+        "id": "DSGAI08",
+        "name": "Non-Compliance and Regulatory Violations",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V9.1.1",
-    "control_name": "Verify all sensitive data encrypted in transit",
+    "control_id": "V8.3.3",
+    "control_name": "Consent obtained before PI processing",
     "entries": [
       {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI08",
+        "name": "Non-Compliance and Regulatory Violations",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "High",
-        "tier": "Hardening",
+        "id": "DSGAI19",
+        "name": "Human-in-Loop and Labeler Overexposure",
+        "source_list": "DSGAI-2026",
+        "severity": "Medium",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
diff --git a/data/entries/ASI01.json b/data/entries/ASI01.json
index 2028810..c911084 100644
--- a/data/entries/ASI01.json
+++ b/data/entries/ASI01.json
@@ -311,31 +311,34 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.1.1",
-      "control_name": "Verify all user input validated against allowlist",
+      "control_id": "V15.3.7",
+      "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All inputs to agents validated — indirect injection through processed content equally in scope",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.1",
-      "control_name": "Verify output encoding prevents injection",
+      "control_id": "V1.3.1",
+      "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.5",
-      "control_name": "Verify application protects against OS command injection",
+      "control_id": "V1.3.7",
+      "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent-generated instructions not executed in system context without validation",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -345,17 +348,19 @@
       "control_name": "Threat modelling of all data flows",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "All agent input sources threat-modelled — every indirect injection path documented",
+      "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic limits prevent function abuse",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Business logic controls prevent injection from redirecting agent goal",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI02.json b/data/entries/ASI02.json
index 2e057db..e7c4a68 100644
--- a/data/entries/ASI02.json
+++ b/data/entries/ASI02.json
@@ -318,51 +318,56 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control enforces least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.1",
-      "control_name": "Verify all sensitive functions have access control",
+      "control_id": "V8.3.1",
+      "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.2",
-      "control_name": "Verify all business logic decisions logged",
+      "control_id": "V16.3.2",
+      "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic abuse scenarios identified",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13.1.1",
+      "control_id": "V1.5.3",
       "control_name": "Verify API rate limiting",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected",
+      "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI03.json b/data/entries/ASI03.json
index aca26b3..ece2f67 100644
--- a/data/entries/ASI03.json
+++ b/data/entries/ASI03.json
@@ -311,51 +311,56 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V2.1.1",
-      "control_name": "Verify credentials not in source code",
+      "control_id": "V6.2.1",
+      "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent credentials not hardcoded — secret manager required",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control enforces least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent credential scope minimum required — no over-privileged NHIs",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6.1.1",
-      "control_name": "Verify sensitive data encrypted at rest",
+      "control_id": "V14.1.1",
+      "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.1",
-      "control_name": "Verify access control decisions logged",
+      "control_id": "V16.3.1",
+      "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All credential usage logged — issuance, access, expiry detectable",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V14.2.3",
-      "control_name": "Verify secrets not in source code",
+      "control_id": "V3.6.1",
+      "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent credentials not committed to source control",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI04.json b/data/entries/ASI04.json
index 97e4c7a..5782a99 100644
--- a/data/entries/ASI04.json
+++ b/data/entries/ASI04.json
@@ -326,7 +326,8 @@
       "control_name": "Verify third-party components current and free of vulnerabilities",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored",
+      "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -336,17 +337,19 @@
       "control_name": "Verify only minimal approved external libraries",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "Approved component list — unsigned or unverified agent components rejected",
+      "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V14.2.2",
-      "control_name": "Verify build pipelines include security checks",
+      "control_id": "V13.4.5",
+      "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -356,7 +359,8 @@
       "control_name": "Verify threat model covers all data flows",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "Supply chain threat model documents all agent component sources and trust levels",
+      "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI05.json b/data/entries/ASI05.json
index 899faa9..03f548d 100644
--- a/data/entries/ASI05.json
+++ b/data/entries/ASI05.json
@@ -311,51 +311,56 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.1",
-      "control_name": "Verify output encoding of untrusted data in HTML context",
+      "control_id": "V1.3.1",
+      "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Agent code output encoded before rendering in any context",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.4",
-      "control_name": "Verify application does not use eval or dynamic code",
+      "control_id": "V1.3.2",
+      "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.5",
-      "control_name": "Verify output encoding in OS command context",
+      "control_id": "V1.3.7",
+      "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Agent-generated commands validated before any shell execution",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.3.5",
-      "control_name": "Verify output encoding in SQL context",
+      "control_id": "V1.2.4",
+      "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "No raw agent output in SQL context — parameterised execution only",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic limits",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI06.json b/data/entries/ASI06.json
index 9f531ce..f0265d8 100644
--- a/data/entries/ASI06.json
+++ b/data/entries/ASI06.json
@@ -311,41 +311,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.1.1",
-      "control_name": "Verify all user input validated against allowlist",
+      "control_id": "V15.3.7",
+      "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "All content entering agent memory validated — injection patterns rejected at write boundary",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control enforces least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6.1.1",
-      "control_name": "Verify sensitive data encrypted at rest",
+      "control_id": "V14.1.1",
+      "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V12.1.1",
-      "control_name": "Verify file upload malware scanning",
+      "control_id": "V5.2.1",
+      "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI07.json b/data/entries/ASI07.json
index 0b7ba37..61c19bd 100644
--- a/data/entries/ASI07.json
+++ b/data/entries/ASI07.json
@@ -311,41 +311,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V9.1.1",
-      "control_name": "Verify TLS used for all client connectivity",
+      "control_id": "V12.2.1",
+      "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V3.3.1",
-      "control_name": "Verify anti-replay tokens in state-changing operations",
+      "control_id": "V7.4.1",
+      "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control enforces identity",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "A2A channels enforce sender identity — unauthenticated messages rejected",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.1",
-      "control_name": "Verify all security controls logged",
+      "control_id": "V16.3.1",
+      "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "All A2A messages logged — sender identity, content hash, schema validation results",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI08.json b/data/entries/ASI08.json
index 9f11c5e..79d2ed8 100644
--- a/data/entries/ASI08.json
+++ b/data/entries/ASI08.json
@@ -311,41 +311,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.1",
-      "control_name": "Verify business logic assumptions documented",
+      "control_id": "V2.3.1",
+      "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic limits prevent abuse",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Circuit breakers as business logic controls — cascade propagation limited by design",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13.1.1",
+      "control_id": "V1.5.3",
       "control_name": "Verify API rate limiting",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited",
+      "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.4.1",
-      "control_name": "Verify error handling does not expose sensitive data",
+      "control_id": "V16.5.1",
+      "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Cascade errors handled gracefully — no sensitive system information in error responses",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI09.json b/data/entries/ASI09.json
index 62f51af..e94d7e1 100644
--- a/data/entries/ASI09.json
+++ b/data/entries/ASI09.json
@@ -311,41 +311,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.1",
-      "control_name": "Verify business logic assumptions documented",
+      "control_id": "V2.3.1",
+      "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.1",
-      "control_name": "Verify outputs encoded before rendering",
+      "control_id": "V1.3.1",
+      "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.4.1",
-      "control_name": "Verify all security controls logged",
+      "control_id": "V16.5.1",
+      "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13.1.3",
-      "control_name": "Verify API rejects large unexpected payloads",
+      "control_id": "V14.2.1",
+      "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json
index 9d08e24..5c94f89 100644
--- a/data/entries/ASI10.json
+++ b/data/entries/ASI10.json
@@ -321,41 +321,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.1",
-      "control_name": "Verify access control decisions logged",
+      "control_id": "V16.3.1",
+      "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "All agent actions logged — no production deployment without complete observability",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.2",
-      "control_name": "Verify all business logic decisions logged",
+      "control_id": "V16.3.2",
+      "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic limits prevent abuse",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13.1.1",
+      "control_id": "V1.5.3",
       "control_name": "Verify API rate limiting",
       "tier": "Hardening",
       "scope": "Both",
-      "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion",
+      "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI01.json b/data/entries/DSGAI01.json
index aed2bae..6765b51 100644
--- a/data/entries/DSGAI01.json
+++ b/data/entries/DSGAI01.json
@@ -315,46 +315,56 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters",
+      "control_id": "V14.2.2",
+      "control_name": "Sensitive data not transmitted in URL parameters",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.4 — Sensitive data identified and classified",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data identified and classified",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.3 — Deny by default access control",
+      "control_id": "V8.2.1",
+      "control_name": "Deny by default access control",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.2.8 — Output encoding for context",
+      "control_id": "V1.3.5",
+      "control_name": "Output encoding for context",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6 Cryptography",
-      "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data not stored in cleartext",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V6",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI02.json b/data/entries/DSGAI02.json
index c370021..48646a9 100644
--- a/data/entries/DSGAI02.json
+++ b/data/entries/DSGAI02.json
@@ -315,37 +315,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V2 Authentication",
-      "control_name": "V2.1.1 — Passwords minimum 12 characters",
+      "control_id": "V6.2.1",
+      "control_name": "Passwords minimum 12 characters",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V2",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V2 Authentication",
-      "control_name": "V2.10.1 — Integration secrets not hardcoded",
+      "control_id": "V13.2.1",
+      "control_name": "Integration secrets not hardcoded",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V2",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.2 — Least privilege for service accounts",
+      "control_id": "V8.2.1",
+      "control_name": "Least privilege for service accounts",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.7 — Data transferred using current TLS",
+      "control_id": "V14.1.2",
+      "control_name": "Data transferred using current TLS",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI03.json b/data/entries/DSGAI03.json
index 5e05330..f005dae 100644
--- a/data/entries/DSGAI03.json
+++ b/data/entries/DSGAI03.json
@@ -305,37 +305,47 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V1 Architecture",
-      "control_name": "V1.1.4 — Trust boundaries documented and enforced",
+      "control_id": "V1.1.4",
+      "control_name": "Trust boundaries documented and enforced",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V1",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.5 — Access control failures logged",
+      "control_id": "V16.5.3",
+      "control_name": "Access control failures logged",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7 Logging",
-      "control_name": "V7.2.2 — Log entries contain required information",
+      "control_id": "V16.3.2",
+      "control_name": "Log entries contain required information",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V7",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V14 Configuration",
-      "control_name": "V14.1.4 — All components inventoried",
+      "control_id": "V14.1.4",
+      "control_name": "All components inventoried",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V14",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI04.json b/data/entries/DSGAI04.json
index 04ddbaa..f6fdc8d 100644
--- a/data/entries/DSGAI04.json
+++ b/data/entries/DSGAI04.json
@@ -305,37 +305,47 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.1.3 — Input validation server-side",
+      "control_id": "V2.2.1",
+      "control_name": "Input validation server-side",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V10 Malicious Code",
-      "control_name": "V10.2.1 — Application only uses official repositories",
+      "control_id": "V10.2.1",
+      "control_name": "Application only uses official repositories",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V10",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V10 Malicious Code",
-      "control_name": "V10.2.2 — Dependency managers check for vulnerabilities",
+      "control_id": "V10.2.2",
+      "control_name": "Dependency managers check for vulnerabilities",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V10",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V12 Files/Resources",
-      "control_name": "V12.1.1 — File upload size limits",
+      "control_id": "V5.2.1",
+      "control_name": "File upload size limits",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V12",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI05.json b/data/entries/DSGAI05.json
index db39c46..07810d0 100644
--- a/data/entries/DSGAI05.json
+++ b/data/entries/DSGAI05.json
@@ -285,28 +285,34 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.1.1 — Input validation using allowlists",
+      "control_id": "V15.3.7",
+      "control_name": "Input validation using allowlists",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.2.1 — HTML/JS output sanitised",
+      "control_id": "V1.3.1",
+      "control_name": "HTML/JS output sanitised",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7 Logging",
-      "control_name": "V7.4.1 — Generic error messages",
+      "control_id": "V16.5.1",
+      "control_name": "Generic error messages",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V7",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI06.json b/data/entries/DSGAI06.json
index 4388c37..8412182 100644
--- a/data/entries/DSGAI06.json
+++ b/data/entries/DSGAI06.json
@@ -295,28 +295,34 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.1 — Access control on every request",
+      "control_id": "V8.3.1",
+      "control_name": "Access control on every request",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V9 Communication",
-      "control_name": "V9.1.1 — TLS for all connections",
+      "control_id": "V12.2.1",
+      "control_name": "TLS for all connections",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V9",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11 Business Logic",
-      "control_name": "V11.1.4 — Business logic limits on repeated actions",
+      "control_id": "V2.4.1",
+      "control_name": "Business logic limits on repeated actions",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V11",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI07.json b/data/entries/DSGAI07.json
index 6824e87..03a4e83 100644
--- a/data/entries/DSGAI07.json
+++ b/data/entries/DSGAI07.json
@@ -305,28 +305,35 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.4 — Sensitive data minimisation",
+      "control_id": "V8.1.4",
+      "control_name": "Sensitive data minimisation",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.4 — Sensitive data identified and classified",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data identified and classified",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.5 — Attribute-based access control",
+      "control_id": "V16.5.3",
+      "control_name": "Attribute-based access control",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI08.json b/data/entries/DSGAI08.json
index b3d3160..66f4ae0 100644
--- a/data/entries/DSGAI08.json
+++ b/data/entries/DSGAI08.json
@@ -295,28 +295,36 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.3 — Consent obtained before PI processing",
+      "control_id": "V8.3.3",
+      "control_name": "Consent obtained before PI processing",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.10 — Personal data not kept longer than needed",
+      "control_id": "V8.3.10",
+      "control_name": "Personal data not kept longer than needed",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7 Logging",
-      "control_name": "V7.2.2 — Audit trail sufficient for compliance",
+      "control_id": "V16.3.2",
+      "control_name": "Audit trail sufficient for compliance",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V7",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI09.json b/data/entries/DSGAI09.json
index 3544041..ec0c751 100644
--- a/data/entries/DSGAI09.json
+++ b/data/entries/DSGAI09.json
@@ -295,28 +295,35 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.2.5 — Unstructured data sanitised",
+      "control_id": "V1.3.7",
+      "control_name": "Unstructured data sanitised",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.4 — Sensitive data minimised",
+      "control_id": "V8.1.4",
+      "control_name": "Sensitive data minimised",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V8",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V12 Files/Resources",
-      "control_name": "V12.1.3 — Malicious file detection on upload",
+      "control_id": "V5.2.4",
+      "control_name": "Malicious file detection on upload",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V12",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI10.json b/data/entries/DSGAI10.json
index f56bfcb..45929d4 100644
--- a/data/entries/DSGAI10.json
+++ b/data/entries/DSGAI10.json
@@ -275,19 +275,23 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.4 — Sensitive data classified",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data classified",
       "tier": "Hardening",
       "scope": "Build",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.2.6 — Defined output structure",
+      "control_id": "V1.3.6",
+      "control_name": "Defined output structure",
       "tier": "Hardening",
       "scope": "Build",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI11.json b/data/entries/DSGAI11.json
index 3ea0e3d..fc9f2f3 100644
--- a/data/entries/DSGAI11.json
+++ b/data/entries/DSGAI11.json
@@ -295,37 +295,46 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V3 Session Management",
-      "control_name": "V3.1.1 — Session tokens unique and random",
+      "control_id": "V14.2.1",
+      "control_name": "Session tokens unique and random",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V3",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V3 Session Management",
-      "control_name": "V3.3.1 — Sessions invalidated after logout",
+      "control_id": "V7.4.1",
+      "control_name": "Sessions invalidated after logout",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V3",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.1 — Access control enforced on every request",
+      "control_id": "V8.3.1",
+      "control_name": "Access control enforced on every request",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.3 — Sensitive data not in session storage",
+      "control_id": "V8.1.3",
+      "control_name": "Sensitive data not in session storage",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V8",
+      "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI12.json b/data/entries/DSGAI12.json
index d877460..1c69ac2 100644
--- a/data/entries/DSGAI12.json
+++ b/data/entries/DSGAI12.json
@@ -305,37 +305,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.1.1 — Allowlist input validation",
+      "control_id": "V15.3.7",
+      "control_name": "Allowlist input validation",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.3.4 — SQL injection prevention",
+      "control_id": "V1.2.4",
+      "control_name": "SQL injection prevention",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.1 — Access control on every request",
+      "control_id": "V8.3.1",
+      "control_name": "Access control on every request",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13 API",
-      "control_name": "V13.1.1 — API protection against enumeration",
+      "control_id": "V1.5.3",
+      "control_name": "API protection against enumeration",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V13",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI13.json b/data/entries/DSGAI13.json
index 6072030..d1a3ef6 100644
--- a/data/entries/DSGAI13.json
+++ b/data/entries/DSGAI13.json
@@ -295,28 +295,34 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.3 — Deny by default",
+      "control_id": "V8.2.1",
+      "control_name": "Deny by default",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6 Cryptography",
-      "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data not stored in cleartext",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V6",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V12 Files/Resources",
-      "control_name": "V12.1.1 — File upload validation",
+      "control_id": "V5.2.1",
+      "control_name": "File upload validation",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V12",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI14.json b/data/entries/DSGAI14.json
index 2c5dc3b..2c74821 100644
--- a/data/entries/DSGAI14.json
+++ b/data/entries/DSGAI14.json
@@ -295,37 +295,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7 Logging",
-      "control_name": "V7.1.1 — No credential logging",
+      "control_id": "V16.2.5",
+      "control_name": "No credential logging",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V7",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7 Logging",
-      "control_name": "V7.1.2 — No sensitive data in logs",
+      "control_id": "V16.2.5",
+      "control_name": "No sensitive data in logs",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V7",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.1 — Sensitive data not in URLs",
+      "control_id": "V14.2.2",
+      "control_name": "Sensitive data not in URLs",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.1 — Access control on log stores",
+      "control_id": "V8.3.1",
+      "control_name": "Access control on log stores",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI15.json b/data/entries/DSGAI15.json
index 65bcc95..84a7a7e 100644
--- a/data/entries/DSGAI15.json
+++ b/data/entries/DSGAI15.json
@@ -295,28 +295,35 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.3 — Deny by default access control",
+      "control_id": "V8.2.1",
+      "control_name": "Deny by default access control",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.4 — Data minimisation",
+      "control_id": "V8.1.4",
+      "control_name": "Data minimisation",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V8",
+      "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V3 Session Management",
-      "control_name": "V3.1.1 — Session isolation",
+      "control_id": "V14.2.1",
+      "control_name": "Session isolation",
       "tier": "Foundational",
       "scope": "Build",
+      "parent": "V3",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI16.json b/data/entries/DSGAI16.json
index 607fbe0..2abed25 100644
--- a/data/entries/DSGAI16.json
+++ b/data/entries/DSGAI16.json
@@ -295,28 +295,35 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.2 — Least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Least privilege",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11 Business Logic",
-      "control_name": "V11.1.5 — Business logic prevents excess data access",
+      "control_id": "V2.2.1",
+      "control_name": "Business logic prevents excess data access",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V11",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V1 Architecture",
-      "control_name": "V1.1.2 — Secure architecture and design",
+      "control_id": "V1.1.2",
+      "control_name": "Secure architecture and design",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V1",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI17.json b/data/entries/DSGAI17.json
index 7eaf5ab..367f943 100644
--- a/data/entries/DSGAI17.json
+++ b/data/entries/DSGAI17.json
@@ -285,19 +285,25 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11 Business Logic",
-      "control_name": "V11.1.7 — Anti-automation controls",
+      "control_id": "V11.1.7",
+      "control_name": "Anti-automation controls",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V11",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13 API",
-      "control_name": "V13.1.2 — API throttling",
+      "control_id": "V13.1.2",
+      "control_name": "API throttling",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V13",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI18.json b/data/entries/DSGAI18.json
index ca6d2ac..3eea231 100644
--- a/data/entries/DSGAI18.json
+++ b/data/entries/DSGAI18.json
@@ -275,19 +275,23 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.4 — Sensitive data identified",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data identified",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V8",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6 Cryptography",
-      "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+      "control_id": "V14.1.1",
+      "control_name": "Sensitive data not stored in cleartext",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V6",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI19.json b/data/entries/DSGAI19.json
index 6d9ed85..891f050 100644
--- a/data/entries/DSGAI19.json
+++ b/data/entries/DSGAI19.json
@@ -285,28 +285,35 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.2 — Least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Least privilege",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.3.3 — Consent for personal data processing",
+      "control_id": "V8.3.3",
+      "control_name": "Consent for personal data processing",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V8",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V2 Authentication",
-      "control_name": "V2.1.1 — Strong authentication",
+      "control_id": "V6.2.1",
+      "control_name": "Strong authentication",
       "tier": "Foundational",
       "scope": "Both",
+      "parent": "V2",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI20.json b/data/entries/DSGAI20.json
index accb34f..7174f86 100644
--- a/data/entries/DSGAI20.json
+++ b/data/entries/DSGAI20.json
@@ -295,28 +295,36 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4 Access Control",
-      "control_name": "V4.1.1 — Access control per request",
+      "control_id": "V8.3.1",
+      "control_name": "Access control per request",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V4",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8 Data Protection",
-      "control_name": "V8.1.4 — Data minimisation in responses",
+      "control_id": "V8.1.4",
+      "control_name": "Data minimisation in responses",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V8",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V10 Malicious Code",
-      "control_name": "V10.2.2 — Component integrity checking",
+      "control_id": "V10.2.2",
+      "control_name": "Component integrity checking",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V10",
+      "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/DSGAI21.json b/data/entries/DSGAI21.json
index e4df173..8822935 100644
--- a/data/entries/DSGAI21.json
+++ b/data/entries/DSGAI21.json
@@ -305,19 +305,23 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5 Validation",
-      "control_name": "V5.1.3 — Server-side input validation",
+      "control_id": "V2.2.1",
+      "control_name": "Server-side input validation",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V5",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11 Business Logic",
-      "control_name": "V11.1.4 — Enforce business logic limits",
+      "control_id": "V2.4.1",
+      "control_name": "Enforce business logic limits",
       "tier": "Hardening",
       "scope": "Both",
+      "parent": "V11",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM01.json b/data/entries/LLM01.json
index 1dfc4bb..a4822f7 100644
--- a/data/entries/LLM01.json
+++ b/data/entries/LLM01.json
@@ -249,41 +249,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.1.1",
-      "control_name": "Verify all user input validated against an allowlist or rejected",
+      "control_id": "V15.3.7",
+      "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.1.2",
-      "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected",
+      "control_id": "V15.3.3",
+      "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM API request validation — prompt structure, content type, and character set enforced",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.1",
-      "control_name": "Verify output encoding prevents injection attacks",
+      "control_id": "V1.3.1",
+      "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM output encoding before passing to downstream renderers or interpreters",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.5",
-      "control_name": "Verify application protects against OS command injection",
+      "control_id": "V1.3.7",
+      "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM-generated content validated before execution in any shell or interpreter context",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -293,17 +297,19 @@
       "control_name": "Threat modelling of all data flows",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "LLM data flows threat-modelled — all injection paths identified and documented",
+      "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic limits prevent abuse of LLM functions",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM02.json b/data/entries/LLM02.json
index 889a5fb..80618de 100644
--- a/data/entries/LLM02.json
+++ b/data/entries/LLM02.json
@@ -259,51 +259,56 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8.1.1",
-      "control_name": "Verify sensitive data is not cached or exposed in logs",
+      "control_id": "V14.2.2",
+      "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8.3.4",
-      "control_name": "Verify PII is identified and protected",
+      "control_id": "V14.1.1",
+      "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control decisions enforce least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6.1.1",
-      "control_name": "Verify all sensitive data encrypted at rest",
+      "control_id": "V14.1.1",
+      "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V9.1.1",
-      "control_name": "Verify all sensitive data encrypted in transit",
+      "control_id": "V12.2.1",
+      "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM03.json b/data/entries/LLM03.json
index 45b2016..289a7a1 100644
--- a/data/entries/LLM03.json
+++ b/data/entries/LLM03.json
@@ -227,41 +227,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control enforces least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM tool access enforced at minimum required scope — read-only by default",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.1",
-      "control_name": "Verify all sensitive functions have access control",
+      "control_id": "V8.3.1",
+      "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.2",
-      "control_name": "Verify all business logic decisions logged",
+      "control_id": "V16.3.2",
+      "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All LLM tool invocations logged with full context — every tool call auditable",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.2",
-      "control_name": "Verify business logic abuse scenarios identified",
+      "control_id": "V2.4.2",
+      "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Business logic controls preventing tool misuse through prompt manipulation",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM04.json b/data/entries/LLM04.json
index 0aef8e7..3508219 100644
--- a/data/entries/LLM04.json
+++ b/data/entries/LLM04.json
@@ -252,7 +252,8 @@
       "control_name": "Verify third-party components are current and free from vulnerabilities",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained",
+      "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -262,17 +263,19 @@
       "control_name": "Verify only minimal approved external libraries are used",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected",
+      "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V14.2.2",
-      "control_name": "Verify build pipelines include security checks",
+      "control_id": "V13.4.5",
+      "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM05.json b/data/entries/LLM05.json
index b964730..f3e6993 100644
--- a/data/entries/LLM05.json
+++ b/data/entries/LLM05.json
@@ -259,11 +259,12 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.1.1",
-      "control_name": "Verify all inputs validated against allowlist",
+      "control_id": "V15.3.7",
+      "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Training data pipeline input validation — anomalous data rejected before training",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
@@ -273,17 +274,19 @@
       "control_name": "Verify third-party components free of vulnerabilities",
       "tier": "Hardening",
       "scope": "Both",
-      "notes": "Training pipeline components scanned — compromised dependencies rejected",
+      "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+      "framework_version": "ASVS 4.0.3",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V12.1.1",
-      "control_name": "Verify file uploads scanned for malware",
+      "control_id": "V5.2.1",
+      "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Training data uploads scanned before ingestion — adversarial content detected",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM06.json b/data/entries/LLM06.json
index 782cb50..e46d797 100644
--- a/data/entries/LLM06.json
+++ b/data/entries/LLM06.json
@@ -227,41 +227,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13.1.1",
+      "control_id": "V1.5.3",
       "control_name": "Verify API rate limiting",
       "tier": "Foundational",
       "scope": "Both",
-      "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key",
+      "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V13.1.3",
-      "control_name": "Verify API rejects large unexpected payloads",
+      "control_id": "V14.2.1",
+      "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.4",
-      "control_name": "Verify business logic rate limits",
+      "control_id": "V2.4.1",
+      "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.4.1",
-      "control_name": "Verify error handling does not expose sensitive data",
+      "control_id": "V16.5.1",
+      "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM07.json b/data/entries/LLM07.json
index d5f5ef7..570bbe7 100644
--- a/data/entries/LLM07.json
+++ b/data/entries/LLM07.json
@@ -227,31 +227,34 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V11.1.1",
-      "control_name": "Verify business logic assumptions documented",
+      "control_id": "V2.3.1",
+      "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.4.1",
-      "control_name": "Verify all security controls logged",
+      "control_id": "V16.5.1",
+      "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.1",
-      "control_name": "Verify outputs encoded before rendering",
+      "control_id": "V1.3.1",
+      "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM08.json b/data/entries/LLM08.json
index a1674fb..ac1e34c 100644
--- a/data/entries/LLM08.json
+++ b/data/entries/LLM08.json
@@ -227,41 +227,45 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V8.1.1",
-      "control_name": "Verify sensitive data not cached in cleartext",
+      "control_id": "V14.2.2",
+      "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "System prompts not stored in cleartext application configuration or source code",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify access control enforces least privilege",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "System prompt access restricted to authorised personnel — read access logged",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V7.2.1",
-      "control_name": "Verify access control decisions logged",
+      "control_id": "V16.3.1",
+      "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "All access to system prompts logged — unauthorised access attempts detectable",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V14.2.3",
-      "control_name": "Verify secrets not in source code",
+      "control_id": "V3.6.1",
+      "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "System prompts not hardcoded in source code — stored in secret management system",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM09.json b/data/entries/LLM09.json
index b03ab20..1ec21d4 100644
--- a/data/entries/LLM09.json
+++ b/data/entries/LLM09.json
@@ -227,31 +227,34 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.1.3",
-      "control_name": "Verify least privilege access control on data",
+      "control_id": "V8.2.1",
+      "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "RBAC on all vector store collections — no unauthenticated access",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V6.1.1",
-      "control_name": "Verify all sensitive data encrypted at rest",
+      "control_id": "V14.1.1",
+      "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "All vector store content encrypted at rest",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V12.1.1",
-      "control_name": "Verify file upload malware scanning",
+      "control_id": "V5.2.1",
+      "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
       "tier": "Hardening",
       "scope": "Both",
       "notes": "Content validation on all vector store ingestion — adversarial content detected",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/entries/LLM10.json b/data/entries/LLM10.json
index 86e0a1e..f453e11 100644
--- a/data/entries/LLM10.json
+++ b/data/entries/LLM10.json
@@ -227,51 +227,56 @@
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.1",
-      "control_name": "Verify output encoding of untrusted data in HTML context",
+      "control_id": "V1.3.1",
+      "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM responses rendered in browser contexts encoded against XSS",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.3.5",
-      "control_name": "Verify output encoding in SQL query context",
+      "control_id": "V1.2.4",
+      "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.5",
-      "control_name": "Verify output encoding in OS command context",
+      "control_id": "V1.3.7",
+      "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "LLM-generated commands validated — never raw output in shell context",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V5.2.4",
-      "control_name": "Verify application does not use eval or dynamic code",
+      "control_id": "V1.3.2",
+      "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "No eval or dynamic code execution of LLM-generated content",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
     {
       "framework": "OWASP ASVS 4.0.3",
-      "control_id": "V4.2.2",
-      "control_name": "Verify anti-CSRF tokens in state-changing operations",
+      "control_id": "V3.5.1",
+      "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).",
       "tier": "Foundational",
       "scope": "Both",
       "notes": "CSRF protection on endpoints where LLM output triggers state changes",
+      "framework_version": "ASVS 5.0.0",
       "confidence": "unreviewed",
       "reviewed_by": []
     },
diff --git a/data/framework-sources.json b/data/framework-sources.json
index 37408a4..451a128 100644
--- a/data/framework-sources.json
+++ b/data/framework-sources.json
@@ -164,11 +164,11 @@
     },
     "owasp-asvs": {
       "name": "OWASP ASVS 4.0.3",
-      "mapped_version": "4.0.3",
+      "mapped_version": "5.0.0",
       "current_version": "5.0.0",
-      "checked": "2026-08-28",
+      "checked": "2026-09-18",
       "source_url": "https://owasp.org/projects/asvs",
-      "notes": "Verified via the OWASP/ASVS releases API (tag v5.0.0_release). Renumbered — re-map tracked in issue #22, NOT a version bump."
+      "notes": "Identifiers translated from 4.0.3 with the ASVS project's own 5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml; requirement text from the v5.0.0 release. Mechanical translation — relationship, rationale type and confidence on every row read DRAFT pending ASVS-leadership review (issue #22, STRAT-04). 11 identifiers 5.0.0 deleted are retained at 4.0.3 and flagged; see docs/ASVS_4_TO_5_TRANSLATION.md."
     },
     "owasp-nhi": {
       "name": "OWASP NHI Top 10",
diff --git a/data/frameworks/cis-controls.json b/data/frameworks/cis-controls.json
index 37ee5ef..8b454c7 100644
--- a/data/frameworks/cis-controls.json
+++ b/data/frameworks/cis-controls.json
@@ -508,6 +508,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 70 items -> 68, including 14 referenced by mappings but absent from the registry",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 68 items -> 68",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ],
   "inventory_completeness": {
diff --git a/data/frameworks/cwe-cve.json b/data/frameworks/cwe-cve.json
index dfe718e..f1a0020 100644
--- a/data/frameworks/cwe-cve.json
+++ b/data/frameworks/cwe-cve.json
@@ -397,6 +397,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 76 items -> 61",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 61 items -> 61",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ]
 }
diff --git a/data/frameworks/eu-ai-act.json b/data/frameworks/eu-ai-act.json
index 718d75c..e105906 100644
--- a/data/frameworks/eu-ai-act.json
+++ b/data/frameworks/eu-ai-act.json
@@ -256,6 +256,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 145 items -> 30",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 30 items -> 30",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ],
   "inventory_completeness": {
diff --git a/data/frameworks/iso-42001.json b/data/frameworks/iso-42001.json
index 1771176..74480a5 100644
--- a/data/frameworks/iso-42001.json
+++ b/data/frameworks/iso-42001.json
@@ -439,6 +439,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 87 items -> 56",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 56 items -> 56",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ],
   "inventory_completeness": {
diff --git a/data/frameworks/nist-sp-800-218a.json b/data/frameworks/nist-sp-800-218a.json
index 03bd7d2..e431d5a 100644
--- a/data/frameworks/nist-sp-800-218a.json
+++ b/data/frameworks/nist-sp-800-218a.json
@@ -95,6 +95,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 52 items -> 12",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 12 items -> 12",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ]
 }
diff --git a/data/frameworks/nist-sp-800-82.json b/data/frameworks/nist-sp-800-82.json
index 7c10115..fd1a89e 100644
--- a/data/frameworks/nist-sp-800-82.json
+++ b/data/frameworks/nist-sp-800-82.json
@@ -205,6 +205,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 59 items -> 26",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 26 items -> 26",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ]
 }
diff --git a/data/frameworks/owasp-ai-testing.json b/data/frameworks/owasp-ai-testing.json
index b664719..e91dd04 100644
--- a/data/frameworks/owasp-ai-testing.json
+++ b/data/frameworks/owasp-ai-testing.json
@@ -86,6 +86,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 58 items -> 9",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 9 items -> 9",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ]
 }
diff --git a/data/frameworks/owasp-asvs.json b/data/frameworks/owasp-asvs.json
index 5812b51..d5e0768 100644
--- a/data/frameworks/owasp-asvs.json
+++ b/data/frameworks/owasp-asvs.json
@@ -2,512 +2,647 @@
   "id": "owasp-asvs",
   "name": "OWASP ASVS 4.0.3",
   "short_name": "ASVS",
-  "version": "4.0.3",
+  "version": "5.0.0",
   "url": "https://owasp.org/projects/asvs",
   "license": "CC BY-SA 4.0",
   "publisher": "OWASP",
   "category": "appsec",
-  "last_synced": "2026-04-10",
+  "last_synced": "2026-09-18",
   "source_sha": null,
   "controls": [
     {
       "control_id": "V1",
-      "title": "Architecture, Design and Threat Modeling",
-      "description": "Ensure a verified application satisfies high-level security architecture requirements.",
+      "title": "Encoding and Sanitization",
+      "description": "",
       "parent": null,
-      "function": "Architecture",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V1.1",
-      "title": "Secure Software Development Lifecycle",
-      "description": "Ensure the use of a secure software development lifecycle that addresses security in all stages.",
-      "parent": "V1",
-      "function": "Architecture",
-      "kind": "control"
+      "control_id": "V1.1.2",
+      "title": "Threat modelling of all data flows",
+      "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented",
+      "parent": null,
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
     },
     {
-      "control_id": "V1.2",
-      "title": "Authentication Architecture",
-      "description": "Verify that authentication is addressed in the architecture.",
+      "control_id": "V1.1.4",
+      "title": "Trust boundaries documented and enforced",
+      "description": "",
       "parent": "V1",
-      "function": "Architecture",
-      "kind": "control"
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
     },
     {
-      "control_id": "V1.4",
-      "title": "Access Control Architecture",
-      "description": "Verify that access controls are applied consistently.",
+      "control_id": "V1.2",
+      "title": "Injection Prevention",
+      "description": "",
       "parent": "V1",
-      "function": "Architecture",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V1.5",
-      "title": "Input and Output Architecture",
-      "description": "Verify that input and output requirements define handling of data based on type and content.",
-      "parent": "V1",
-      "function": "Architecture",
+      "control_id": "V1.2.4",
+      "title": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
+      "description": "",
+      "parent": "V1.2",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V2",
-      "title": "Authentication",
-      "description": "Verify that the application uses appropriate authentication mechanisms.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V1.3",
+      "title": "Sanitization",
+      "description": "",
+      "parent": "V1",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V2.1",
-      "title": "Password Security",
-      "description": "Verify password requirements align with modern standards.",
-      "parent": "V2",
-      "function": "Verification",
+      "control_id": "V1.3.1",
+      "title": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
+      "description": "",
+      "parent": "V1.3",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V2.5",
-      "title": "Credential Recovery",
-      "description": "Verify credential recovery mechanisms are secure.",
-      "parent": "V2",
-      "function": "Verification",
+      "control_id": "V1.3.2",
+      "title": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
+      "description": "",
+      "parent": "V1.3",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V2.8",
-      "title": "One Time Verifier",
-      "description": "Verify one-time passwords and verifiers are secure.",
-      "parent": "V2",
-      "function": "Verification",
+      "control_id": "V1.3.5",
+      "title": "Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar.",
+      "description": "",
+      "parent": "V1.3",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V3",
-      "title": "Session Management",
-      "description": "Verify the application has adequate session management controls.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V1.3.6",
+      "title": "Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service.",
+      "description": "",
+      "parent": "V1.3",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V4",
-      "title": "Access Control",
-      "description": "Verify that users can only access functions and data for which they possess specific authorization.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V1.3.7",
+      "title": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
+      "description": "",
+      "parent": "V1.3",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V4.1",
-      "title": "General Access Control Design",
-      "description": "Verify access control is applied server-side and consistently.",
-      "parent": "V4",
-      "function": "Verification",
+      "control_id": "V1.5",
+      "title": "Safe Deserialization",
+      "description": "",
+      "parent": "V1",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V4.2",
-      "title": "Operation Level Access Control",
-      "description": "Verify access controls at the operation and function level.",
-      "parent": "V4",
-      "function": "Verification",
+      "control_id": "V1.5.3",
+      "title": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks.",
+      "description": "",
+      "parent": "V1.5",
+      "function": "Encoding and Sanitization",
       "kind": "control"
     },
     {
-      "control_id": "V5",
-      "title": "Validation, Sanitization and Encoding",
-      "description": "Verify that the application sanitizes, validates, and encodes untrusted input.",
+      "control_id": "V2",
+      "title": "Validation and Business Logic",
+      "description": "",
       "parent": null,
-      "function": "Verification",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V5.1",
+      "control_id": "V2.2",
       "title": "Input Validation",
-      "description": "Verify input validation controls are in place.",
-      "parent": "V5",
-      "function": "Verification",
-      "kind": "control"
-    },
-    {
-      "control_id": "V5.2",
-      "title": "Sanitization and Sandboxing",
-      "description": "Verify that sanitization and sandboxing are used to prevent injection.",
-      "parent": "V5",
-      "function": "Verification",
+      "description": "",
+      "parent": "V2",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V5.3",
-      "title": "Output Encoding and Injection Prevention",
-      "description": "Verify that output encoding prevents injection attacks.",
-      "parent": "V5",
-      "function": "Verification",
+      "control_id": "V2.2.1",
+      "title": "Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.",
+      "description": "",
+      "parent": "V2.2",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V5.5",
-      "title": "Deserialization Prevention",
-      "description": "Verify that deserialization is done safely.",
-      "parent": "V5",
-      "function": "Verification",
+      "control_id": "V2.3",
+      "title": "Business Logic Security",
+      "description": "",
+      "parent": "V2",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V6",
-      "title": "Stored Cryptography",
-      "description": "Verify that cryptographic modules and algorithms are used correctly.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V2.3.1",
+      "title": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
+      "description": "",
+      "parent": "V2.3",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V7",
-      "title": "Error Handling and Logging",
-      "description": "Verify that errors are handled safely and logs contain sufficient information.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V2.4",
+      "title": "Anti-automation",
+      "description": "",
+      "parent": "V2",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V7.1",
-      "title": "Log Content",
-      "description": "Verify that security-relevant events are logged.",
-      "parent": "V7",
-      "function": "Verification",
+      "control_id": "V2.4.1",
+      "title": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.",
+      "description": "",
+      "parent": "V2.4",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V7.2",
-      "title": "Log Processing",
-      "description": "Verify that logs are processed securely.",
-      "parent": "V7",
-      "function": "Verification",
+      "control_id": "V2.4.2",
+      "title": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
+      "description": "",
+      "parent": "V2.4",
+      "function": "Validation and Business Logic",
       "kind": "control"
     },
     {
-      "control_id": "V8",
-      "title": "Data Protection",
-      "description": "Verify that data is protected in transit and at rest.",
+      "control_id": "V3",
+      "title": "Web Frontend Security",
+      "description": "",
       "parent": null,
-      "function": "Verification",
+      "function": "Web Frontend Security",
       "kind": "control"
     },
     {
-      "control_id": "V8.1",
-      "title": "General Data Protection",
-      "description": "Verify sensitive data is identified and protected.",
-      "parent": "V8",
-      "function": "Verification",
+      "control_id": "V3.5",
+      "title": "Browser Origin Separation",
+      "description": "",
+      "parent": "V3",
+      "function": "Web Frontend Security",
       "kind": "control"
     },
     {
-      "control_id": "V8.3",
-      "title": "Sensitive Private Data",
-      "description": "Verify that sensitive data is protected from unauthorized access.",
-      "parent": "V8",
-      "function": "Verification",
+      "control_id": "V3.5.1",
+      "title": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).",
+      "description": "",
+      "parent": "V3.5",
+      "function": "Web Frontend Security",
       "kind": "control"
     },
     {
-      "control_id": "V9",
-      "title": "Communication",
-      "description": "Verify that communications are encrypted using TLS.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V3.6",
+      "title": "External Resource Integrity",
+      "description": "",
+      "parent": "V3",
+      "function": "Web Frontend Security",
       "kind": "control"
     },
     {
-      "control_id": "V10",
-      "title": "Malicious Code",
-      "description": "Verify that code does not contain malicious logic.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V3.6.1",
+      "title": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
+      "description": "",
+      "parent": "V3.6",
+      "function": "Web Frontend Security",
       "kind": "control"
     },
     {
-      "control_id": "V11",
-      "title": "Business Logic",
-      "description": "Verify that business logic flows are sequential and audited.",
+      "control_id": "V5",
+      "title": "File Handling",
+      "description": "",
       "parent": null,
-      "function": "Verification",
+      "function": "File Handling",
       "kind": "control"
     },
     {
-      "control_id": "V12",
-      "title": "Files and Resources",
-      "description": "Verify that untrusted files and resources are handled safely.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V5.2",
+      "title": "File Upload and Content",
+      "description": "",
+      "parent": "V5",
+      "function": "File Handling",
       "kind": "control"
     },
     {
-      "control_id": "V13",
-      "title": "API and Web Service",
-      "description": "Verify that API and web service requests are validated.",
-      "parent": null,
-      "function": "Verification",
+      "control_id": "V5.2.1",
+      "title": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
+      "description": "",
+      "parent": "V5.2",
+      "function": "File Handling",
       "kind": "control"
     },
     {
-      "control_id": "V13.1",
-      "title": "Generic Web Service Security",
-      "description": "Verify that all API and web service interactions are authenticated and authorized.",
-      "parent": "V13",
-      "function": "Verification",
+      "control_id": "V5.2.4",
+      "title": "Verify that a file size quota and maximum number of files per user are enforced to ensure that a single user cannot fill up the storage with too many files, or excessively large files.",
+      "description": "",
+      "parent": "V5.2",
+      "function": "File Handling",
       "kind": "control"
     },
     {
-      "control_id": "V14",
-      "title": "Configuration",
-      "description": "Verify that the application is securely configured.",
+      "control_id": "V6",
+      "title": "Authentication",
+      "description": "",
       "parent": null,
-      "function": "Verification",
+      "function": "Authentication",
       "kind": "control"
     },
     {
-      "control_id": "V5.1.1",
-      "title": "Verify all user input validated against allowlist",
-      "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope",
+      "control_id": "V6.2",
+      "title": "Password Security",
+      "description": "",
+      "parent": "V6",
+      "function": "Authentication",
       "kind": "control"
     },
     {
-      "control_id": "V5.2.1",
-      "title": "Verify output encoding prevents injection",
-      "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content",
+      "control_id": "V6.2.1",
+      "title": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.",
+      "description": "",
+      "parent": "V6.2",
+      "function": "Authentication",
       "kind": "control"
     },
     {
-      "control_id": "V5.2.5",
-      "title": "Verify application protects against OS command injection",
-      "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context",
+      "control_id": "V7",
+      "title": "Session Management",
+      "description": "",
+      "parent": null,
+      "function": "Session Management",
       "kind": "control"
     },
     {
-      "control_id": "V1.1.2",
-      "title": "Threat modelling of all data flows",
-      "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented",
+      "control_id": "V7.4",
+      "title": "Session Termination",
+      "description": "",
+      "parent": "V7",
+      "function": "Session Management",
       "kind": "control"
     },
     {
-      "control_id": "V11.1.2",
-      "title": "Verify business logic limits prevent function abuse",
-      "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis",
+      "control_id": "V7.4.1",
+      "title": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.",
+      "description": "",
+      "parent": "V7.4",
+      "function": "Session Management",
       "kind": "control"
     },
     {
-      "control_id": "V4.1.3",
-      "title": "Verify access control enforces least privilege",
-      "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write",
+      "control_id": "V8",
+      "title": "Authorization",
+      "description": "",
+      "parent": null,
+      "function": "Authorization",
       "kind": "control"
     },
     {
-      "control_id": "V4.1.1",
-      "title": "Verify all sensitive functions have access control",
-      "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation",
-      "kind": "control"
+      "control_id": "V8.1.3",
+      "title": "Sensitive data not in session storage",
+      "description": "",
+      "parent": "V8",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, INSUFFICIENT IMPACT)"
     },
     {
-      "control_id": "V7.2.2",
-      "title": "Verify all business logic decisions logged",
-      "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable",
-      "kind": "control"
+      "control_id": "V8.1.4",
+      "title": "Sensitive data minimisation",
+      "description": "",
+      "parent": "V8",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
     },
     {
-      "control_id": "V13.1.1",
-      "title": "Verify API rate limiting",
-      "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion",
+      "control_id": "V8.2",
+      "title": "General Authorization Design",
+      "description": "",
+      "parent": "V8",
+      "function": "Authorization",
       "kind": "control"
     },
     {
-      "control_id": "V2.1.1",
-      "title": "Verify credentials not in source code",
-      "description": "Agent credentials not hardcoded — secret manager required",
+      "control_id": "V8.2.1",
+      "title": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
+      "description": "",
+      "parent": "V8.2",
+      "function": "Authorization",
       "kind": "control"
     },
     {
-      "control_id": "V6.1.1",
-      "title": "Verify sensitive data encrypted at rest",
-      "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest",
+      "control_id": "V8.3",
+      "title": "Operation Level Authorization",
+      "description": "",
+      "parent": "V8",
+      "function": "Authorization",
       "kind": "control"
     },
     {
-      "control_id": "V7.2.1",
-      "title": "Verify access control decisions logged",
-      "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability",
+      "control_id": "V8.3.1",
+      "title": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
+      "description": "",
+      "parent": "V8.3",
+      "function": "Authorization",
       "kind": "control"
     },
     {
-      "control_id": "V14.2.3",
-      "title": "Verify secrets not in source code",
-      "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system",
-      "kind": "control"
+      "control_id": "V8.3.3",
+      "title": "Consent obtained before PI processing",
+      "description": "",
+      "parent": "V8",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
+    },
+    {
+      "control_id": "V8.3.10",
+      "title": "Personal data not kept longer than needed",
+      "description": "",
+      "parent": "V8",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))"
     },
     {
       "control_id": "V10.2.1",
       "title": "Verify third-party components current and free of vulnerabilities",
       "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected",
-      "kind": "control"
+      "parent": null,
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)"
     },
     {
       "control_id": "V10.2.2",
       "title": "Verify only minimal approved external libraries",
       "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected",
-      "kind": "control"
+      "parent": null,
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)"
     },
     {
-      "control_id": "V14.2.2",
-      "title": "Verify build pipelines include security checks",
-      "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning",
+      "control_id": "V11.1.7",
+      "title": "Anti-automation controls",
+      "description": "",
+      "parent": "V11",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
+    },
+    {
+      "control_id": "V12",
+      "title": "Secure Communication",
+      "description": "",
+      "parent": null,
+      "function": "Secure Communication",
       "kind": "control"
     },
     {
-      "control_id": "V5.2.4",
-      "title": "Verify application does not use eval or dynamic code",
-      "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content",
+      "control_id": "V12.2",
+      "title": "HTTPS Communication with External Facing Services",
+      "description": "",
+      "parent": "V12",
+      "function": "Secure Communication",
       "kind": "control"
     },
     {
-      "control_id": "V5.3.5",
-      "title": "Verify output encoding in SQL context",
-      "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context",
+      "control_id": "V12.2.1",
+      "title": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
+      "description": "",
+      "parent": "V12.2",
+      "function": "Secure Communication",
       "kind": "control"
     },
     {
-      "control_id": "V12.1.1",
-      "title": "Verify file upload malware scanning",
-      "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected",
+      "control_id": "V13",
+      "title": "Configuration",
+      "description": "",
+      "parent": null,
+      "function": "Configuration",
       "kind": "control"
     },
     {
-      "control_id": "V9.1.1",
-      "title": "Verify TLS used for all client connectivity",
-      "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum",
+      "control_id": "V13.1.2",
+      "title": "API throttling",
+      "description": "",
+      "parent": "V13",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))"
+    },
+    {
+      "control_id": "V13.2",
+      "title": "Backend Communication Configuration",
+      "description": "",
+      "parent": "V13",
+      "function": "Configuration",
       "kind": "control"
     },
     {
-      "control_id": "V3.3.1",
-      "title": "Verify anti-replay tokens in state-changing operations",
-      "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers",
+      "control_id": "V13.2.1",
+      "title": "Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.",
+      "description": "",
+      "parent": "V13.2",
+      "function": "Configuration",
       "kind": "control"
     },
     {
-      "control_id": "V11.1.1",
-      "title": "Verify business logic assumptions documented",
-      "description": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions — verification requirements per domain; LLM accuracy limitations documented as business logic assumptions — verification requirements defined",
+      "control_id": "V13.4",
+      "title": "Unintended Information Leakage",
+      "description": "",
+      "parent": "V13",
+      "function": "Configuration",
       "kind": "control"
     },
     {
-      "control_id": "V7.4.1",
-      "title": "Verify error handling does not expose sensitive data",
-      "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality",
+      "control_id": "V13.4.5",
+      "title": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
+      "description": "",
+      "parent": "V13.4",
+      "function": "Configuration",
       "kind": "control"
     },
     {
-      "control_id": "V13.1.3",
-      "title": "Verify API rejects large unexpected payloads",
-      "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway",
+      "control_id": "V14",
+      "title": "Data Protection",
+      "description": "",
+      "parent": null,
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V8 Data Protection",
-      "title": "V8.1.1 — Sensitive data not transmitted in URL parameters",
+      "control_id": "V14.1",
+      "title": "Data Protection Documentation",
+      "description": "",
+      "parent": "V14",
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V4 Access Control",
-      "title": "V4.1.3 — Deny by default access control",
+      "control_id": "V14.1.1",
+      "title": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
+      "description": "",
+      "parent": "V14.1",
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V5 Validation",
-      "title": "V5.2.8 — Output encoding for context",
+      "control_id": "V14.1.2",
+      "title": "Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements.",
+      "description": "",
+      "parent": "V14.1",
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V6 Cryptography",
-      "title": "V6.1.1 — Sensitive data not stored in cleartext",
+      "control_id": "V14.1.4",
+      "title": "All components inventoried",
+      "description": "",
+      "parent": "V14",
+      "function": null,
+      "kind": "control",
+      "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
+    },
+    {
+      "control_id": "V14.2",
+      "title": "General Data Protection",
+      "description": "",
+      "parent": "V14",
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V2 Authentication",
-      "title": "V2.1.1 — Passwords minimum 12 characters",
+      "control_id": "V14.2.1",
+      "title": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
+      "description": "",
+      "parent": "V14.2",
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V1 Architecture",
-      "title": "V1.1.4 — Trust boundaries documented and enforced",
+      "control_id": "V14.2.2",
+      "title": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
+      "description": "",
+      "parent": "V14.2",
+      "function": "Data Protection",
       "kind": "control"
     },
     {
-      "control_id": "V7 Logging",
-      "title": "V7.2.2 — Log entries contain required information",
+      "control_id": "V15",
+      "title": "Secure Coding and Architecture",
+      "description": "",
+      "parent": null,
+      "function": "Secure Coding and Architecture",
       "kind": "control"
     },
     {
-      "control_id": "V14 Configuration",
-      "title": "V14.1.4 — All components inventoried",
+      "control_id": "V15.3",
+      "title": "Defensive Coding",
+      "description": "",
+      "parent": "V15",
+      "function": "Secure Coding and Architecture",
       "kind": "control"
     },
     {
-      "control_id": "V10 Malicious Code",
-      "title": "V10.2.1 — Application only uses official repositories",
+      "control_id": "V15.3.3",
+      "title": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.",
+      "description": "",
+      "parent": "V15.3",
+      "function": "Secure Coding and Architecture",
       "kind": "control"
     },
     {
-      "control_id": "V12 Files/Resources",
-      "title": "V12.1.1 — File upload size limits",
+      "control_id": "V15.3.7",
+      "title": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
+      "description": "",
+      "parent": "V15.3",
+      "function": "Secure Coding and Architecture",
       "kind": "control"
     },
     {
-      "control_id": "V9 Communication",
-      "title": "V9.1.1 — TLS for all connections",
+      "control_id": "V16",
+      "title": "Security Logging and Error Handling",
+      "description": "",
+      "parent": null,
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V11 Business Logic",
-      "title": "V11.1.4 — Business logic limits on repeated actions",
+      "control_id": "V16.2",
+      "title": "General Logging",
+      "description": "",
+      "parent": "V16",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V3 Session Management",
-      "title": "V3.1.1 — Session tokens unique and random",
+      "control_id": "V16.2.5",
+      "title": "Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially.",
+      "description": "",
+      "parent": "V16.2",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V13 API",
-      "title": "V13.1.1 — API protection against enumeration",
+      "control_id": "V16.3",
+      "title": "Security Events",
+      "description": "",
+      "parent": "V16",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V5.1.2",
-      "title": "Verify that HTTP request parts are validated, sanitised, or rejected",
-      "description": "LLM API request validation — prompt structure, content type, and character set enforced",
+      "control_id": "V16.3.1",
+      "title": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
+      "description": "",
+      "parent": "V16.3",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V8.1.1",
-      "title": "Verify sensitive data is not cached or exposed in logs",
-      "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code",
+      "control_id": "V16.3.2",
+      "title": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
+      "description": "",
+      "parent": "V16.3",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V8.3.4",
-      "title": "Verify PII is identified and protected",
-      "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy",
+      "control_id": "V16.5",
+      "title": "Error Handling",
+      "description": "",
+      "parent": "V16",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V4.2.2",
-      "title": "Verify anti-CSRF tokens in state-changing operations",
-      "description": "CSRF protection on endpoints where LLM output triggers state changes",
+      "control_id": "V16.5.1",
+      "title": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
+      "description": "",
+      "parent": "V16.5",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     },
     {
-      "control_id": "V11.1.4",
-      "title": "Verify business logic rate limits",
-      "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies",
+      "control_id": "V16.5.3",
+      "title": "Verify that the application fails gracefully and securely, including when an exception occurs, preventing fail-open conditions such as processing a transaction despite errors resulting from validation logic.",
+      "description": "",
+      "parent": "V16.5",
+      "function": "Security Logging and Error Handling",
       "kind": "control"
     }
   ],
@@ -516,13 +651,28 @@
       "date": "2026-04-09",
       "change": "Initial seed — 32 ASVS verification requirements and sub-requirements",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 75 items -> 82, including 17 referenced by mappings but absent from the registry",
+      "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 82 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)",
+      "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 78 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ],
   "inventory_completeness": {
-    "status": "unknown",
-    "included": 75,
-    "total": null,
-    "note": "Authoritative control count not established. Needs a count from the published framework.",
-    "source": "https://owasp.org/projects/asvs"
+    "status": "partial",
+    "included": 78,
+    "total": 345,
+    "note": "Holds the 44 requirement(s) the mappings cite plus their sections and chapters, titled from the ASVS 5.0.0 release. The standard has 345 requirements in total; the rest are not referenced by this crosswalk. 11 id(s) remain at 4.0.3 because 5.0.0 deleted them — see issue #22.",
+    "source": "https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release"
   }
 }
diff --git a/data/frameworks/owasp-nhi.json b/data/frameworks/owasp-nhi.json
index 1b0991f..25046ac 100644
--- a/data/frameworks/owasp-nhi.json
+++ b/data/frameworks/owasp-nhi.json
@@ -98,6 +98,11 @@
       "date": "2026-09-18",
       "change": "Migrated off the swapped-column ids of issue #35: 104 items -> 10",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 10 items -> 10",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ]
 }
diff --git a/data/frameworks/pci-dss.json b/data/frameworks/pci-dss.json
index a0e3e82..0dc2633 100644
--- a/data/frameworks/pci-dss.json
+++ b/data/frameworks/pci-dss.json
@@ -339,6 +339,11 @@
       "date": "2026-09-18",
       "change": "Titled 17 entries that had carried only their identifier, from the published text: PCI DSS v4.0 requirement headings, transcribed from PCI SSC \"PCI DSS v4.0 SAQ D for Merchants\" — Req 1.3, Req 2.2, Req 3.4, Req 3.5, Req 4.2, Req 5.2, Req 6.3, Req 6.4, Req 7.2, Req 7.3, Req 8.2, Req 8.3, Req 10.2, Req 10.7, Req 11.3, Req 12.3, Req 12.6",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 49 items -> 49",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ]
 }
diff --git a/data/frameworks/soc2.json b/data/frameworks/soc2.json
index 6b2c4ac..e5e00ad 100644
--- a/data/frameworks/soc2.json
+++ b/data/frameworks/soc2.json
@@ -386,6 +386,11 @@
       "date": "2026-09-18",
       "change": "Titled 2 entries that had carried only their identifier, from the published text: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022) — P7.1, PI1.3",
       "author": "OWASP GenAI Data Security Initiative"
+    },
+    {
+      "date": "2026-09-18",
+      "change": "Migrated off the swapped-column ids of issue #35: 46 items -> 46",
+      "author": "OWASP GenAI Data Security Initiative"
     }
   ],
   "inventory_completeness": {
diff --git a/data/stats.json b/data/stats.json
index 9ccfa54..6f5e69c 100644
--- a/data/stats.json
+++ b/data/stats.json
@@ -74,8 +74,8 @@
   },
   "freshness": {
     "checked": 5,
-    "current": 3,
-    "diverged": 2,
+    "current": 4,
+    "diverged": 1,
     "unchecked": 21,
     "diverged_frameworks": [
       {
@@ -83,20 +83,14 @@
         "mapped": "4.0",
         "current": "2026.09",
         "checked": "2026-09-17"
-      },
-      {
-        "name": "OWASP ASVS 4.0.3",
-        "mapped": "4.0.3",
-        "current": "5.0.0",
-        "checked": "2026-08-28"
       }
     ]
   },
   "controls": {
-    "total": 991,
-    "registry_items": 1125,
+    "total": 994,
+    "registry_items": 1128,
     "by_kind": {
-      "control": 991,
+      "control": 994,
       "layer": 10,
       "technique": 57,
       "threat-category": 6,
diff --git a/docs/ASVS_4_TO_5_TRANSLATION.md b/docs/ASVS_4_TO_5_TRANSLATION.md
new file mode 100644
index 0000000..acecbfd
--- /dev/null
+++ b/docs/ASVS_4_TO_5_TRANSLATION.md
@@ -0,0 +1,110 @@
+<!--
+  OWASP GenAI Crosswalk
+  File    : ASVS 4.0.3 -> 5.0.0 identifier translation
+  Source  : OWASP/ASVS 5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml
+  License : CC BY-SA 4.0
+-->
+
+# ASVS 4.0.3 → 5.0.0 translation
+
+Every ASVS identifier this crosswalk cites, and what the **ASVS project’s own mapping
+file** says became of it in 5.0.0. Nothing here is our judgment: the disposition column
+is quoted from [`mapping_v4.0.3_to_v5.0.0.yml`][official], and the 5.0.0 requirement text
+is from the [v5.0.0 release][release].
+
+[official]: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml
+[release]: https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release
+
+| | |
+|---|--:|
+| Identifiers cited by this crosswalk | 50 |
+| Mapping rows they cover | 151 |
+| **Translated to a 5.0.0 identifier** | **39 ids / 127 rows** |
+| **Retained at 4.0.3 — 5.0.0 has no successor** | **11 ids / 24 rows** |
+
+Dispositions seen:
+
+- `modified` × 16
+- `moved` × 12
+- `deleted` × 9
+- `merged` × 6
+- `covered-by` × 3
+- `not-in-official-mapping` × 2
+- `other` × 1
+- `split` × 1
+
+## Translated
+
+The requirement text on each row was replaced with 5.0.0’s own wording. Where the official
+file records a **split**, the row takes the first target and the full disposition is recorded
+here — an SME decides whether the second target deserves its own row.
+
+| 4.0.3 | → 5.0.0 | Official disposition | Rows | Entries |
+|---|---|---|--:|---|
+| `V2.1.1` | `V6.2.1` | MODIFIED, MOVED TO v5.0.0-6.2.1 | 3 | ASI03, DSGAI02, DSGAI19 |
+| `V2.10.1` | `V13.2.1` | MOVED TO v5.0.0-13.2.1 | 1 | DSGAI02 |
+| `V3.1.1` | `V14.2.1` | DELETED, MERGED TO v5.0.0-14.2.1 | 2 | DSGAI11, DSGAI15 |
+| `V3.3.1` | `V7.4.1` | MOVED TO v5.0.0-7.4.1 | 2 | ASI07, DSGAI11 |
+| `V4.1.1` | `V8.3.1` | MOVED TO v5.0.0-8.3.1 | 7 | ASI02, DSGAI06, DSGAI11, DSGAI12, DSGAI14, DSGAI20, LLM03 |
+| `V4.1.2` | `V8.2.1` | DELETED, COVERED BY v5.0.0-8.2.1 | 3 | DSGAI02, DSGAI16, DSGAI19 |
+| `V4.1.3` | `V8.2.1` | MODIFIED, MOVED TO v5.0.0-8.2.1 | 11 | ASI02, ASI03, ASI06, ASI07, DSGAI01, DSGAI13, DSGAI15, LLM02, LLM03, LLM08, LLM09 |
+| `V4.1.5` | `V16.5.3` | MOVED TO v5.0.0-16.5.3 | 2 | DSGAI03, DSGAI07 |
+| `V4.2.2` | `V3.5.1` | MOVED TO v5.0.0-3.5.1 | 1 | LLM10 |
+| `V5.1.1` | `V15.3.7` | MOVED TO v5.0.0-15.3.7 | 6 | ASI01, ASI06, DSGAI05, DSGAI12, LLM01, LLM05 |
+| `V5.1.2` | `V15.3.3` | MOVED TO v5.0.0-15.3.3 | 1 | LLM01 |
+| `V5.1.3` | `V2.2.1` | MOVED TO v5.0.0-2.2.1 | 2 | DSGAI04, DSGAI21 |
+| `V5.2.1` | `V1.3.1` | MODIFIED, MOVED TO v5.0.0-1.3.1 | 7 | ASI01, ASI05, ASI09, DSGAI05, LLM01, LLM07, LLM10 |
+| `V5.2.4` | `V1.3.2` | MODIFIED, MOVED TO v5.0.0-1.3.2 | 2 | ASI05, LLM10 |
+| `V5.2.5` | `V1.3.7` | MODIFIED, MOVED TO v5.0.0-1.3.7 | 5 | ASI01, ASI05, DSGAI09, LLM01, LLM10 |
+| `V5.2.6` | `V1.3.6` | MODIFIED, MOVED TO v5.0.0-1.3.6 | 1 | DSGAI10 |
+| `V5.2.8` | `V1.3.5` | MODIFIED, MOVED TO v5.0.0-1.3.5 | 1 | DSGAI01 |
+| `V5.3.4` | `V1.2.4` | MODIFIED, MOVED TO v5.0.0-1.2.4 | 1 | DSGAI12 |
+| `V5.3.5` | `V1.2.4` | DELETED, COVERED BY v5.0.0-1.2.4 | 2 | ASI05, LLM10 |
+| `V6.1.1` | `V14.1.1` | DELETED, MERGED TO v5.0.0-14.1.1 | 7 | ASI03, ASI06, DSGAI01, DSGAI13, DSGAI18, LLM02, LLM09 |
+| `V7.1.1` | `V16.2.5` | MODIFIED, MOVED TO v5.0.0-16.2.5 | 1 | DSGAI14 |
+| `V7.1.2` | `V16.2.5` | DELETED, MERGED TO v5.0.0-16.2.5 | 1 | DSGAI14 |
+| `V7.2.1` | `V16.3.1` | MODIFIED, MOVED TO v5.0.0-16.3.1 | 4 | ASI03, ASI07, ASI10, LLM08 |
+| `V7.2.2` | `V16.3.2` | MODIFIED, MOVED TO v5.0.0-16.3.2 | 5 | ASI02, ASI10, DSGAI03, DSGAI08, LLM03 |
+| `V7.4.1` | `V16.5.1` | MODIFIED, MOVED TO v5.0.0-16.5.1 | 5 | ASI08, ASI09, DSGAI05, LLM06, LLM07 |
+| `V8.1.1` | `V14.2.2` | MODIFIED, MOVED TO v5.0.0-14.2.2 | 4 | DSGAI01, DSGAI14, LLM02, LLM08 |
+| `V8.3.4` | `V14.1.1` | DELETED, MERGED TO v5.0.0-14.1.1 | 5 | DSGAI01, DSGAI07, DSGAI10, DSGAI18, LLM02 |
+| `V8.3.7` | `V14.1.2` | DELETED, COVERED BY v5.0.0-14.1.2 | 1 | DSGAI02 |
+| `V9.1.1` | `V12.2.1` | MODIFIED, MOVED TO v5.0.0-12.2.1 | 3 | ASI07, DSGAI06, LLM02 |
+| `V11.1.1` | `V2.3.1` | MODIFIED, MOVED TO v5.0.0-2.3.1 | 3 | ASI08, ASI09, LLM07 |
+| `V11.1.2` | `V2.4.2` | MOVED TO v5.0.0-2.4.2 | 7 | ASI01, ASI02, ASI05, ASI08, ASI10, LLM01, LLM03 |
+| `V11.1.4` | `V2.4.1` | MOVED TO v5.0.0-2.4.1 | 3 | DSGAI06, DSGAI21, LLM06 |
+| `V11.1.5` | `V2.2.1` | DELETED, MERGED TO v5.0.0-2.2.1 | 1 | DSGAI16 |
+| `V12.1.1` | `V5.2.1` | MODIFIED, MOVED TO v5.0.0-5.2.1 | 5 | ASI06, DSGAI04, DSGAI13, LLM05, LLM09 |
+| `V12.1.3` | `V5.2.4` | GRAMMAR, MOVED TO v5.0.0-5.2.4 | 1 | DSGAI09 |
+| `V13.1.1` | `V1.5.3` | MOVED TO v5.0.0-1.5.3 | 5 | ASI02, ASI08, ASI10, DSGAI12, LLM06 |
+| `V13.1.3` | `V14.2.1` | DELETED, MERGED TO v5.0.0-14.2.1 | 2 | ASI09, LLM06 |
+| `V14.2.2` | `V13.4.5` | SPLIT TO v5.0.0-13.4.5, v5.0.0-15.2.3 | 2 | ASI04, LLM04 |
+| `V14.2.3` | `V3.6.1` | MOVED TO v5.0.0-3.6.1 | 2 | ASI03, LLM08 |
+
+## Retained at 4.0.3 — no 5.0.0 successor
+
+These rows keep their 4.0.3 identifier and carry a DRAFT marker naming the disposition.
+They are **not** silently renumbered: several of these numbers exist in 5.0.0 as an entirely
+different requirement, so reusing them would assert a mapping nobody made.
+
+| 4.0.3 | Official disposition | Rows | Entries |
+|---|---|--:|---|
+| `V1.1.2` | DELETED, NOT IN SCOPE | 4 | ASI01, ASI04, DSGAI16, LLM01 |
+| `V1.1.4` | DELETED, NOT IN SCOPE | 1 | DSGAI03 |
+| `V8.1.3` | DELETED, INSUFFICIENT IMPACT | 1 | DSGAI11 |
+| `V8.1.4` | DELETED, NOT IN SCOPE | 4 | DSGAI07, DSGAI09, DSGAI15, DSGAI20 |
+| `V8.3.3` | DELETED, NOT IN SCOPE | 2 | DSGAI08, DSGAI19 |
+| `V8.3.10` | (id absent from the official 4.0.3 mapping) | 1 | DSGAI08 |
+| `V10.2.1` | DELETED, NOT PRACTICAL | 4 | ASI04, DSGAI04, LLM04, LLM05 |
+| `V10.2.2` | DELETED, NOT PRACTICAL | 4 | ASI04, DSGAI04, DSGAI20, LLM04 |
+| `V11.1.7` | DELETED, NOT IN SCOPE | 1 | DSGAI17 |
+| `V13.1.2` | (id absent from the official 4.0.3 mapping) | 1 | DSGAI17 |
+| `V14.1.4` | DELETED, NOT IN SCOPE | 1 | DSGAI03 |
+
+## What still needs a human
+
+- The 11 retained identifiers above: retarget to a 5.0.0 requirement, or drop the row.
+- **Every** translated row’s `relationship`, `rationale type` and `confidence`, all of
+  which read `DRAFT`. The identifier translation is mechanical; whether the 5.0.0
+  requirement still addresses the GenAI risk the row claims is expert judgment (C4),
+  reviewed by an ASVS-leadership reviewer per STRAT-04.
diff --git a/docs/backlinks.js b/docs/backlinks.js
index 5f293e2..926b15b 100644
--- a/docs/backlinks.js
+++ b/docs/backlinks.js
@@ -1,5 +1,5 @@
 // Auto-generated by scripts/generate.js — do not edit manually
-// Backlinks: 766
+// Backlinks: 767
 window.CROSSWALK_BACKLINKS = [
   {
     "framework": "AIUC-1",
@@ -30528,31 +30528,6 @@ window.CROSSWALK_BACKLINKS = [
       }
     ]
   },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V1 Architecture",
-    "control_name": "V1.1.4 — Trust boundaries documented and enforced",
-    "entries": [
-      {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      },
-      {
-        "id": "DSGAI16",
-        "name": "Endpoint and Browser Overreach",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
   {
     "framework": "OWASP ASVS 4.0.3",
     "control_id": "V1.1.2",
@@ -30565,7 +30540,7 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM data flows threat-modelled — all injection paths identified and documented"
+        "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
         "id": "ASI01",
@@ -30574,7 +30549,7 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All agent input sources threat-modelled — every indirect injection path documented"
+        "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
         "id": "ASI04",
@@ -30583,175 +30558,200 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Supply chain threat model documents all agent component sources and trust levels"
+        "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
+      },
+      {
+        "id": "DSGAI16",
+        "name": "Endpoint and Browser Overreach",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V10 Malicious Code",
-    "control_name": "V10.2.1 — Application only uses official repositories",
+    "control_id": "V1.1.4",
+    "control_name": "Trust boundaries documented and enforced",
     "entries": [
       {
-        "id": "DSGAI04",
-        "name": "Data Model and Artifact Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": null
-      },
-      {
-        "id": "DSGAI20",
-        "name": "Model Exfiltration and IP Replication",
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V10.2.1",
-    "control_name": "Verify third-party components are current and free from vulnerabilities",
+    "control_id": "V1.2.4",
+    "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
     "entries": [
       {
-        "id": "LLM04",
-        "name": "Supply Chain",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained"
+        "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context"
       },
       {
-        "id": "LLM05",
-        "name": "Data and Model Poisoning",
-        "source_list": "LLM-Top10-2026",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
+        "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Training pipeline components scanned — compromised dependencies rejected"
+        "notes": "No raw agent output in SQL context — parameterised execution only"
       },
       {
-        "id": "ASI04",
-        "name": "Agentic Supply Chain",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "High",
+        "id": "DSGAI12",
+        "name": "Unsafe Natural Language Data Gateways",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
         "tier": "Foundational",
-        "scope": "Both",
-        "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored"
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V10.2.2",
-    "control_name": "Verify only minimal approved external libraries are used",
+    "control_id": "V1.3.1",
+    "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
     "entries": [
       {
-        "id": "LLM04",
-        "name": "Supply Chain",
+        "id": "LLM01",
+        "name": "Prompt Injection",
         "source_list": "LLM-Top10-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected"
+        "notes": "LLM output encoding before passing to downstream renderers or interpreters"
       },
       {
-        "id": "ASI04",
-        "name": "Agentic Supply Chain",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM07",
+        "name": "Misinformation",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approved component list — unsigned or unverified agent components rejected"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11 Business Logic",
-    "control_name": "V11.1.4 — Business logic limits on repeated actions",
-    "entries": [
+        "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source"
+      },
       {
-        "id": "DSGAI06",
-        "name": "Tool Plugin and Agent Data Exchange",
-        "source_list": "DSGAI-2026",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "LLM responses rendered in browser contexts encoded against XSS"
       },
       {
-        "id": "DSGAI16",
-        "name": "Endpoint and Browser Overreach",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI01",
+        "name": "Agent Goal Hijack",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted"
       },
       {
-        "id": "DSGAI17",
-        "name": "Data Availability and Resilience Failures",
-        "source_list": "DSGAI-2026",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Agent code output encoded before rendering in any context"
+      },
+      {
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content"
       },
       {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
+        "id": "DSGAI05",
+        "name": "Data Integrity and Validation Failures",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
+        "tier": "Foundational",
+        "scope": "Build",
         "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11.1.1",
-    "control_name": "Verify business logic assumptions documented",
+    "control_id": "V1.3.2",
+    "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
     "entries": [
       {
-        "id": "LLM07",
-        "name": "Misinformation",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined"
+        "notes": "No eval or dynamic code execution of LLM-generated content"
       },
       {
-        "id": "ASI08",
-        "name": "Cascading Agent Failures",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted"
-      },
+        "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review"
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V1.3.5",
+    "control_name": "Output encoding for context",
+    "entries": [
       {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "High",
+        "id": "DSGAI01",
+        "name": "Sensitive Data Leakage",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain"
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V1.3.6",
+    "control_name": "Defined output structure",
+    "entries": [
+      {
+        "id": "DSGAI10",
+        "name": "Synthetic Data and Anonymization Pitfalls",
+        "source_list": "DSGAI-2026",
+        "severity": "Medium",
+        "tier": "Hardening",
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11.1.2",
-    "control_name": "Verify business logic limits prevent abuse of LLM functions",
+    "control_id": "V1.3.7",
+    "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
     "entries": [
       {
         "id": "LLM01",
@@ -30760,16 +30760,16 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions"
+        "notes": "LLM-generated content validated before execution in any shell or interpreter context"
       },
       {
-        "id": "LLM03",
-        "name": "Excessive Agency",
+        "id": "LLM10",
+        "name": "Improper Output Handling",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls preventing tool misuse through prompt manipulation"
+        "notes": "LLM-generated commands validated — never raw output in shell context"
       },
       {
         "id": "ASI01",
@@ -30778,25 +30778,50 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls prevent injection from redirecting agent goal"
+        "notes": "Agent-generated instructions not executed in system context without validation"
       },
       {
-        "id": "ASI02",
-        "name": "Tool Misuse and Exploitation",
+        "id": "ASI05",
+        "name": "Unexpected Code Execution",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Agent-generated commands validated before any shell execution"
+      },
+      {
+        "id": "DSGAI09",
+        "name": "Multimodal Cross-Channel Leakage",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V1.5.3",
+    "control_name": "Verify API rate limiting",
+    "entries": [
+      {
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
       },
       {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
+        "id": "ASI02",
+        "name": "Tool Misuse and Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
       },
       {
         "id": "ASI08",
@@ -30805,7 +30830,7 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Circuit breakers as business logic controls — cascade propagation limited by design"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
       },
       {
         "id": "ASI10",
@@ -30814,108 +30839,110 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope"
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio"
+      },
+      {
+        "id": "DSGAI12",
+        "name": "Unsafe Natural Language Data Gateways",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V11.1.4",
-    "control_name": "Verify business logic rate limits",
+    "control_id": "V10.2.1",
+    "control_name": "Verify third-party components are current and free from vulnerabilities",
     "entries": [
       {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
+        "id": "LLM04",
+        "name": "Supply Chain",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V12 Files/Resources",
-    "control_name": "V12.1.1 — File upload size limits",
-    "entries": [
+        "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
+      },
       {
-        "id": "DSGAI04",
-        "name": "Data Model and Artifact Poisoning",
-        "source_list": "DSGAI-2026",
+        "id": "LLM05",
+        "name": "Data and Model Poisoning",
+        "source_list": "LLM-Top10-2026",
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI09",
-        "name": "Multimodal Cross-Channel Leakage",
-        "source_list": "DSGAI-2026",
+        "id": "ASI04",
+        "name": "Agentic Supply Chain",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI13",
-        "name": "Vector Store Platform Security",
+        "id": "DSGAI04",
+        "name": "Data Model and Artifact Poisoning",
         "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
+        "severity": "Critical",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V12.1.1",
-    "control_name": "Verify file uploads scanned for malware",
+    "control_id": "V10.2.2",
+    "control_name": "Verify only minimal approved external libraries are used",
     "entries": [
       {
-        "id": "LLM05",
-        "name": "Data and Model Poisoning",
+        "id": "LLM04",
+        "name": "Supply Chain",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
+        "severity": "High",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "Training data uploads scanned before ingestion — adversarial content detected"
+        "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "LLM09",
-        "name": "Vector and Embedding Weaknesses",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Medium",
+        "id": "ASI04",
+        "name": "Agentic Supply Chain",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
+      },
+      {
+        "id": "DSGAI04",
+        "name": "Data Model and Artifact Poisoning",
+        "source_list": "DSGAI-2026",
+        "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Content validation on all vector store ingestion — adversarial content detected"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI20",
+        "name": "Model Exfiltration and IP Replication",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V13 API",
-    "control_name": "V13.1.1 — API protection against enumeration",
+    "control_id": "V11.1.7",
+    "control_name": "Anti-automation controls",
     "entries": [
-      {
-        "id": "DSGAI12",
-        "name": "Unsafe Natural Language Data Gateways",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
-      },
       {
         "id": "DSGAI17",
         "name": "Data Availability and Resilience Failures",
@@ -30923,88 +30950,70 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V13.1.1",
-    "control_name": "Verify API rate limiting",
+    "control_id": "V12.2.1",
+    "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
     "entries": [
       {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key"
+        "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum"
       },
       {
-        "id": "ASI02",
-        "name": "Tool Misuse and Exploitation",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
         "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected"
+        "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages"
       },
       {
-        "id": "ASI08",
-        "name": "Cascading Agent Failures",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
+        "id": "DSGAI06",
+        "name": "Tool Plugin and Agent Data Exchange",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited"
-      },
-      {
-        "id": "ASI10",
-        "name": "Rogue Agents",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion"
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V13.1.3",
-    "control_name": "Verify API rejects large unexpected payloads",
+    "control_id": "V13.1.2",
+    "control_name": "API throttling",
     "entries": [
       {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway"
-      },
-      {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI17",
+        "name": "Data Availability and Resilience Failures",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V14 Configuration",
-    "control_name": "V14.1.4 — All components inventoried",
+    "control_id": "V13.2.1",
+    "control_name": "Integration secrets not hardcoded",
     "entries": [
       {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
+        "id": "DSGAI02",
+        "name": "Agent Identity and Credential Exposure",
         "source_list": "DSGAI-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
         "notes": null
@@ -31013,8 +31022,8 @@ window.CROSSWALK_BACKLINKS = [
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V14.2.2",
-    "control_name": "Verify build pipelines include security checks",
+    "control_id": "V13.4.5",
+    "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
     "entries": [
       {
         "id": "LLM04",
@@ -31038,17 +31047,26 @@ window.CROSSWALK_BACKLINKS = [
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V14.2.3",
-    "control_name": "Verify secrets not in source code",
+    "control_id": "V14.1.1",
+    "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
     "entries": [
       {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "System prompts not hardcoded in source code — stored in secret management system"
+        "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy"
+      },
+      {
+        "id": "LLM09",
+        "name": "Vector and Embedding Weaknesses",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Medium",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "All vector store content encrypted at rest"
       },
       {
         "id": "ASI03",
@@ -31057,18 +31075,20 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent credentials not committed to source control"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V2 Authentication",
-    "control_name": "V2.1.1 — Passwords minimum 12 characters",
-    "entries": [
+        "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory"
+      },
       {
-        "id": "DSGAI02",
-        "name": "Agent Identity and Credential Exposure",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory"
+      },
+      {
+        "id": "DSGAI01",
+        "name": "Sensitive Data Leakage",
         "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Foundational",
@@ -31076,37 +31096,98 @@ window.CROSSWALK_BACKLINKS = [
         "notes": null
       },
       {
-        "id": "DSGAI19",
-        "name": "Human-in-Loop and Labeler Overexposure",
+        "id": "DSGAI07",
+        "name": "Data Governance and Lifecycle",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
+      },
+      {
+        "id": "DSGAI10",
+        "name": "Synthetic Data and Anonymization Pitfalls",
         "source_list": "DSGAI-2026",
         "severity": "Medium",
+        "tier": "Hardening",
+        "scope": "Build",
+        "notes": null
+      },
+      {
+        "id": "DSGAI13",
+        "name": "Vector Store Platform Security",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
         "notes": null
+      },
+      {
+        "id": "DSGAI18",
+        "name": "Inference and Data Reconstruction",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V2.1.1",
-    "control_name": "Verify credentials not in source code",
+    "control_id": "V14.1.2",
+    "control_name": "Data transferred using current TLS",
     "entries": [
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI02",
+        "name": "Agent Identity and Credential Exposure",
+        "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent credentials not hardcoded — secret manager required"
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V14.1.4",
+    "control_name": "All components inventoried",
+    "entries": [
+      {
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V3 Session Management",
-    "control_name": "V3.1.1 — Session tokens unique and random",
+    "control_id": "V14.2.1",
+    "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
     "entries": [
+      {
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway"
+      },
+      {
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat"
+      },
       {
         "id": "DSGAI11",
         "name": "Cross-Context Conversation Bleed",
@@ -31129,37 +31210,30 @@ window.CROSSWALK_BACKLINKS = [
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V3.3.1",
-    "control_name": "Verify anti-replay tokens in state-changing operations",
+    "control_id": "V14.2.2",
+    "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
     "entries": [
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4 Access Control",
-    "control_name": "V4.1.3 — Deny by default access control",
-    "entries": [
-      {
-        "id": "DSGAI01",
-        "name": "Sensitive Data Leakage",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection"
       },
       {
-        "id": "DSGAI02",
-        "name": "Agent Identity and Credential Exposure",
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "System prompts not stored in cleartext application configuration or source code"
+      },
+      {
+        "id": "DSGAI01",
+        "name": "Sensitive Data Leakage",
         "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Foundational",
@@ -31167,35 +31241,76 @@ window.CROSSWALK_BACKLINKS = [
         "notes": null
       },
       {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
+        "id": "DSGAI14",
+        "name": "Excessive Telemetry and Monitoring Leakage",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
+        "scope": "Build",
         "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V15.3.3",
+    "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.",
+    "entries": [
+      {
+        "id": "LLM01",
+        "name": "Prompt Injection",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "LLM API request validation — prompt structure, content type, and character set enforced"
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V15.3.7",
+    "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
+    "entries": [
+      {
+        "id": "LLM01",
+        "name": "Prompt Injection",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope"
       },
       {
-        "id": "DSGAI06",
-        "name": "Tool Plugin and Agent Data Exchange",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "LLM05",
+        "name": "Data and Model Poisoning",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Training data pipeline input validation — anomalous data rejected before training"
+      },
+      {
+        "id": "ASI01",
+        "name": "Agent Goal Hijack",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "All inputs to agents validated — indirect injection through processed content equally in scope"
       },
       {
-        "id": "DSGAI07",
-        "name": "Data Governance and Lifecycle",
-        "source_list": "DSGAI-2026",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "All content entering agent memory validated — injection patterns rejected at write boundary"
       },
       {
-        "id": "DSGAI11",
-        "name": "Cross-Context Conversation Bleed",
+        "id": "DSGAI05",
+        "name": "Data Integrity and Validation Failures",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
@@ -31210,16 +31325,14 @@ window.CROSSWALK_BACKLINKS = [
         "tier": "Foundational",
         "scope": "Build",
         "notes": null
-      },
-      {
-        "id": "DSGAI13",
-        "name": "Vector Store Platform Security",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      },
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V16.2.5",
+    "control_name": "No credential logging",
+    "entries": [
       {
         "id": "DSGAI14",
         "name": "Excessive Telemetry and Monitoring Leakage",
@@ -31228,49 +31341,56 @@ window.CROSSWALK_BACKLINKS = [
         "tier": "Foundational",
         "scope": "Build",
         "notes": null
-      },
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V16.3.1",
+    "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
+    "entries": [
       {
-        "id": "DSGAI15",
-        "name": "Over-Broad Context Windows",
-        "source_list": "DSGAI-2026",
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "scope": "Both",
+        "notes": "All access to system prompts logged — unauthorised access attempts detectable"
       },
       {
-        "id": "DSGAI16",
-        "name": "Endpoint and Browser Overreach",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "All credential usage logged — issuance, access, expiry detectable"
       },
       {
-        "id": "DSGAI19",
-        "name": "Human-in-Loop and Labeler Overexposure",
-        "source_list": "DSGAI-2026",
-        "severity": "Medium",
-        "tier": "Foundational",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "All A2A messages logged — sender identity, content hash, schema validation results"
       },
       {
-        "id": "DSGAI20",
-        "name": "Model Exfiltration and IP Replication",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI10",
+        "name": "Rogue Agents",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": null
+        "notes": "All agent actions logged — no production deployment without complete observability"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4.1.1",
-    "control_name": "Verify all sensitive functions have access control",
+    "control_id": "V16.3.2",
+    "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
     "entries": [
       {
         "id": "LLM03",
@@ -31279,7 +31399,7 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation"
+        "notes": "All LLM tool invocations logged with full context — every tool call auditable"
       },
       {
         "id": "ASI02",
@@ -31288,119 +31408,119 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4.1.3",
-    "control_name": "Verify access control decisions enforce least privilege",
-    "entries": [
+        "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp"
+      },
       {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
+        "id": "ASI10",
+        "name": "Rogue Agents",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access"
+        "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis"
       },
       {
-        "id": "LLM03",
-        "name": "Excessive Agency",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM tool access enforced at minimum required scope — read-only by default"
+        "notes": null
       },
       {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI08",
+        "name": "Non-Compliance and Regulatory Violations",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "System prompt access restricted to authorised personnel — read access logged"
-      },
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V16.5.1",
+    "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
+    "entries": [
       {
-        "id": "LLM09",
-        "name": "Vector and Embedding Weaknesses",
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
         "source_list": "LLM-Top10-2026",
-        "severity": "Medium",
-        "tier": "Hardening",
+        "severity": "High",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "RBAC on all vector store collections — no unauthenticated access"
+        "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses"
       },
       {
-        "id": "ASI02",
-        "name": "Tool Misuse and Exploitation",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
+        "id": "LLM07",
+        "name": "Misinformation",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved"
+        "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality"
       },
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
+        "id": "ASI08",
+        "name": "Cascading Agent Failures",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent credential scope minimum required — no over-privileged NHIs"
+        "notes": "Cascade errors handled gracefully — no sensitive system information in error responses"
       },
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write"
+        "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable"
       },
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI05",
+        "name": "Data Integrity and Validation Failures",
+        "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "A2A channels enforce sender identity — unauthenticated messages rejected"
+        "tier": "Foundational",
+        "scope": "Build",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V4.2.2",
-    "control_name": "Verify anti-CSRF tokens in state-changing operations",
+    "control_id": "V16.5.3",
+    "control_name": "Access control failures logged",
     "entries": [
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI03",
+        "name": "Shadow AI and Unsanctioned Data Flows",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "CSRF protection on endpoints where LLM output triggers state changes"
+        "notes": null
+      },
+      {
+        "id": "DSGAI07",
+        "name": "Data Governance and Lifecycle",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5 Validation",
-    "control_name": "V5.2.8 — Output encoding for context",
+    "control_id": "V2.2.1",
+    "control_name": "Input validation server-side",
     "entries": [
-      {
-        "id": "DSGAI01",
-        "name": "Sensitive Data Leakage",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      },
       {
         "id": "DSGAI04",
         "name": "Data Model and Artifact Poisoning",
@@ -31411,41 +31531,14 @@ window.CROSSWALK_BACKLINKS = [
         "notes": null
       },
       {
-        "id": "DSGAI05",
-        "name": "Data Integrity and Validation Failures",
+        "id": "DSGAI16",
+        "name": "Endpoint and Browser Overreach",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
-      },
-      {
-        "id": "DSGAI09",
-        "name": "Multimodal Cross-Channel Leakage",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Hardening",
         "scope": "Both",
         "notes": null
       },
-      {
-        "id": "DSGAI10",
-        "name": "Synthetic Data and Anonymization Pitfalls",
-        "source_list": "DSGAI-2026",
-        "severity": "Medium",
-        "tier": "Hardening",
-        "scope": "Build",
-        "notes": null
-      },
-      {
-        "id": "DSGAI12",
-        "name": "Unsafe Natural Language Data Gateways",
-        "source_list": "DSGAI-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
-      },
       {
         "id": "DSGAI21",
         "name": "Disinformation via Data Poisoning",
@@ -31459,67 +31552,76 @@ window.CROSSWALK_BACKLINKS = [
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.1.1",
-    "control_name": "Verify all user input validated against an allowlist or rejected",
+    "control_id": "V2.3.1",
+    "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
     "entries": [
       {
-        "id": "LLM01",
-        "name": "Prompt Injection",
+        "id": "LLM07",
+        "name": "Misinformation",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope"
-      },
-      {
-        "id": "LLM05",
-        "name": "Data and Model Poisoning",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Training data pipeline input validation — anomalous data rejected before training"
+        "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined"
       },
       {
-        "id": "ASI01",
-        "name": "Agent Goal Hijack",
+        "id": "ASI08",
+        "name": "Cascading Agent Failures",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All inputs to agents validated — indirect injection through processed content equally in scope"
+        "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted"
       },
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
+        "id": "ASI09",
+        "name": "Human-Agent Trust Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "All content entering agent memory validated — injection patterns rejected at write boundary"
+        "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.1.2",
-    "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected",
+    "control_id": "V2.4.1",
+    "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.",
     "entries": [
       {
-        "id": "LLM01",
-        "name": "Prompt Injection",
+        "id": "LLM06",
+        "name": "Unbounded Consumption",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
+        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM API request validation — prompt structure, content type, and character set enforced"
+        "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies"
+      },
+      {
+        "id": "DSGAI06",
+        "name": "Tool Plugin and Agent Data Exchange",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
+      },
+      {
+        "id": "DSGAI21",
+        "name": "Disinformation via Data Poisoning",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.2.1",
-    "control_name": "Verify output encoding prevents injection attacks",
+    "control_id": "V2.4.2",
+    "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
     "entries": [
       {
         "id": "LLM01",
@@ -31528,34 +31630,34 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM output encoding before passing to downstream renderers or interpreters"
+        "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions"
       },
       {
-        "id": "LLM07",
-        "name": "Misinformation",
+        "id": "LLM03",
+        "name": "Excessive Agency",
         "source_list": "LLM-Top10-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source"
+        "notes": "Business logic controls preventing tool misuse through prompt manipulation"
       },
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
+        "id": "ASI01",
+        "name": "Agent Goal Hijack",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM responses rendered in browser contexts encoded against XSS"
+        "notes": "Business logic controls prevent injection from redirecting agent goal"
       },
       {
-        "id": "ASI01",
-        "name": "Agent Goal Hijack",
+        "id": "ASI02",
+        "name": "Tool Misuse and Exploitation",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted"
+        "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified"
       },
       {
         "id": "ASI05",
@@ -31564,23 +31666,32 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent code output encoded before rendering in any context"
+        "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis"
       },
       {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
+        "id": "ASI08",
+        "name": "Cascading Agent Failures",
         "source_list": "Agentic-Top10-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content"
+        "notes": "Circuit breakers as business logic controls — cascade propagation limited by design"
+      },
+      {
+        "id": "ASI10",
+        "name": "Rogue Agents",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.2.4",
-    "control_name": "Verify application does not use eval or dynamic code",
+    "control_id": "V3.5.1",
+    "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).",
     "entries": [
       {
         "id": "LLM10",
@@ -31589,116 +31700,132 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "No eval or dynamic code execution of LLM-generated content"
+        "notes": "CSRF protection on endpoints where LLM output triggers state changes"
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V3.6.1",
+    "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
+    "entries": [
+      {
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "System prompts not hardcoded in source code — stored in secret management system"
       },
       {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review"
+        "notes": "Agent credentials not committed to source control"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.2.5",
-    "control_name": "Verify application protects against OS command injection",
+    "control_id": "V5.2.1",
+    "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
     "entries": [
       {
-        "id": "LLM01",
-        "name": "Prompt Injection",
+        "id": "LLM05",
+        "name": "Data and Model Poisoning",
         "source_list": "LLM-Top10-2026",
         "severity": "Critical",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "LLM-generated content validated before execution in any shell or interpreter context"
+        "notes": "Training data uploads scanned before ingestion — adversarial content detected"
       },
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
+        "id": "LLM09",
+        "name": "Vector and Embedding Weaknesses",
         "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
+        "severity": "Medium",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "LLM-generated commands validated — never raw output in shell context"
+        "notes": "Content validation on all vector store ingestion — adversarial content detected"
       },
       {
-        "id": "ASI01",
-        "name": "Agent Goal Hijack",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
         "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent-generated instructions not executed in system context without validation"
+        "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write"
       },
       {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI04",
+        "name": "Data Model and Artifact Poisoning",
+        "source_list": "DSGAI-2026",
         "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent-generated commands validated before any shell execution"
+        "notes": null
+      },
+      {
+        "id": "DSGAI13",
+        "name": "Vector Store Platform Security",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V5.3.5",
-    "control_name": "Verify output encoding in SQL query context",
+    "control_id": "V5.2.4",
+    "control_name": "Malicious file detection on upload",
     "entries": [
       {
-        "id": "LLM10",
-        "name": "Improper Output Handling",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI09",
+        "name": "Multimodal Cross-Channel Leakage",
+        "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context"
-      },
-      {
-        "id": "ASI05",
-        "name": "Unexpected Code Execution",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "No raw agent output in SQL context — parameterised execution only"
+        "notes": null
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V6 Cryptography",
-    "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+    "control_id": "V6.2.1",
+    "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.",
     "entries": [
       {
-        "id": "DSGAI01",
-        "name": "Sensitive Data Leakage",
-        "source_list": "DSGAI-2026",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
+        "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Agent credentials not hardcoded — secret manager required"
       },
       {
-        "id": "DSGAI13",
-        "name": "Vector Store Platform Security",
+        "id": "DSGAI02",
+        "name": "Agent Identity and Credential Exposure",
         "source_list": "DSGAI-2026",
-        "severity": "High",
+        "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
         "notes": null
       },
       {
-        "id": "DSGAI18",
-        "name": "Inference and Data Reconstruction",
+        "id": "DSGAI19",
+        "name": "Human-in-Loop and Labeler Overexposure",
         "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Hardening",
+        "severity": "Medium",
+        "tier": "Foundational",
         "scope": "Both",
         "notes": null
       }
@@ -31706,146 +31833,128 @@ window.CROSSWALK_BACKLINKS = [
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V6.1.1",
-    "control_name": "Verify all sensitive data encrypted at rest",
+    "control_id": "V7.4.1",
+    "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.",
     "entries": [
       {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
+        "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest"
-      },
-      {
-        "id": "LLM09",
-        "name": "Vector and Embedding Weaknesses",
-        "source_list": "LLM-Top10-2026",
-        "severity": "Medium",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "All vector store content encrypted at rest"
+        "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers"
       },
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
+        "id": "DSGAI11",
+        "name": "Cross-Context Conversation Bleed",
+        "source_list": "DSGAI-2026",
+        "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory"
-      },
+        "scope": "Build",
+        "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V8.1.3",
+    "control_name": "Sensitive data not in session storage",
+    "entries": [
       {
-        "id": "ASI06",
-        "name": "Memory and Context Poisoning",
-        "source_list": "Agentic-Top10-2026",
+        "id": "DSGAI11",
+        "name": "Cross-Context Conversation Bleed",
+        "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory"
+        "tier": "Foundational",
+        "scope": "Build",
+        "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7 Logging",
-    "control_name": "V7.2.2 — Log entries contain required information",
+    "control_id": "V8.1.4",
+    "control_name": "Sensitive data minimisation",
     "entries": [
       {
-        "id": "DSGAI03",
-        "name": "Shadow AI and Unsanctioned Data Flows",
+        "id": "DSGAI07",
+        "name": "Data Governance and Lifecycle",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI05",
-        "name": "Data Integrity and Validation Failures",
+        "id": "DSGAI09",
+        "name": "Multimodal Cross-Channel Leakage",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI08",
-        "name": "Non-Compliance and Regulatory Violations",
+        "id": "DSGAI15",
+        "name": "Over-Broad Context Windows",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
+        "scope": "Build",
+        "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "DSGAI14",
-        "name": "Excessive Telemetry and Monitoring Leakage",
+        "id": "DSGAI20",
+        "name": "Model Exfiltration and IP Replication",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "tier": "Hardening",
+        "scope": "Both",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7.2.1",
-    "control_name": "Verify access control decisions logged",
+    "control_id": "V8.2.1",
+    "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
     "entries": [
       {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
+        "id": "LLM02",
+        "name": "Sensitive Information Disclosure",
         "source_list": "LLM-Top10-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All access to system prompts logged — unauthorised access attempts detectable"
+        "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access"
       },
       {
-        "id": "ASI03",
-        "name": "Identity and Privilege Abuse",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM03",
+        "name": "Excessive Agency",
+        "source_list": "LLM-Top10-2026",
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All credential usage logged — issuance, access, expiry detectable"
+        "notes": "LLM tool access enforced at minimum required scope — read-only by default"
       },
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
+        "id": "LLM08",
+        "name": "Hidden Context Exposure",
+        "source_list": "LLM-Top10-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "All A2A messages logged — sender identity, content hash, schema validation results"
+        "notes": "System prompt access restricted to authorised personnel — read access logged"
       },
       {
-        "id": "ASI10",
-        "name": "Rogue Agents",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "All agent actions logged — no production deployment without complete observability"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7.2.2",
-    "control_name": "Verify all business logic decisions logged",
-    "entries": [
-      {
-        "id": "LLM03",
-        "name": "Excessive Agency",
+        "id": "LLM09",
+        "name": "Vector and Embedding Weaknesses",
         "source_list": "LLM-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "Medium",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "All LLM tool invocations logged with full context — every tool call auditable"
+        "notes": "RBAC on all vector store collections — no unauthenticated access"
       },
       {
         "id": "ASI02",
@@ -31854,67 +31963,35 @@ window.CROSSWALK_BACKLINKS = [
         "severity": "Critical",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp"
+        "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved"
       },
       {
-        "id": "ASI10",
-        "name": "Rogue Agents",
+        "id": "ASI03",
+        "name": "Identity and Privilege Abuse",
         "source_list": "Agentic-Top10-2026",
         "severity": "Critical",
-        "tier": "Hardening",
-        "scope": "Both",
-        "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V7.4.1",
-    "control_name": "Verify error handling does not expose sensitive data",
-    "entries": [
-      {
-        "id": "LLM06",
-        "name": "Unbounded Consumption",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses"
-      },
-      {
-        "id": "LLM07",
-        "name": "Misinformation",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality"
+        "notes": "Agent credential scope minimum required — no over-privileged NHIs"
       },
       {
-        "id": "ASI08",
-        "name": "Cascading Agent Failures",
+        "id": "ASI06",
+        "name": "Memory and Context Poisoning",
         "source_list": "Agentic-Top10-2026",
-        "severity": "Critical",
-        "tier": "Foundational",
+        "severity": "High",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Cascade errors handled gracefully — no sensitive system information in error responses"
+        "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write"
       },
       {
-        "id": "ASI09",
-        "name": "Human-Agent Trust Exploitation",
+        "id": "ASI07",
+        "name": "Insecure Inter-Agent Communications",
         "source_list": "Agentic-Top10-2026",
         "severity": "High",
-        "tier": "Foundational",
+        "tier": "Hardening",
         "scope": "Both",
-        "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V8 Data Protection",
-    "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters",
-    "entries": [
+        "notes": "A2A channels enforce sender identity — unauthenticated messages rejected"
+      },
       {
         "id": "DSGAI01",
         "name": "Sensitive Data Leakage",
@@ -31934,8 +32011,8 @@ window.CROSSWALK_BACKLINKS = [
         "notes": null
       },
       {
-        "id": "DSGAI07",
-        "name": "Data Governance and Lifecycle",
+        "id": "DSGAI13",
+        "name": "Vector Store Platform Security",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
@@ -31943,53 +32020,69 @@ window.CROSSWALK_BACKLINKS = [
         "notes": null
       },
       {
-        "id": "DSGAI08",
-        "name": "Non-Compliance and Regulatory Violations",
+        "id": "DSGAI15",
+        "name": "Over-Broad Context Windows",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
+        "scope": "Build",
         "notes": null
       },
       {
-        "id": "DSGAI09",
-        "name": "Multimodal Cross-Channel Leakage",
+        "id": "DSGAI16",
+        "name": "Endpoint and Browser Overreach",
         "source_list": "DSGAI-2026",
         "severity": "High",
-        "tier": "Hardening",
+        "tier": "Foundational",
         "scope": "Both",
         "notes": null
       },
       {
-        "id": "DSGAI10",
-        "name": "Synthetic Data and Anonymization Pitfalls",
+        "id": "DSGAI19",
+        "name": "Human-in-Loop and Labeler Overexposure",
         "source_list": "DSGAI-2026",
         "severity": "Medium",
-        "tier": "Hardening",
-        "scope": "Build",
+        "tier": "Foundational",
+        "scope": "Both",
         "notes": null
+      }
+    ]
+  },
+  {
+    "framework": "OWASP ASVS 4.0.3",
+    "control_id": "V8.3.1",
+    "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
+    "entries": [
+      {
+        "id": "LLM03",
+        "name": "Excessive Agency",
+        "source_list": "LLM-Top10-2026",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Both",
+        "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation"
       },
       {
-        "id": "DSGAI11",
-        "name": "Cross-Context Conversation Bleed",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
+        "id": "ASI02",
+        "name": "Tool Misuse and Exploitation",
+        "source_list": "Agentic-Top10-2026",
+        "severity": "Critical",
         "tier": "Foundational",
-        "scope": "Build",
-        "notes": null
+        "scope": "Both",
+        "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session"
       },
       {
-        "id": "DSGAI14",
-        "name": "Excessive Telemetry and Monitoring Leakage",
+        "id": "DSGAI06",
+        "name": "Tool Plugin and Agent Data Exchange",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
-        "scope": "Build",
+        "scope": "Both",
         "notes": null
       },
       {
-        "id": "DSGAI15",
-        "name": "Over-Broad Context Windows",
+        "id": "DSGAI11",
+        "name": "Cross-Context Conversation Bleed",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
@@ -31997,21 +32090,21 @@ window.CROSSWALK_BACKLINKS = [
         "notes": null
       },
       {
-        "id": "DSGAI18",
-        "name": "Inference and Data Reconstruction",
+        "id": "DSGAI12",
+        "name": "Unsafe Natural Language Data Gateways",
         "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Hardening",
-        "scope": "Both",
+        "severity": "Critical",
+        "tier": "Foundational",
+        "scope": "Build",
         "notes": null
       },
       {
-        "id": "DSGAI19",
-        "name": "Human-in-Loop and Labeler Overexposure",
+        "id": "DSGAI14",
+        "name": "Excessive Telemetry and Monitoring Leakage",
         "source_list": "DSGAI-2026",
-        "severity": "Medium",
+        "severity": "High",
         "tier": "Foundational",
-        "scope": "Both",
+        "scope": "Build",
         "notes": null
       },
       {
@@ -32027,83 +32120,42 @@ window.CROSSWALK_BACKLINKS = [
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V8.1.1",
-    "control_name": "Verify sensitive data is not cached or exposed in logs",
-    "entries": [
-      {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection"
-      },
-      {
-        "id": "LLM08",
-        "name": "Hidden Context Exposure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "System prompts not stored in cleartext application configuration or source code"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V8.3.4",
-    "control_name": "Verify PII is identified and protected",
-    "entries": [
-      {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V9 Communication",
-    "control_name": "V9.1.1 — TLS for all connections",
+    "control_id": "V8.3.10",
+    "control_name": "Personal data not kept longer than needed",
     "entries": [
       {
-        "id": "DSGAI06",
-        "name": "Tool Plugin and Agent Data Exchange",
+        "id": "DSGAI08",
+        "name": "Non-Compliance and Regulatory Violations",
         "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": null
+        "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**"
       }
     ]
   },
   {
     "framework": "OWASP ASVS 4.0.3",
-    "control_id": "V9.1.1",
-    "control_name": "Verify all sensitive data encrypted in transit",
+    "control_id": "V8.3.3",
+    "control_name": "Consent obtained before PI processing",
     "entries": [
       {
-        "id": "LLM02",
-        "name": "Sensitive Information Disclosure",
-        "source_list": "LLM-Top10-2026",
+        "id": "DSGAI08",
+        "name": "Non-Compliance and Regulatory Violations",
+        "source_list": "DSGAI-2026",
         "severity": "High",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       },
       {
-        "id": "ASI07",
-        "name": "Insecure Inter-Agent Communications",
-        "source_list": "Agentic-Top10-2026",
-        "severity": "High",
-        "tier": "Hardening",
+        "id": "DSGAI19",
+        "name": "Human-in-Loop and Labeler Overexposure",
+        "source_list": "DSGAI-2026",
+        "severity": "Medium",
+        "tier": "Foundational",
         "scope": "Both",
-        "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages"
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**"
       }
     ]
   },
diff --git a/docs/data.js b/docs/data.js
index a1b806c..4d1b254 100644
--- a/docs/data.js
+++ b/docs/data.js
@@ -253,41 +253,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.1.1",
-        "control_name": "Verify all user input validated against an allowlist or rejected",
+        "control_id": "V15.3.7",
+        "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All inputs to LLMs validated — indirect injection through processed content equally in scope",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.1.2",
-        "control_name": "Verify that HTTP request parts are validated, sanitised, or rejected",
+        "control_id": "V15.3.3",
+        "control_name": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM API request validation — prompt structure, content type, and character set enforced",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.1",
-        "control_name": "Verify output encoding prevents injection attacks",
+        "control_id": "V1.3.1",
+        "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM output encoding before passing to downstream renderers or interpreters",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.5",
-        "control_name": "Verify application protects against OS command injection",
+        "control_id": "V1.3.7",
+        "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM-generated content validated before execution in any shell or interpreter context",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -297,17 +301,19 @@ window.CROSSWALK_DATA = [
         "control_name": "Threat modelling of all data flows",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "LLM data flows threat-modelled — all injection paths identified and documented",
+        "notes": "LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic limits prevent abuse of LLM functions",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Business logic controls preventing prompt injection from triggering unauthorised actions",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -1725,51 +1731,56 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8.1.1",
-        "control_name": "Verify sensitive data is not cached or exposed in logs",
+        "control_id": "V14.2.2",
+        "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM outputs containing sensitive data not logged in cleartext or cached without protection",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8.3.4",
-        "control_name": "Verify PII is identified and protected",
+        "control_id": "V14.1.1",
+        "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "PII in LLM training data, RAG sources, and outputs identified and handled per policy",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control decisions enforce least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "RAG retrieval access controls — users retrieve only data they are authorised to access",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6.1.1",
-        "control_name": "Verify all sensitive data encrypted at rest",
+        "control_id": "V14.1.1",
+        "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Training data, embeddings, RAG document stores, and prompt caches encrypted at rest",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V9.1.1",
-        "control_name": "Verify all sensitive data encrypted in transit",
+        "control_id": "V12.2.1",
+        "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -2901,41 +2912,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control enforces least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM tool access enforced at minimum required scope — read-only by default",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.1",
-        "control_name": "Verify all sensitive functions have access control",
+        "control_id": "V8.3.1",
+        "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.2",
-        "control_name": "Verify all business logic decisions logged",
+        "control_id": "V16.3.2",
+        "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All LLM tool invocations logged with full context — every tool call auditable",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic abuse scenarios identified",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Business logic controls preventing tool misuse through prompt manipulation",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -4175,7 +4190,8 @@ window.CROSSWALK_DATA = [
         "control_name": "Verify third-party components are current and free from vulnerabilities",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained",
+        "notes": "All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -4185,17 +4201,19 @@ window.CROSSWALK_DATA = [
         "control_name": "Verify only minimal approved external libraries are used",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected",
+        "notes": "Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V14.2.2",
-        "control_name": "Verify build pipelines include security checks",
+        "control_id": "V13.4.5",
+        "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -5378,11 +5396,12 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.1.1",
-        "control_name": "Verify all inputs validated against allowlist",
+        "control_id": "V15.3.7",
+        "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Training data pipeline input validation — anomalous data rejected before training",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -5392,17 +5411,19 @@ window.CROSSWALK_DATA = [
         "control_name": "Verify third-party components free of vulnerabilities",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Training pipeline components scanned — compromised dependencies rejected",
+        "notes": "Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V12.1.1",
-        "control_name": "Verify file uploads scanned for malware",
+        "control_id": "V5.2.1",
+        "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Training data uploads scanned before ingestion — adversarial content detected",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -6522,41 +6543,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13.1.1",
+        "control_id": "V1.5.3",
         "control_name": "Verify API rate limiting",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Rate limiting on all LLM API endpoints — per user, per session, per API key",
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13.1.3",
-        "control_name": "Verify API rejects large unexpected payloads",
+        "control_id": "V14.2.1",
+        "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Token limits on LLM API inputs — requests exceeding limits rejected at the gateway",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.4",
-        "control_name": "Verify business logic rate limits",
+        "control_id": "V2.4.1",
+        "control_name": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.4.1",
-        "control_name": "Verify error handling does not expose sensitive data",
+        "control_id": "V16.5.1",
+        "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM resource exhaustion errors handled gracefully — no sensitive information in error responses",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -7595,31 +7620,34 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.1",
-        "control_name": "Verify business logic assumptions documented",
+        "control_id": "V2.3.1",
+        "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM accuracy limitations documented as business logic assumptions — verification requirements defined",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.4.1",
-        "control_name": "Verify all security controls logged",
+        "control_id": "V16.5.1",
+        "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM accuracy metrics and hallucination rate logged — production monitoring for output quality",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.1",
-        "control_name": "Verify outputs encoded before rendering",
+        "control_id": "V1.3.1",
+        "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -8776,41 +8804,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8.1.1",
-        "control_name": "Verify sensitive data not cached in cleartext",
+        "control_id": "V14.2.2",
+        "control_name": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "System prompts not stored in cleartext application configuration or source code",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control enforces least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "System prompt access restricted to authorised personnel — read access logged",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.1",
-        "control_name": "Verify access control decisions logged",
+        "control_id": "V16.3.1",
+        "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All access to system prompts logged — unauthorised access attempts detectable",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V14.2.3",
-        "control_name": "Verify secrets not in source code",
+        "control_id": "V3.6.1",
+        "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "System prompts not hardcoded in source code — stored in secret management system",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -9837,31 +9869,34 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify least privilege access control on data",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "RBAC on all vector store collections — no unauthenticated access",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6.1.1",
-        "control_name": "Verify all sensitive data encrypted at rest",
+        "control_id": "V14.1.1",
+        "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "All vector store content encrypted at rest",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V12.1.1",
-        "control_name": "Verify file upload malware scanning",
+        "control_id": "V5.2.1",
+        "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Content validation on all vector store ingestion — adversarial content detected",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -10912,51 +10947,56 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.1",
-        "control_name": "Verify output encoding of untrusted data in HTML context",
+        "control_id": "V1.3.1",
+        "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM responses rendered in browser contexts encoded against XSS",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.3.5",
-        "control_name": "Verify output encoding in SQL query context",
+        "control_id": "V1.2.4",
+        "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM-generated SQL parameterised — never raw LLM output in SQL context",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.5",
-        "control_name": "Verify output encoding in OS command context",
+        "control_id": "V1.3.7",
+        "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "LLM-generated commands validated — never raw output in shell context",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.4",
-        "control_name": "Verify application does not use eval or dynamic code",
+        "control_id": "V1.3.2",
+        "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "No eval or dynamic code execution of LLM-generated content",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.2.2",
-        "control_name": "Verify anti-CSRF tokens in state-changing operations",
+        "control_id": "V3.5.1",
+        "control_name": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "CSRF protection on endpoints where LLM output triggers state changes",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -13148,31 +13188,34 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.1.1",
-        "control_name": "Verify all user input validated against allowlist",
+        "control_id": "V15.3.7",
+        "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All inputs to agents validated — indirect injection through processed content equally in scope",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.1",
-        "control_name": "Verify output encoding prevents injection",
+        "control_id": "V1.3.1",
+        "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.5",
-        "control_name": "Verify application protects against OS command injection",
+        "control_id": "V1.3.7",
+        "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent-generated instructions not executed in system context without validation",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -13182,17 +13225,19 @@ window.CROSSWALK_DATA = [
         "control_name": "Threat modelling of all data flows",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All agent input sources threat-modelled — every indirect injection path documented",
+        "notes": "All agent input sources threat-modelled — every indirect injection path documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic limits prevent function abuse",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Business logic controls prevent injection from redirecting agent goal",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -14506,51 +14551,56 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control enforces least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.1",
-        "control_name": "Verify all sensitive functions have access control",
+        "control_id": "V8.3.1",
+        "control_name": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All destructive tool operations require explicit authorisation — not inheritable from agent session",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.2",
-        "control_name": "Verify all business logic decisions logged",
+        "control_id": "V16.3.2",
+        "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All tool invocations logged — tool identity, parameters, agent session, timestamp",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic abuse scenarios identified",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13.1.1",
+        "control_id": "V1.5.3",
         "control_name": "Verify API rate limiting",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Tool API endpoints rate-limited — anomalous invocation frequency detected",
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -15786,51 +15836,56 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V2.1.1",
-        "control_name": "Verify credentials not in source code",
+        "control_id": "V6.2.1",
+        "control_name": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent credentials not hardcoded — secret manager required",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control enforces least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent credential scope minimum required — no over-privileged NHIs",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6.1.1",
-        "control_name": "Verify sensitive data encrypted at rest",
+        "control_id": "V14.1.1",
+        "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent credentials encrypted at rest — no cleartext in config or agent memory",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.1",
-        "control_name": "Verify access control decisions logged",
+        "control_id": "V16.3.1",
+        "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "All credential usage logged — issuance, access, expiry detectable",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V14.2.3",
-        "control_name": "Verify secrets not in source code",
+        "control_id": "V3.6.1",
+        "control_name": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent credentials not committed to source control",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -17145,7 +17200,8 @@ window.CROSSWALK_DATA = [
         "control_name": "Verify third-party components current and free of vulnerabilities",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored",
+        "notes": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -17155,17 +17211,19 @@ window.CROSSWALK_DATA = [
         "control_name": "Verify only minimal approved external libraries",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Approved component list — unsigned or unverified agent components rejected",
+        "notes": "Approved component list — unsigned or unverified agent components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V14.2.2",
-        "control_name": "Verify build pipelines include security checks",
+        "control_id": "V13.4.5",
+        "control_name": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "CI/CD pipeline for agent components includes integrity verification and CVE scanning",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -17175,7 +17233,8 @@ window.CROSSWALK_DATA = [
         "control_name": "Verify threat model covers all data flows",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Supply chain threat model documents all agent component sources and trust levels",
+        "notes": "Supply chain threat model documents all agent component sources and trust levels — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -18328,51 +18387,56 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.1",
-        "control_name": "Verify output encoding of untrusted data in HTML context",
+        "control_id": "V1.3.1",
+        "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Agent code output encoded before rendering in any context",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.4",
-        "control_name": "Verify application does not use eval or dynamic code",
+        "control_id": "V1.3.2",
+        "control_name": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.5",
-        "control_name": "Verify output encoding in OS command context",
+        "control_id": "V1.3.7",
+        "control_name": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Agent-generated commands validated before any shell execution",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.3.5",
-        "control_name": "Verify output encoding in SQL context",
+        "control_id": "V1.2.4",
+        "control_name": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "No raw agent output in SQL context — parameterised execution only",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic limits",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -19526,41 +19590,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.1.1",
-        "control_name": "Verify all user input validated against allowlist",
+        "control_id": "V15.3.7",
+        "control_name": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "All content entering agent memory validated — injection patterns rejected at write boundary",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control enforces least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Memory write access restricted to minimum required sources — only agent and authorised administrators can write",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6.1.1",
-        "control_name": "Verify sensitive data encrypted at rest",
+        "control_id": "V14.1.1",
+        "control_name": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Agent memory stores encrypted at rest — embeddings, long-term memory",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V12.1.1",
-        "control_name": "Verify file upload malware scanning",
+        "control_id": "V5.2.1",
+        "control_name": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Content entering agent memory scanned — adversarial content, injection patterns detected before write",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -20703,41 +20771,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V9.1.1",
-        "control_name": "Verify TLS used for all client connectivity",
+        "control_id": "V12.2.1",
+        "control_name": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V3.3.1",
-        "control_name": "Verify anti-replay tokens in state-changing operations",
+        "control_id": "V7.4.1",
+        "control_name": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4.1.3",
-        "control_name": "Verify access control enforces identity",
+        "control_id": "V8.2.1",
+        "control_name": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "A2A channels enforce sender identity — unauthenticated messages rejected",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.1",
-        "control_name": "Verify all security controls logged",
+        "control_id": "V16.3.1",
+        "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "All A2A messages logged — sender identity, content hash, schema validation results",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -21834,41 +21906,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.1",
-        "control_name": "Verify business logic assumptions documented",
+        "control_id": "V2.3.1",
+        "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic limits prevent abuse",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Circuit breakers as business logic controls — cascade propagation limited by design",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13.1.1",
+        "control_id": "V1.5.3",
         "control_name": "Verify API rate limiting",
         "tier": "Foundational",
         "scope": "Both",
-        "notes": "Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited",
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.4.1",
-        "control_name": "Verify error handling does not expose sensitive data",
+        "control_id": "V16.5.1",
+        "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Cascade errors handled gracefully — no sensitive system information in error responses",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -22964,41 +23040,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.1",
-        "control_name": "Verify business logic assumptions documented",
+        "control_id": "V2.3.1",
+        "control_name": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "AI advisory limitations documented as business logic assumptions — verification requirements per domain",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5.2.1",
-        "control_name": "Verify outputs encoded before rendering",
+        "control_id": "V1.3.1",
+        "control_name": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.4.1",
-        "control_name": "Verify all security controls logged",
+        "control_id": "V16.5.1",
+        "control_name": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Agent-influenced operator decisions logged — aggregate patterns detectable",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13.1.3",
-        "control_name": "Verify API rejects large unexpected payloads",
+        "control_id": "V14.2.1",
+        "control_name": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
         "tier": "Foundational",
         "scope": "Both",
         "notes": "Approval flows independent of agent interface — no state-changing approvals via agent chat",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -24123,41 +24203,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.1",
-        "control_name": "Verify access control decisions logged",
+        "control_id": "V16.3.1",
+        "control_name": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "All agent actions logged — no production deployment without complete observability",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7.2.2",
-        "control_name": "Verify all business logic decisions logged",
+        "control_id": "V16.3.2",
+        "control_name": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11.1.2",
-        "control_name": "Verify business logic limits prevent abuse",
+        "control_id": "V2.4.2",
+        "control_name": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
         "tier": "Hardening",
         "scope": "Both",
         "notes": "Scope constraints as business logic controls — rogue agent cannot exceed permission envelope",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13.1.1",
+        "control_id": "V1.5.3",
         "control_name": "Verify API rate limiting",
         "tier": "Hardening",
         "scope": "Both",
-        "notes": "Rate limiting prevents rogue agent from amplifying impact through API exhaustion",
+        "notes": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusio",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -25352,46 +25436,56 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.1 — Sensitive data not transmitted in URL parameters",
+        "control_id": "V14.2.2",
+        "control_name": "Sensitive data not transmitted in URL parameters",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.4 — Sensitive data identified and classified",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data identified and classified",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.3 — Deny by default access control",
+        "control_id": "V8.2.1",
+        "control_name": "Deny by default access control",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.2.8 — Output encoding for context",
+        "control_id": "V1.3.5",
+        "control_name": "Output encoding for context",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6 Cryptography",
-        "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data not stored in cleartext",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V6",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -26554,37 +26648,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V2 Authentication",
-        "control_name": "V2.1.1 — Passwords minimum 12 characters",
+        "control_id": "V6.2.1",
+        "control_name": "Passwords minimum 12 characters",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V2",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V2 Authentication",
-        "control_name": "V2.10.1 — Integration secrets not hardcoded",
+        "control_id": "V13.2.1",
+        "control_name": "Integration secrets not hardcoded",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V2",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.2 — Least privilege for service accounts",
+        "control_id": "V8.2.1",
+        "control_name": "Least privilege for service accounts",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.7 — Data transferred using current TLS",
+        "control_id": "V14.1.2",
+        "control_name": "Data transferred using current TLS",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -27620,37 +27722,47 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V1 Architecture",
-        "control_name": "V1.1.4 — Trust boundaries documented and enforced",
+        "control_id": "V1.1.4",
+        "control_name": "Trust boundaries documented and enforced",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V1",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.5 — Access control failures logged",
+        "control_id": "V16.5.3",
+        "control_name": "Access control failures logged",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7 Logging",
-        "control_name": "V7.2.2 — Log entries contain required information",
+        "control_id": "V16.3.2",
+        "control_name": "Log entries contain required information",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V7",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V14 Configuration",
-        "control_name": "V14.1.4 — All components inventoried",
+        "control_id": "V14.1.4",
+        "control_name": "All components inventoried",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V14",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -28599,37 +28711,47 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.1.3 — Input validation server-side",
+        "control_id": "V2.2.1",
+        "control_name": "Input validation server-side",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V10 Malicious Code",
-        "control_name": "V10.2.1 — Application only uses official repositories",
+        "control_id": "V10.2.1",
+        "control_name": "Application only uses official repositories",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V10",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V10 Malicious Code",
-        "control_name": "V10.2.2 — Dependency managers check for vulnerabilities",
+        "control_id": "V10.2.2",
+        "control_name": "Dependency managers check for vulnerabilities",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V10",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V12 Files/Resources",
-        "control_name": "V12.1.1 — File upload size limits",
+        "control_id": "V5.2.1",
+        "control_name": "File upload size limits",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V12",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -29682,28 +29804,34 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.1.1 — Input validation using allowlists",
+        "control_id": "V15.3.7",
+        "control_name": "Input validation using allowlists",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.2.1 — HTML/JS output sanitised",
+        "control_id": "V1.3.1",
+        "control_name": "HTML/JS output sanitised",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7 Logging",
-        "control_name": "V7.4.1 — Generic error messages",
+        "control_id": "V16.5.1",
+        "control_name": "Generic error messages",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V7",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -30734,28 +30862,34 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.1 — Access control on every request",
+        "control_id": "V8.3.1",
+        "control_name": "Access control on every request",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V9 Communication",
-        "control_name": "V9.1.1 — TLS for all connections",
+        "control_id": "V12.2.1",
+        "control_name": "TLS for all connections",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V9",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11 Business Logic",
-        "control_name": "V11.1.4 — Business logic limits on repeated actions",
+        "control_id": "V2.4.1",
+        "control_name": "Business logic limits on repeated actions",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V11",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -31722,28 +31856,35 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.4 — Sensitive data minimisation",
+        "control_id": "V8.1.4",
+        "control_name": "Sensitive data minimisation",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.4 — Sensitive data identified and classified",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data identified and classified",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.5 — Attribute-based access control",
+        "control_id": "V16.5.3",
+        "control_name": "Attribute-based access control",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -32694,28 +32835,36 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.3 — Consent obtained before PI processing",
+        "control_id": "V8.3.3",
+        "control_name": "Consent obtained before PI processing",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.10 — Personal data not kept longer than needed",
+        "control_id": "V8.3.10",
+        "control_name": "Personal data not kept longer than needed",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7 Logging",
-        "control_name": "V7.2.2 — Audit trail sufficient for compliance",
+        "control_id": "V16.3.2",
+        "control_name": "Audit trail sufficient for compliance",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V7",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -33773,28 +33922,35 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.2.5 — Unstructured data sanitised",
+        "control_id": "V1.3.7",
+        "control_name": "Unstructured data sanitised",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.4 — Sensitive data minimised",
+        "control_id": "V8.1.4",
+        "control_name": "Sensitive data minimised",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V8",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V12 Files/Resources",
-        "control_name": "V12.1.3 — Malicious file detection on upload",
+        "control_id": "V5.2.4",
+        "control_name": "Malicious file detection on upload",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V12",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -34738,19 +34894,23 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.4 — Sensitive data classified",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data classified",
         "tier": "Hardening",
         "scope": "Build",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.2.6 — Defined output structure",
+        "control_id": "V1.3.6",
+        "control_name": "Defined output structure",
         "tier": "Hardening",
         "scope": "Build",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -35657,37 +35817,46 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V3 Session Management",
-        "control_name": "V3.1.1 — Session tokens unique and random",
+        "control_id": "V14.2.1",
+        "control_name": "Session tokens unique and random",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V3",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V3 Session Management",
-        "control_name": "V3.3.1 — Sessions invalidated after logout",
+        "control_id": "V7.4.1",
+        "control_name": "Sessions invalidated after logout",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V3",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.1 — Access control enforced on every request",
+        "control_id": "V8.3.1",
+        "control_name": "Access control enforced on every request",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.3 — Sensitive data not in session storage",
+        "control_id": "V8.1.3",
+        "control_name": "Sensitive data not in session storage",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V8",
+        "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -36632,37 +36801,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.1.1 — Allowlist input validation",
+        "control_id": "V15.3.7",
+        "control_name": "Allowlist input validation",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.3.4 — SQL injection prevention",
+        "control_id": "V1.2.4",
+        "control_name": "SQL injection prevention",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.1 — Access control on every request",
+        "control_id": "V8.3.1",
+        "control_name": "Access control on every request",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13 API",
-        "control_name": "V13.1.1 — API protection against enumeration",
+        "control_id": "V1.5.3",
+        "control_name": "API protection against enumeration",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V13",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -37629,28 +37806,34 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.3 — Deny by default",
+        "control_id": "V8.2.1",
+        "control_name": "Deny by default",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6 Cryptography",
-        "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data not stored in cleartext",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V6",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V12 Files/Resources",
-        "control_name": "V12.1.1 — File upload validation",
+        "control_id": "V5.2.1",
+        "control_name": "File upload validation",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V12",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -38642,37 +38825,45 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7 Logging",
-        "control_name": "V7.1.1 — No credential logging",
+        "control_id": "V16.2.5",
+        "control_name": "No credential logging",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V7",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V7 Logging",
-        "control_name": "V7.1.2 — No sensitive data in logs",
+        "control_id": "V16.2.5",
+        "control_name": "No sensitive data in logs",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V7",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.1 — Sensitive data not in URLs",
+        "control_id": "V14.2.2",
+        "control_name": "Sensitive data not in URLs",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.1 — Access control on log stores",
+        "control_id": "V8.3.1",
+        "control_name": "Access control on log stores",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -39658,28 +39849,35 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.3 — Deny by default access control",
+        "control_id": "V8.2.1",
+        "control_name": "Deny by default access control",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.4 — Data minimisation",
+        "control_id": "V8.1.4",
+        "control_name": "Data minimisation",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V8",
+        "notes": "Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V3 Session Management",
-        "control_name": "V3.1.1 — Session isolation",
+        "control_id": "V14.2.1",
+        "control_name": "Session isolation",
         "tier": "Foundational",
         "scope": "Build",
+        "parent": "V3",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -40620,28 +40818,35 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.2 — Least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Least privilege",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11 Business Logic",
-        "control_name": "V11.1.5 — Business logic prevents excess data access",
+        "control_id": "V2.2.1",
+        "control_name": "Business logic prevents excess data access",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V11",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V1 Architecture",
-        "control_name": "V1.1.2 — Secure architecture and design",
+        "control_id": "V1.1.2",
+        "control_name": "Secure architecture and design",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V1",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -41626,19 +41831,25 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11 Business Logic",
-        "control_name": "V11.1.7 — Anti-automation controls",
+        "control_id": "V11.1.7",
+        "control_name": "Anti-automation controls",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V11",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V13 API",
-        "control_name": "V13.1.2 — API throttling",
+        "control_id": "V13.1.2",
+        "control_name": "API throttling",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V13",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -42652,19 +42863,23 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.4 — Sensitive data identified",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data identified",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V8",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V6 Cryptography",
-        "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+        "control_id": "V14.1.1",
+        "control_name": "Sensitive data not stored in cleartext",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V6",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -43553,28 +43768,35 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.2 — Least privilege",
+        "control_id": "V8.2.1",
+        "control_name": "Least privilege",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.3.3 — Consent for personal data processing",
+        "control_id": "V8.3.3",
+        "control_name": "Consent for personal data processing",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V8",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V2 Authentication",
-        "control_name": "V2.1.1 — Strong authentication",
+        "control_id": "V6.2.1",
+        "control_name": "Strong authentication",
         "tier": "Foundational",
         "scope": "Both",
+        "parent": "V2",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -44510,28 +44732,36 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V4 Access Control",
-        "control_name": "V4.1.1 — Access control per request",
+        "control_id": "V8.3.1",
+        "control_name": "Access control per request",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V4",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V8 Data Protection",
-        "control_name": "V8.1.4 — Data minimisation in responses",
+        "control_id": "V8.1.4",
+        "control_name": "Data minimisation in responses",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V8",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V10 Malicious Code",
-        "control_name": "V10.2.2 — Component integrity checking",
+        "control_id": "V10.2.2",
+        "control_name": "Component integrity checking",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V10",
+        "notes": "Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)**",
+        "framework_version": "ASVS 4.0.3",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
@@ -45511,19 +45741,23 @@ window.CROSSWALK_DATA = [
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V5 Validation",
-        "control_name": "V5.1.3 — Server-side input validation",
+        "control_id": "V2.2.1",
+        "control_name": "Server-side input validation",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V5",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
       {
         "framework": "OWASP ASVS 4.0.3",
-        "control_id": "V11 Business Logic",
-        "control_name": "V11.1.4 — Enforce business logic limits",
+        "control_id": "V2.4.1",
+        "control_name": "Enforce business logic limits",
         "tier": "Hardening",
         "scope": "Both",
+        "parent": "V11",
+        "framework_version": "ASVS 5.0.0",
         "confidence": "unreviewed",
         "reviewed_by": []
       },
diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js
index cfc0ecd..bd6dfd4 100644
--- a/docs/frameworks-registry.js
+++ b/docs/frameworks-registry.js
@@ -622,6 +622,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 70 items -> 68, including 14 referenced by mappings but absent from the registry",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 68 items -> 68",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ],
     "inventory_completeness": {
@@ -1315,6 +1320,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 76 items -> 61",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 61 items -> 61",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ]
   },
@@ -2333,6 +2343,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 145 items -> 30",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 30 items -> 30",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ],
     "inventory_completeness": {
@@ -3745,6 +3760,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 87 items -> 56",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 56 items -> 56",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ],
     "inventory_completeness": {
@@ -5639,6 +5659,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 52 items -> 12",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 12 items -> 12",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ]
   },
@@ -5849,6 +5874,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 59 items -> 26",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 26 items -> 26",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ]
   },
@@ -5940,6 +5970,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 58 items -> 9",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 9 items -> 9",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ]
   },
@@ -7699,512 +7734,647 @@ window.CROSSWALK_FRAMEWORKS = [
     "id": "owasp-asvs",
     "name": "OWASP ASVS 4.0.3",
     "short_name": "ASVS",
-    "version": "4.0.3",
+    "version": "5.0.0",
     "url": "https://owasp.org/projects/asvs",
     "license": "CC BY-SA 4.0",
     "publisher": "OWASP",
     "category": "appsec",
-    "last_synced": "2026-04-10",
+    "last_synced": "2026-09-18",
     "source_sha": null,
     "controls": [
       {
         "control_id": "V1",
-        "title": "Architecture, Design and Threat Modeling",
-        "description": "Ensure a verified application satisfies high-level security architecture requirements.",
+        "title": "Encoding and Sanitization",
+        "description": "",
         "parent": null,
-        "function": "Architecture",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V1.1",
-        "title": "Secure Software Development Lifecycle",
-        "description": "Ensure the use of a secure software development lifecycle that addresses security in all stages.",
-        "parent": "V1",
-        "function": "Architecture",
-        "kind": "control"
+        "control_id": "V1.1.2",
+        "title": "Threat modelling of all data flows",
+        "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented",
+        "parent": null,
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
       },
       {
-        "control_id": "V1.2",
-        "title": "Authentication Architecture",
-        "description": "Verify that authentication is addressed in the architecture.",
+        "control_id": "V1.1.4",
+        "title": "Trust boundaries documented and enforced",
+        "description": "",
         "parent": "V1",
-        "function": "Architecture",
-        "kind": "control"
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
       },
       {
-        "control_id": "V1.4",
-        "title": "Access Control Architecture",
-        "description": "Verify that access controls are applied consistently.",
+        "control_id": "V1.2",
+        "title": "Injection Prevention",
+        "description": "",
         "parent": "V1",
-        "function": "Architecture",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V1.5",
-        "title": "Input and Output Architecture",
-        "description": "Verify that input and output requirements define handling of data based on type and content.",
-        "parent": "V1",
-        "function": "Architecture",
+        "control_id": "V1.2.4",
+        "title": "Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures.",
+        "description": "",
+        "parent": "V1.2",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V2",
-        "title": "Authentication",
-        "description": "Verify that the application uses appropriate authentication mechanisms.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V1.3",
+        "title": "Sanitization",
+        "description": "",
+        "parent": "V1",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V2.1",
-        "title": "Password Security",
-        "description": "Verify password requirements align with modern standards.",
-        "parent": "V2",
-        "function": "Verification",
+        "control_id": "V1.3.1",
+        "title": "Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature.",
+        "description": "",
+        "parent": "V1.3",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V2.5",
-        "title": "Credential Recovery",
-        "description": "Verify credential recovery mechanisms are secure.",
-        "parent": "V2",
-        "function": "Verification",
+        "control_id": "V1.3.2",
+        "title": "Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed.",
+        "description": "",
+        "parent": "V1.3",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V2.8",
-        "title": "One Time Verifier",
-        "description": "Verify one-time passwords and verifiers are secure.",
-        "parent": "V2",
-        "function": "Verification",
+        "control_id": "V1.3.5",
+        "title": "Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar.",
+        "description": "",
+        "parent": "V1.3",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V3",
-        "title": "Session Management",
-        "description": "Verify the application has adequate session management controls.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V1.3.6",
+        "title": "Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service.",
+        "description": "",
+        "parent": "V1.3",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V4",
-        "title": "Access Control",
-        "description": "Verify that users can only access functions and data for which they possess specific authorization.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V1.3.7",
+        "title": "Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated.",
+        "description": "",
+        "parent": "V1.3",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V4.1",
-        "title": "General Access Control Design",
-        "description": "Verify access control is applied server-side and consistently.",
-        "parent": "V4",
-        "function": "Verification",
+        "control_id": "V1.5",
+        "title": "Safe Deserialization",
+        "description": "",
+        "parent": "V1",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V4.2",
-        "title": "Operation Level Access Control",
-        "description": "Verify access controls at the operation and function level.",
-        "parent": "V4",
-        "function": "Verification",
+        "control_id": "V1.5.3",
+        "title": "Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks.",
+        "description": "",
+        "parent": "V1.5",
+        "function": "Encoding and Sanitization",
         "kind": "control"
       },
       {
-        "control_id": "V5",
-        "title": "Validation, Sanitization and Encoding",
-        "description": "Verify that the application sanitizes, validates, and encodes untrusted input.",
+        "control_id": "V2",
+        "title": "Validation and Business Logic",
+        "description": "",
         "parent": null,
-        "function": "Verification",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V5.1",
+        "control_id": "V2.2",
         "title": "Input Validation",
-        "description": "Verify input validation controls are in place.",
-        "parent": "V5",
-        "function": "Verification",
-        "kind": "control"
-      },
-      {
-        "control_id": "V5.2",
-        "title": "Sanitization and Sandboxing",
-        "description": "Verify that sanitization and sandboxing are used to prevent injection.",
-        "parent": "V5",
-        "function": "Verification",
+        "description": "",
+        "parent": "V2",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V5.3",
-        "title": "Output Encoding and Injection Prevention",
-        "description": "Verify that output encoding prevents injection attacks.",
-        "parent": "V5",
-        "function": "Verification",
+        "control_id": "V2.2.1",
+        "title": "Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.",
+        "description": "",
+        "parent": "V2.2",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V5.5",
-        "title": "Deserialization Prevention",
-        "description": "Verify that deserialization is done safely.",
-        "parent": "V5",
-        "function": "Verification",
+        "control_id": "V2.3",
+        "title": "Business Logic Security",
+        "description": "",
+        "parent": "V2",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V6",
-        "title": "Stored Cryptography",
-        "description": "Verify that cryptographic modules and algorithms are used correctly.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V2.3.1",
+        "title": "Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps.",
+        "description": "",
+        "parent": "V2.3",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V7",
-        "title": "Error Handling and Logging",
-        "description": "Verify that errors are handled safely and logs contain sufficient information.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V2.4",
+        "title": "Anti-automation",
+        "description": "",
+        "parent": "V2",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V7.1",
-        "title": "Log Content",
-        "description": "Verify that security-relevant events are logged.",
-        "parent": "V7",
-        "function": "Verification",
+        "control_id": "V2.4.1",
+        "title": "Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources.",
+        "description": "",
+        "parent": "V2.4",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V7.2",
-        "title": "Log Processing",
-        "description": "Verify that logs are processed securely.",
-        "parent": "V7",
-        "function": "Verification",
+        "control_id": "V2.4.2",
+        "title": "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions.",
+        "description": "",
+        "parent": "V2.4",
+        "function": "Validation and Business Logic",
         "kind": "control"
       },
       {
-        "control_id": "V8",
-        "title": "Data Protection",
-        "description": "Verify that data is protected in transit and at rest.",
+        "control_id": "V3",
+        "title": "Web Frontend Security",
+        "description": "",
         "parent": null,
-        "function": "Verification",
+        "function": "Web Frontend Security",
         "kind": "control"
       },
       {
-        "control_id": "V8.1",
-        "title": "General Data Protection",
-        "description": "Verify sensitive data is identified and protected.",
-        "parent": "V8",
-        "function": "Verification",
+        "control_id": "V3.5",
+        "title": "Browser Origin Separation",
+        "description": "",
+        "parent": "V3",
+        "function": "Web Frontend Security",
         "kind": "control"
       },
       {
-        "control_id": "V8.3",
-        "title": "Sensitive Private Data",
-        "description": "Verify that sensitive data is protected from unauthorized access.",
-        "parent": "V8",
-        "function": "Verification",
+        "control_id": "V3.5.1",
+        "title": "Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).",
+        "description": "",
+        "parent": "V3.5",
+        "function": "Web Frontend Security",
         "kind": "control"
       },
       {
-        "control_id": "V9",
-        "title": "Communication",
-        "description": "Verify that communications are encrypted using TLS.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V3.6",
+        "title": "External Resource Integrity",
+        "description": "",
+        "parent": "V3",
+        "function": "Web Frontend Security",
         "kind": "control"
       },
       {
-        "control_id": "V10",
-        "title": "Malicious Code",
-        "description": "Verify that code does not contain malicious logic.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V3.6.1",
+        "title": "Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.",
+        "description": "",
+        "parent": "V3.6",
+        "function": "Web Frontend Security",
         "kind": "control"
       },
       {
-        "control_id": "V11",
-        "title": "Business Logic",
-        "description": "Verify that business logic flows are sequential and audited.",
+        "control_id": "V5",
+        "title": "File Handling",
+        "description": "",
         "parent": null,
-        "function": "Verification",
+        "function": "File Handling",
         "kind": "control"
       },
       {
-        "control_id": "V12",
-        "title": "Files and Resources",
-        "description": "Verify that untrusted files and resources are handled safely.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V5.2",
+        "title": "File Upload and Content",
+        "description": "",
+        "parent": "V5",
+        "function": "File Handling",
         "kind": "control"
       },
       {
-        "control_id": "V13",
-        "title": "API and Web Service",
-        "description": "Verify that API and web service requests are validated.",
-        "parent": null,
-        "function": "Verification",
+        "control_id": "V5.2.1",
+        "title": "Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack.",
+        "description": "",
+        "parent": "V5.2",
+        "function": "File Handling",
         "kind": "control"
       },
       {
-        "control_id": "V13.1",
-        "title": "Generic Web Service Security",
-        "description": "Verify that all API and web service interactions are authenticated and authorized.",
-        "parent": "V13",
-        "function": "Verification",
+        "control_id": "V5.2.4",
+        "title": "Verify that a file size quota and maximum number of files per user are enforced to ensure that a single user cannot fill up the storage with too many files, or excessively large files.",
+        "description": "",
+        "parent": "V5.2",
+        "function": "File Handling",
         "kind": "control"
       },
       {
-        "control_id": "V14",
-        "title": "Configuration",
-        "description": "Verify that the application is securely configured.",
+        "control_id": "V6",
+        "title": "Authentication",
+        "description": "",
         "parent": null,
-        "function": "Verification",
+        "function": "Authentication",
         "kind": "control"
       },
       {
-        "control_id": "V5.1.1",
-        "title": "Verify all user input validated against allowlist",
-        "description": "All inputs to agents validated — indirect injection through processed content equally in scope; All content entering agent memory validated — injection patterns rejected at write boundary; All inputs to LLMs validated — indirect injection through processed content equally in scope",
+        "control_id": "V6.2",
+        "title": "Password Security",
+        "description": "",
+        "parent": "V6",
+        "function": "Authentication",
         "kind": "control"
       },
       {
-        "control_id": "V5.2.1",
-        "title": "Verify output encoding prevents injection",
-        "description": "Agent responses encoded before passing to downstream renderers — outputs treated as untrusted; Agent code output encoded before rendering in any context; Agent advisory outputs clearly labelled — users cannot mistake AI output for authoritative content",
+        "control_id": "V6.2.1",
+        "title": "Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.",
+        "description": "",
+        "parent": "V6.2",
+        "function": "Authentication",
         "kind": "control"
       },
       {
-        "control_id": "V5.2.5",
-        "title": "Verify application protects against OS command injection",
-        "description": "Agent-generated instructions not executed in system context without validation; Agent-generated commands validated before any shell execution; LLM-generated content validated before execution in any shell or interpreter context",
+        "control_id": "V7",
+        "title": "Session Management",
+        "description": "",
+        "parent": null,
+        "function": "Session Management",
         "kind": "control"
       },
       {
-        "control_id": "V1.1.2",
-        "title": "Threat modelling of all data flows",
-        "description": "All agent input sources threat-modelled — every indirect injection path documented; Supply chain threat model documents all agent component sources and trust levels; LLM data flows threat-modelled — all injection paths identified and documented",
+        "control_id": "V7.4",
+        "title": "Session Termination",
+        "description": "",
+        "parent": "V7",
+        "function": "Session Management",
         "kind": "control"
       },
       {
-        "control_id": "V11.1.2",
-        "title": "Verify business logic limits prevent function abuse",
-        "description": "Business logic controls prevent injection from redirecting agent goal; Tool chain exploitation scenarios identified in threat model — mitigations implemented and verified; Code execution capability in agents subject to business logic controls — sandbox, allowlist, static analysis",
+        "control_id": "V7.4.1",
+        "title": "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.",
+        "description": "",
+        "parent": "V7.4",
+        "function": "Session Management",
         "kind": "control"
       },
       {
-        "control_id": "V4.1.3",
-        "title": "Verify access control enforces least privilege",
-        "description": "Agent tool access scoped to minimum required operations — read-only by default, write access formally approved; Agent credential scope minimum required — no over-privileged NHIs; Memory write access restricted to minimum required sources — only agent and authorised administrators can write",
+        "control_id": "V8",
+        "title": "Authorization",
+        "description": "",
+        "parent": null,
+        "function": "Authorization",
         "kind": "control"
       },
       {
-        "control_id": "V4.1.1",
-        "title": "Verify all sensitive functions have access control",
-        "description": "All destructive tool operations require explicit authorisation — not inheritable from agent session; LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation",
-        "kind": "control"
+        "control_id": "V8.1.3",
+        "title": "Sensitive data not in session storage",
+        "description": "",
+        "parent": "V8",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, INSUFFICIENT IMPACT)"
       },
       {
-        "control_id": "V7.2.2",
-        "title": "Verify all business logic decisions logged",
-        "description": "All tool invocations logged — tool identity, parameters, agent session, timestamp; All agent tool invocations and recommendations logged — systematic bias detectable through aggregate analysis; All LLM tool invocations logged with full context — every tool call auditable",
-        "kind": "control"
+        "control_id": "V8.1.4",
+        "title": "Sensitive data minimisation",
+        "description": "",
+        "parent": "V8",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
       },
       {
-        "control_id": "V13.1.1",
-        "title": "Verify API rate limiting",
-        "description": "Tool API endpoints rate-limited — anomalous invocation frequency detected; Rate limiting on all agent API endpoints — cascade amplification through API exhaustion limited; Rate limiting prevents rogue agent from amplifying impact through API exhaustion",
+        "control_id": "V8.2",
+        "title": "General Authorization Design",
+        "description": "",
+        "parent": "V8",
+        "function": "Authorization",
         "kind": "control"
       },
       {
-        "control_id": "V2.1.1",
-        "title": "Verify credentials not in source code",
-        "description": "Agent credentials not hardcoded — secret manager required",
+        "control_id": "V8.2.1",
+        "title": "Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.",
+        "description": "",
+        "parent": "V8.2",
+        "function": "Authorization",
         "kind": "control"
       },
       {
-        "control_id": "V6.1.1",
-        "title": "Verify sensitive data encrypted at rest",
-        "description": "Agent credentials encrypted at rest — no cleartext in config or agent memory; Agent memory stores encrypted at rest — embeddings, long-term memory; Training data, embeddings, RAG document stores, and prompt caches encrypted at rest",
+        "control_id": "V8.3",
+        "title": "Operation Level Authorization",
+        "description": "",
+        "parent": "V8",
+        "function": "Authorization",
         "kind": "control"
       },
       {
-        "control_id": "V7.2.1",
-        "title": "Verify access control decisions logged",
-        "description": "All credential usage logged — issuance, access, expiry detectable; All A2A messages logged — sender identity, content hash, schema validation results; All agent actions logged — no production deployment without complete observability",
+        "control_id": "V8.3.1",
+        "title": "Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.",
+        "description": "",
+        "parent": "V8.3",
+        "function": "Authorization",
         "kind": "control"
       },
       {
-        "control_id": "V14.2.3",
-        "title": "Verify secrets not in source code",
-        "description": "Agent credentials not committed to source control; System prompts not hardcoded in source code — stored in secret management system",
-        "kind": "control"
+        "control_id": "V8.3.3",
+        "title": "Consent obtained before PI processing",
+        "description": "",
+        "parent": "V8",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
+      },
+      {
+        "control_id": "V8.3.10",
+        "title": "Personal data not kept longer than needed",
+        "description": "",
+        "parent": "V8",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))"
       },
       {
         "control_id": "V10.2.1",
         "title": "Verify third-party components current and free of vulnerabilities",
         "description": "All agent component libraries scanned for CVEs — ML SBOM maintained and monitored; All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained; Training pipeline components scanned — compromised dependencies rejected",
-        "kind": "control"
+        "parent": null,
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)"
       },
       {
         "control_id": "V10.2.2",
         "title": "Verify only minimal approved external libraries",
         "description": "Approved component list — unsigned or unverified agent components rejected; Approved component list for LLM deployments — unsigned or unverified components rejected",
-        "kind": "control"
+        "parent": null,
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT PRACTICAL)"
       },
       {
-        "control_id": "V14.2.2",
-        "title": "Verify build pipelines include security checks",
-        "description": "CI/CD pipeline for agent components includes integrity verification and CVE scanning; CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning",
+        "control_id": "V11.1.7",
+        "title": "Anti-automation controls",
+        "description": "",
+        "parent": "V11",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
+      },
+      {
+        "control_id": "V12",
+        "title": "Secure Communication",
+        "description": "",
+        "parent": null,
+        "function": "Secure Communication",
         "kind": "control"
       },
       {
-        "control_id": "V5.2.4",
-        "title": "Verify application does not use eval or dynamic code",
-        "description": "No eval or exec of agent-generated code — absolute prohibition enforced in code review; No eval or dynamic code execution of LLM-generated content",
+        "control_id": "V12.2",
+        "title": "HTTPS Communication with External Facing Services",
+        "description": "",
+        "parent": "V12",
+        "function": "Secure Communication",
         "kind": "control"
       },
       {
-        "control_id": "V5.3.5",
-        "title": "Verify output encoding in SQL context",
-        "description": "No raw agent output in SQL context — parameterised execution only; LLM-generated SQL parameterised — never raw LLM output in SQL context",
+        "control_id": "V12.2.1",
+        "title": "Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.",
+        "description": "",
+        "parent": "V12.2",
+        "function": "Secure Communication",
         "kind": "control"
       },
       {
-        "control_id": "V12.1.1",
-        "title": "Verify file upload malware scanning",
-        "description": "Content entering agent memory scanned — adversarial content, injection patterns detected before write; Training data uploads scanned before ingestion — adversarial content detected; Content validation on all vector store ingestion — adversarial content detected",
+        "control_id": "V13",
+        "title": "Configuration",
+        "description": "",
+        "parent": null,
+        "function": "Configuration",
         "kind": "control"
       },
       {
-        "control_id": "V9.1.1",
-        "title": "Verify TLS used for all client connectivity",
-        "description": "All A2A communication encrypted — mutual TLS, no cleartext inter-agent messages; All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum",
+        "control_id": "V13.1.2",
+        "title": "API throttling",
+        "description": "",
+        "parent": "V13",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 ((id absent from the official 4.0.3 mapping))"
+      },
+      {
+        "control_id": "V13.2",
+        "title": "Backend Communication Configuration",
+        "description": "",
+        "parent": "V13",
+        "function": "Configuration",
         "kind": "control"
       },
       {
-        "control_id": "V3.3.1",
-        "title": "Verify anti-replay tokens in state-changing operations",
-        "description": "Replay protection on all A2A messages — nonces, timestamps, sequence numbers",
+        "control_id": "V13.2.1",
+        "title": "Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.",
+        "description": "",
+        "parent": "V13.2",
+        "function": "Configuration",
         "kind": "control"
       },
       {
-        "control_id": "V11.1.1",
-        "title": "Verify business logic assumptions documented",
-        "description": "Cascade blast radius documented as business logic assumption — maximum affected systems formally accepted; AI advisory limitations documented as business logic assumptions — verification requirements per domain; LLM accuracy limitations documented as business logic assumptions — verification requirements defined",
+        "control_id": "V13.4",
+        "title": "Unintended Information Leakage",
+        "description": "",
+        "parent": "V13",
+        "function": "Configuration",
         "kind": "control"
       },
       {
-        "control_id": "V7.4.1",
-        "title": "Verify error handling does not expose sensitive data",
-        "description": "Cascade errors handled gracefully — no sensitive system information in error responses; Agent-influenced operator decisions logged — aggregate patterns detectable; LLM accuracy metrics and hallucination rate logged — production monitoring for output quality",
+        "control_id": "V13.4.5",
+        "title": "Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.",
+        "description": "",
+        "parent": "V13.4",
+        "function": "Configuration",
         "kind": "control"
       },
       {
-        "control_id": "V13.1.3",
-        "title": "Verify API rejects large unexpected payloads",
-        "description": "Approval flows independent of agent interface — no state-changing approvals via agent chat; Token limits on LLM API inputs — requests exceeding limits rejected at the gateway",
+        "control_id": "V14",
+        "title": "Data Protection",
+        "description": "",
+        "parent": null,
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V8 Data Protection",
-        "title": "V8.1.1 — Sensitive data not transmitted in URL parameters",
+        "control_id": "V14.1",
+        "title": "Data Protection Documentation",
+        "description": "",
+        "parent": "V14",
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V4 Access Control",
-        "title": "V4.1.3 — Deny by default access control",
+        "control_id": "V14.1.1",
+        "title": "Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.",
+        "description": "",
+        "parent": "V14.1",
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V5 Validation",
-        "title": "V5.2.8 — Output encoding for context",
+        "control_id": "V14.1.2",
+        "title": "Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements.",
+        "description": "",
+        "parent": "V14.1",
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V6 Cryptography",
-        "title": "V6.1.1 — Sensitive data not stored in cleartext",
+        "control_id": "V14.1.4",
+        "title": "All components inventoried",
+        "description": "",
+        "parent": "V14",
+        "function": null,
+        "kind": "control",
+        "source_status": "absent-from-asvs-5.0.0 (DELETED, NOT IN SCOPE)"
+      },
+      {
+        "control_id": "V14.2",
+        "title": "General Data Protection",
+        "description": "",
+        "parent": "V14",
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V2 Authentication",
-        "title": "V2.1.1 — Passwords minimum 12 characters",
+        "control_id": "V14.2.1",
+        "title": "Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token.",
+        "description": "",
+        "parent": "V14.2",
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V1 Architecture",
-        "title": "V1.1.4 — Trust boundaries documented and enforced",
+        "control_id": "V14.2.2",
+        "title": "Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use.",
+        "description": "",
+        "parent": "V14.2",
+        "function": "Data Protection",
         "kind": "control"
       },
       {
-        "control_id": "V7 Logging",
-        "title": "V7.2.2 — Log entries contain required information",
+        "control_id": "V15",
+        "title": "Secure Coding and Architecture",
+        "description": "",
+        "parent": null,
+        "function": "Secure Coding and Architecture",
         "kind": "control"
       },
       {
-        "control_id": "V14 Configuration",
-        "title": "V14.1.4 — All components inventoried",
+        "control_id": "V15.3",
+        "title": "Defensive Coding",
+        "description": "",
+        "parent": "V15",
+        "function": "Secure Coding and Architecture",
         "kind": "control"
       },
       {
-        "control_id": "V10 Malicious Code",
-        "title": "V10.2.1 — Application only uses official repositories",
+        "control_id": "V15.3.3",
+        "title": "Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action.",
+        "description": "",
+        "parent": "V15.3",
+        "function": "Secure Coding and Architecture",
         "kind": "control"
       },
       {
-        "control_id": "V12 Files/Resources",
-        "title": "V12.1.1 — File upload size limits",
+        "control_id": "V15.3.7",
+        "title": "Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields).",
+        "description": "",
+        "parent": "V15.3",
+        "function": "Secure Coding and Architecture",
         "kind": "control"
       },
       {
-        "control_id": "V9 Communication",
-        "title": "V9.1.1 — TLS for all connections",
+        "control_id": "V16",
+        "title": "Security Logging and Error Handling",
+        "description": "",
+        "parent": null,
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V11 Business Logic",
-        "title": "V11.1.4 — Business logic limits on repeated actions",
+        "control_id": "V16.2",
+        "title": "General Logging",
+        "description": "",
+        "parent": "V16",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V3 Session Management",
-        "title": "V3.1.1 — Session tokens unique and random",
+        "control_id": "V16.2.5",
+        "title": "Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially.",
+        "description": "",
+        "parent": "V16.2",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V13 API",
-        "title": "V13.1.1 — API protection against enumeration",
+        "control_id": "V16.3",
+        "title": "Security Events",
+        "description": "",
+        "parent": "V16",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V5.1.2",
-        "title": "Verify that HTTP request parts are validated, sanitised, or rejected",
-        "description": "LLM API request validation — prompt structure, content type, and character set enforced",
+        "control_id": "V16.3.1",
+        "title": "Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected.",
+        "description": "",
+        "parent": "V16.3",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V8.1.1",
-        "title": "Verify sensitive data is not cached or exposed in logs",
-        "description": "LLM outputs containing sensitive data not logged in cleartext or cached without protection; System prompts not stored in cleartext application configuration or source code",
+        "control_id": "V16.3.2",
+        "title": "Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself).",
+        "description": "",
+        "parent": "V16.3",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V8.3.4",
-        "title": "Verify PII is identified and protected",
-        "description": "PII in LLM training data, RAG sources, and outputs identified and handled per policy",
+        "control_id": "V16.5",
+        "title": "Error Handling",
+        "description": "",
+        "parent": "V16",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V4.2.2",
-        "title": "Verify anti-CSRF tokens in state-changing operations",
-        "description": "CSRF protection on endpoints where LLM output triggers state changes",
+        "control_id": "V16.5.1",
+        "title": "Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens.",
+        "description": "",
+        "parent": "V16.5",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       },
       {
-        "control_id": "V11.1.4",
-        "title": "Verify business logic rate limits",
-        "description": "Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies",
+        "control_id": "V16.5.3",
+        "title": "Verify that the application fails gracefully and securely, including when an exception occurs, preventing fail-open conditions such as processing a transaction despite errors resulting from validation logic.",
+        "description": "",
+        "parent": "V16.5",
+        "function": "Security Logging and Error Handling",
         "kind": "control"
       }
     ],
@@ -8213,14 +8383,29 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-04-09",
         "change": "Initial seed — 32 ASVS verification requirements and sub-requirements",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 75 items -> 82, including 17 referenced by mappings but absent from the registry",
+        "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 82 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)",
+        "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Re-mapped to ASVS 5.0.0 using the project's own mapping_v4.0.3_to_v5.0.0.yml: 78 items -> 78, titles from the 5.0.0 release; 11 id(s) 5.0.0 deleted are kept and flagged (#22)",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ],
     "inventory_completeness": {
-      "status": "unknown",
-      "included": 75,
-      "total": null,
-      "note": "Authoritative control count not established. Needs a count from the published framework.",
-      "source": "https://owasp.org/projects/asvs"
+      "status": "partial",
+      "included": 78,
+      "total": 345,
+      "note": "Holds the 44 requirement(s) the mappings cite plus their sections and chapters, titled from the ASVS 5.0.0 release. The standard has 345 requirements in total; the rest are not referenced by this crosswalk. 11 id(s) remain at 4.0.3 because 5.0.0 deleted them — see issue #22.",
+      "source": "https://github.com/OWASP/ASVS/releases/tag/v5.0.0_release"
     }
   },
   {
@@ -8323,6 +8508,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Migrated off the swapped-column ids of issue #35: 104 items -> 10",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 10 items -> 10",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ]
   },
@@ -8778,6 +8968,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Titled 17 entries that had carried only their identifier, from the published text: PCI DSS v4.0 requirement headings, transcribed from PCI SSC \"PCI DSS v4.0 SAQ D for Merchants\" — Req 1.3, Req 2.2, Req 3.4, Req 3.5, Req 4.2, Req 5.2, Req 6.3, Req 6.4, Req 7.2, Req 7.3, Req 8.2, Req 8.3, Req 10.2, Req 10.7, Req 11.3, Req 12.3, Req 12.6",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 49 items -> 49",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ]
   },
@@ -9169,6 +9364,11 @@ window.CROSSWALK_FRAMEWORKS = [
         "date": "2026-09-18",
         "change": "Titled 2 entries that had carried only their identifier, from the published text: TSP section 100, 2017 Trust Services Criteria (with Revised Points of Focus — 2022) — P7.1, PI1.3",
         "author": "OWASP GenAI Data Security Initiative"
+      },
+      {
+        "date": "2026-09-18",
+        "change": "Migrated off the swapped-column ids of issue #35: 46 items -> 46",
+        "author": "OWASP GenAI Data Security Initiative"
       }
     ],
     "inventory_completeness": {
diff --git a/dsgai-2026/DSGAI_ASVS.md b/dsgai-2026/DSGAI_ASVS.md
index 71cfb1a..a5df46e 100644
--- a/dsgai-2026/DSGAI_ASVS.md
+++ b/dsgai-2026/DSGAI_ASVS.md
@@ -1,7 +1,7 @@
 <!--
   OWASP GenAI Crosswalk
   Source list : OWASP GenAI Data Security Risks & Mitigations 2026 (DSGAI01–DSGAI21)
-  Framework   : OWASP Application Security Verification Standard (ASVS) 4.0.3
+  Framework   : OWASP Application Security Verification Standard (ASVS) 5.0.0
   Version     : 2026-Q1
   Maintained by: OWASP GenAI Data Security Initiative — https://genai.owasp.org
   License     : CC BY-SA 4.0
@@ -23,12 +23,16 @@ directly, augmented by GenAI-specific data handling requirements. This mapping
 enables security engineers and penetration testers to translate DSGAI threats into
 verifiable ASVS requirements for inclusion in security test plans.
 
-> **Mapped against ASVS 4.0.3.** ASVS **5.0.0** is released and renumbered the
-> requirements, so the V-numbers below do not reliably denote the same
-> requirement in 5.0. These mappings are **not** current for 5.0 and have not
-> been re-mapped: doing so is expert work, tracked in
-> [issue #22](https://github.com/GenAI-Security-Project/crosswalk/issues/22).
-> Treat the requirement identifiers here as 4.0.3 identifiers.
+> **Mapped against ASVS 5.0.0.** The identifiers below were translated from 4.0.3
+> using the ASVS project’s own mapping file, [`mapping_v4.0.3_to_v5.0.0.yml`][asvs-map],
+> and the requirement text is 5.0.0’s own. The translation is mechanical: the
+> **relationship, rationale type and confidence on every row read `DRAFT`** and
+> await an ASVS-leadership reviewer ([#22][issue-22], STRAT-04). Requirements
+> 5.0.0 deleted rather than renumbered keep their 4.0.3 identifier and carry a
+> DRAFT marker naming the official disposition.
+
+[asvs-map]: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml
+[issue-22]: https://github.com/GenAI-Security-Project/crosswalk/issues/22
 
 ---
 
@@ -142,13 +146,13 @@ The aggregation effect — combining data from multiple sources in a single cont
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V8.1.1 — Sensitive data not transmitted in URL parameters | V8 Data Protection | Sensitive data in LLM API calls and RAG queries must not be exposed via URL parameters | L1 | Foundational | Both |
-| V8.3.4 — Sensitive data identified and classified | V8 Data Protection | All data types entering LLM context (training, RAG, user input) classified and handled per classification policy | L2 | Foundational | Both |
-| V4.1.3 — Deny by default access control | V4 Access Control | RAG data sources enforce deny-by-default — users access only data explicitly authorised to them | L1 | Foundational | Both |
-| V5.2.8 — Output encoding for context | V5 Validation | Model outputs scanned and redacted for PII, credentials, and sensitive patterns before delivery | L1 | Foundational | Both |
-| V6.1.1 — Sensitive data not stored in cleartext | V6 Cryptography | Training data and RAG corpora containing sensitive data encrypted at rest | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V14.2.2 — Sensitive data not transmitted in URL parameters | V8 Data Protection | Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.1.1 — Sensitive data identified and classified | V8 Data Protection | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.2.1 — Deny by default access control | V4 Access Control | Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V1.3.5 — Output encoding for context | V5 Validation | Verify that the application sanitizes or disables user-supplied scriptable or expression template language content, such as Markdown, CSS or XSL stylesheets, BBCode, or similar. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.1.1 — Sensitive data not stored in cleartext | V6 Cryptography | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -196,12 +200,12 @@ credential compromise can propagate across all tools and services the agent can
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V2.1.1 — Passwords minimum 12 characters | V2 Authentication | Agent API keys and service credentials meet minimum strength requirements | L1 | Foundational | Both |
-| V2.10.1 — Integration secrets not hardcoded | V2 Authentication | Agent credentials not hardcoded in prompts, configuration files, or code — stored in secrets managers | L2 | Foundational | Both |
-| V4.1.2 — Least privilege for service accounts | V4 Access Control | Agent service accounts granted minimum permissions — no shared high-privilege accounts across agents | L1 | Foundational | Both |
-| V8.3.7 — Data transferred using current TLS | V8 Data Protection | Agent-to-service communication uses TLS — credentials never transmitted in cleartext | L1 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V6.2.1 — Passwords minimum 12 characters | V2 Authentication | Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V13.2.1 — Integration secrets not hardcoded | V2 Authentication | Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access. | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.2.1 — Least privilege for service accounts | V4 Access Control | Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.1.2 — Data transferred using current TLS | V8 Data Protection | Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -246,12 +250,12 @@ bypassing data governance controls without organisational visibility.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V1.1.4 — Trust boundaries documented and enforced | V1 Architecture | Data flows to external AI services identified, approved, and enforced at architectural boundaries | L2 | Foundational | Both |
-| V4.1.5 — Access control failures logged | V4 Access Control | Attempts to send sensitive data to unapproved AI services detected and logged | L2 | Foundational | Both |
-| V7.2.2 — Log entries contain required information | V7 Logging | Audit logs capture data flows to external AI services sufficient for incident investigation | L2 | Hardening | Both |
-| V14.1.4 — All components inventoried | V14 Configuration | Inventory of all AI tools in use — approved and shadow — maintained and reviewed regularly | L2 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V1.1.4 — Trust boundaries documented and enforced | V1 Architecture | Data flows to external AI services identified, approved, and enforced at architectural boundaries | L2 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V16.5.3 — Access control failures logged | V4 Access Control | Verify that the application fails gracefully and securely, including when an exception occurs, preventing fail-open conditions such as processing a transaction despite errors resulting from validation logic. | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V16.3.2 — Log entries contain required information | V7 Logging | Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself). | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.1.4 — All components inventoried | V14 Configuration | Inventory of all AI tools in use — approved and shadow — maintained and reviewed regularly | L2 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -295,12 +299,12 @@ biases, or targeted misinformation that persist into production.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V5.1.3 — Input validation server-side | V5 Validation | Training data ingestion pipelines validate all inputs against expected schemas before processing | L1 | Foundational | Both |
-| V10.2.1 — Application only uses official repositories | V10 Malicious Code | Pre-trained models and datasets sourced only from verified, approved repositories | L2 | Foundational | Both |
-| V10.2.2 — Dependency managers check for vulnerabilities | V10 Malicious Code | AI model artefacts checked for known vulnerabilities and backdoors before deployment | L2 | Hardening | Both |
-| V12.1.1 — File upload size limits | V12 Files/Resources | Documents uploaded to RAG stores validated for content, size, and format before ingestion | L1 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V2.2.1 — Input validation server-side | V5 Validation | Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V10.2.1 — Application only uses official repositories | V10 Malicious Code | Pre-trained models and datasets sourced only from verified, approved repositories | L2 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V10.2.2 — Dependency managers check for vulnerabilities | V10 Malicious Code | AI model artefacts checked for known vulnerabilities and backdoors before deployment | L2 | Hardening | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V5.2.1 — File upload size limits | V12 Files/Resources | Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -346,11 +350,11 @@ incorrect model outputs or security bypasses in downstream systems.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V5.1.1 — Input validation using allowlists | V5 Validation | All data ingested into GenAI pipelines validated against an allowlist schema | L1 | Foundational | Build |
-| V5.2.1 — HTML/JS output sanitised | V5 Validation | Model outputs destined for HTML renderers sanitised — prevents XSS via AI-generated content | L1 | Foundational | Build |
-| V7.4.1 — Generic error messages | V7 Logging | Validation failures produce generic errors to users — detailed error information logged server-side only | L1 | Foundational | Build |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V15.3.7 — Input validation using allowlists | V5 Validation | Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V1.3.1 — HTML/JS output sanitised | V5 Validation | Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V16.5.1 — Generic error messages | V7 Logging | Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -395,11 +399,11 @@ via tool outputs, or exfiltration through misconfigured plugin channels.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V4.1.1 — Access control on every request | V4 Access Control | Every tool invocation and plugin call authenticated and authorised — no implicit trust between components | L1 | Foundational | Both |
-| V9.1.1 — TLS for all connections | V9 Communication | All agent-to-tool and agent-to-plugin communication uses TLS — prevents interception of exchanged data | L1 | Foundational | Both |
-| V11.1.4 — Business logic limits on repeated actions | V11 Business Logic | Agent tool invocation frequency limited — prevents runaway tool usage or data exfiltration loops | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.3.1 — Access control on every request | V4 Access Control | Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V12.2.1 — TLS for all connections | V9 Communication | Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V2.4.1 — Business logic limits on repeated actions | V11 Business Logic | Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -444,11 +448,11 @@ fulfil deletion obligations under GDPR or other privacy regulations.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V8.1.4 — Sensitive data minimisation | V8 Data Protection | Only data necessary for the defined AI purpose is collected, processed, and retained | L1 | Foundational | Both |
-| V8.3.4 — Sensitive data identified and classified | V8 Data Protection | All data entering GenAI systems classified per sensitivity — classification drives handling and retention rules | L2 | Foundational | Both |
-| V4.1.5 — Attribute-based access control | V4 Access Control | Data access decisions in RAG and training systems based on data classification attributes | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.1.4 — Sensitive data minimisation | V8 Data Protection | Only data necessary for the defined AI purpose is collected, processed, and retained | L1 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V14.1.1 — Sensitive data identified and classified | V8 Data Protection | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V16.5.3 — Attribute-based access control | V4 Access Control | Verify that the application fails gracefully and securely, including when an exception occurs, preventing fail-open conditions such as processing a transaction despite errors resulting from validation logic. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -492,11 +496,11 @@ or processing for purposes beyond those disclosed.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V8.3.3 — Consent obtained before PI processing | V8 Data Protection | Lawful basis established for all personal data processed in GenAI training and inference | L1 | Foundational | Both |
-| V8.3.10 — Personal data not kept longer than needed | V8 Data Protection | Training data and model outputs containing personal data subject to retention limits | L2 | Foundational | Both |
-| V7.2.2 — Audit trail sufficient for compliance | V7 Logging | Logs maintained sufficient to demonstrate regulatory compliance — retained for required periods | L2 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.3.3 — Consent obtained before PI processing | V8 Data Protection | Lawful basis established for all personal data processed in GenAI training and inference | L1 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V8.3.10 — Personal data not kept longer than needed | V8 Data Protection | Training data and model outputs containing personal data subject to retention limits | L2 | Foundational | Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V16.3.2 — Audit trail sufficient for compliance | V7 Logging | Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself). | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -540,11 +544,11 @@ DLP controls that do not inspect non-text modalities.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V5.2.5 — Unstructured data sanitised | V5 Validation | All non-text inputs (images, audio, documents) scanned for sensitive content before multimodal model processing | L2 | Hardening | Both |
-| V8.1.4 — Sensitive data minimised | V8 Data Protection | Non-text data processed only to the extent necessary — full documents not passed to model when excerpts suffice | L2 | Hardening | Both |
-| V12.1.3 — Malicious file detection on upload | V12 Files/Resources | Multimodal inputs scanned for embedded malicious payloads before processing | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V1.3.7 — Unstructured data sanitised | V5 Validation | Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.1.4 — Sensitive data minimised | V8 Data Protection | Non-text data processed only to the extent necessary — full documents not passed to model when excerpts suffice | L2 | Hardening | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V5.2.4 — Malicious file detection on upload | V12 Files/Resources | Verify that a file size quota and maximum number of files per user are enforced to ensure that a single user cannot fill up the storage with too many files, or excessively large files. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -587,10 +591,10 @@ anonymisation through linkage attacks against other available datasets.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V8.3.4 — Sensitive data classified | V8 Data Protection | Synthetic data classified appropriately — residual re-identification risk assessed and documented | L2 | Hardening | Build |
-| V5.2.6 — Defined output structure | V5 Validation | Synthetic data generation outputs validated to confirm absence of original record content | L2 | Hardening | Build |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V14.1.1 — Sensitive data classified | V8 Data Protection | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Hardening | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V1.3.6 — Defined output structure | V5 Validation | Verify that the application protects against Server-side Request Forgery (SSRF) attacks, by validating untrusted data against an allowlist of protocols, domains, paths and ports and sanitizing potentially dangerous characters before using the data to call another service. | L2 | Hardening | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -634,12 +638,12 @@ or improper cache management — violating data separation and user privacy.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V3.1.1 — Session tokens unique and random | V3 Session Management | Each LLM conversation session identified by a unique, unpredictable token — sessions cannot be guessed or forged | L1 | Foundational | Build |
-| V3.3.1 — Sessions invalidated after logout | V3 Session Management | Conversation context fully cleared on session end — no residual context accessible to subsequent sessions | L1 | Foundational | Build |
-| V4.1.1 — Access control enforced on every request | V4 Access Control | Context retrieval operations enforce per-user isolation — cross-user context access blocked by default | L1 | Foundational | Build |
-| V8.1.3 — Sensitive data not in session storage | V8 Data Protection | Sensitive user data not persisted in shared session or cache layers accessible across users | L1 | Foundational | Build |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V14.2.1 — Session tokens unique and random | V3 Session Management | Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V7.4.1 — Sessions invalidated after logout | V3 Session Management | Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.3.1 — Access control enforced on every request | V4 Access Control | Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.1.3 — Sensitive data not in session storage | V8 Data Protection | Sensitive user data not persisted in shared session or cache layers accessible across users | L1 | Foundational | Build — **DRAFT — ASVS 5.0.0: DELETED, INSUFFICIENT IMPACT; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -684,12 +688,12 @@ to bypass access controls, extract unauthorised data, or corrupt data stores.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V5.1.1 — Allowlist input validation | V5 Validation | NL queries translated by LLMs validated against an allowlist of permitted query patterns before execution | L1 | Foundational | Build |
-| V5.3.4 — SQL injection prevention | V5 Validation | LLM-generated SQL parameterised — no direct string interpolation of model output into query execution | L1 | Foundational | Build |
-| V4.1.1 — Access control on every request | V4 Access Control | NL gateway enforces the same access control as the underlying data source — no privilege amplification via NL | L1 | Foundational | Build |
-| V13.1.1 — API protection against enumeration | V13 API | NL data gateway limits result set size and prevents systematic data enumeration through conversational interface | L2 | Hardening | Build |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V15.3.7 — Allowlist input validation | V5 Validation | Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V1.2.4 — SQL injection prevention | V5 Validation | Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.3.1 — Access control on every request | V4 Access Control | Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V1.5.3 — API protection against enumeration | V13 API | Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks. | L2 | Hardening | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -736,11 +740,11 @@ and extraction of sensitive source content through embedding inversion.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V4.1.3 — Deny by default | V4 Access Control | Vector store access defaults to deny — read and write permissions explicitly granted per namespace | L1 | Foundational | Both |
-| V6.1.1 — Sensitive data not stored in cleartext | V6 Cryptography | Embedding vectors encrypted at rest — prevents direct extraction and inversion attacks | L2 | Hardening | Both |
-| V12.1.1 — File upload validation | V12 Files/Resources | Documents ingested into vector stores validated for content, format, and adversarial patterns | L1 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.2.1 — Deny by default | V4 Access Control | Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.1.1 — Sensitive data not stored in cleartext | V6 Cryptography | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V5.2.1 — File upload validation | V12 Files/Resources | Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -784,12 +788,12 @@ PII, API keys, and user behaviour to attackers who compromise logging infrastruc
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V7.1.1 — No credential logging | V7 Logging | Credentials, tokens, and API keys not captured in logs — redacted at the telemetry collection layer | L1 | Foundational | Build |
-| V7.1.2 — No sensitive data in logs | V7 Logging | PII and sensitive content redacted from logs before storage — logs contain event metadata, not conversation content | L1 | Foundational | Build |
-| V8.1.1 — Sensitive data not in URLs | V8 Data Protection | Telemetry pipelines do not transmit sensitive data via URL parameters or unencrypted channels | L1 | Foundational | Build |
-| V4.1.1 — Access control on log stores | V4 Access Control | Log and telemetry stores subject to the same access control rigour as production data | L1 | Foundational | Build |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V16.2.5 — No credential logging | V7 Logging | Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V16.2.5 — No sensitive data in logs | V7 Logging | Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.2.2 — Sensitive data not in URLs | V8 Data Protection | Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.3.1 — Access control on log stores | V4 Access Control | Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -833,11 +837,11 @@ poisoning, and disclosure of information from one user's or system's context to
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V4.1.3 — Deny by default access control | V4 Access Control | Context window population controlled by explicit allow rules — no implicit inclusion of all available context | L1 | Foundational | Build |
-| V8.1.4 — Data minimisation | V8 Data Protection | Context window populated with minimum data necessary for the task — not maximum available data | L1 | Foundational | Build |
-| V3.1.1 — Session isolation | V3 Session Management | Data from different user sessions never co-mingled in a shared context window | L1 | Foundational | Build |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.2.1 — Deny by default access control | V4 Access Control | Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.1.4 — Data minimisation | V8 Data Protection | Context window populated with minimum data necessary for the task — not maximum available data | L1 | Foundational | Build — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V14.2.1 — Session isolation | V3 Session Management | Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token. | L1 | Foundational | Build | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -886,11 +890,11 @@ explicit per-action authorisation — and may exfiltrate this data to remote mod
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V4.1.2 — Least privilege | V4 Access Control | Browser and endpoint AI assistants operate with minimum permissions — no implicit access to OS resources, files, or other applications | L1 | Foundational | Both |
-| V11.1.5 — Business logic prevents excess data access | V11 Business Logic | Endpoint assistant functionality restricted to declared scope — no background data collection beyond stated purpose | L2 | Foundational | Both |
-| V1.1.2 — Secure architecture and design | V1 Architecture | Endpoint AI components subject to the same architectural security review as other privileged applications | L2 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.2.1 — Least privilege | V4 Access Control | Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V2.2.1 — Business logic prevents excess data access | V11 Business Logic | Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input. | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V1.1.2 — Secure architecture and design | V1 Architecture | Endpoint AI components subject to the same architectural security review as other privileged applications | L2 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -935,10 +939,10 @@ service outages, loss of training history, or inability to recover from data cor
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V11.1.7 — Anti-automation controls | V11 Business Logic | GenAI services protected against automated abuse that could exhaust resources and cause availability failures | L2 | Foundational | Both |
-| V13.1.2 — API throttling | V13 API | Model inference APIs throttled to prevent demand spikes from causing availability failures | L1 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V11.1.7 — Anti-automation controls | V11 Business Logic | GenAI services protected against automated abuse that could exhaust resources and cause availability failures | L2 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V13.1.2 — API throttling | V13 API | Model inference APIs throttled to prevent demand spikes from causing availability failures | L1 | Foundational | Both — **DRAFT — ASVS 5.0.0: (id absent from the official 4.0.3 mapping); retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -984,10 +988,10 @@ content from model outputs — even when the data was never directly disclosed.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V8.3.4 — Sensitive data identified | V8 Data Protection | Training datasets containing personal data identified — inference attack risk assessed before deployment | L2 | Hardening | Both |
-| V6.1.1 — Sensitive data not stored in cleartext | V6 Cryptography | Model weights and embedding vectors stored encrypted — reduces utility of extraction attacks | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V14.1.1 — Sensitive data identified | V8 Data Protection | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V14.1.1 — Sensitive data not stored in cleartext | V6 Cryptography | Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -1032,11 +1036,11 @@ data handling risks, privacy violations, and welfare concerns for annotation wor
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V4.1.2 — Least privilege | V4 Access Control | Human reviewers access only the data necessary for their annotation task — no broader dataset access | L1 | Foundational | Both |
-| V8.3.3 — Consent for personal data processing | V8 Data Protection | Data subjects whose data is reviewed by human annotators informed and consented per applicable law | L1 | Foundational | Both |
-| V2.1.1 — Strong authentication | V2 Authentication | Annotation platform access requires strong authentication — labeller access to sensitive data is audited | L2 | Foundational | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.2.1 — Least privilege | V4 Access Control | Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.3.3 — Consent for personal data processing | V8 Data Protection | Data subjects whose data is reviewed by human annotators informed and consented per applicable law | L1 | Foundational | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V6.2.1 — Strong authentication | V2 Authentication | Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended. | L2 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -1079,11 +1083,11 @@ or identify exploitable decision boundaries without access to model weights.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V4.1.1 — Access control per request | V4 Access Control | Model API access authenticated and rate-limited — prevents systematic extraction queries | L1 | Foundational | Both |
-| V8.1.4 — Data minimisation in responses | V8 Data Protection | Model confidence scores and logits not exposed in API responses where not required — limits extraction attack signal | L2 | Hardening | Both |
-| V10.2.2 — Component integrity checking | V10 Malicious Code | Model artefacts protected with integrity verification — detect unauthorised copies or modifications | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V8.3.1 — Access control per request | V4 Access Control | Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | L1 | Foundational | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V8.1.4 — Data minimisation in responses | V8 Data Protection | Model confidence scores and logits not exposed in API responses where not required — limits extraction attack signal | L2 | Hardening | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| V10.2.2 — Component integrity checking | V10 Malicious Code | Model artefacts protected with integrity verification — detect unauthorised copies or modifications | L2 | Hardening | Both — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -1126,10 +1130,10 @@ targeting specific topics, entities, or user segments with malicious intent.
 
 #### ASVS mapping
 
-| Requirement | Chapter | Description | Level | Tier | Scope |
-|---|---|---|---|---|---|
-| V5.1.3 — Server-side input validation | V5 Validation | Training data ingestion validates content against factual integrity checks and anomaly patterns | L2 | Hardening | Both |
-| V11.1.4 — Enforce business logic limits | V11 Business Logic | Model output validation detects systematic deviation from factual baselines — triggers review before serving | L2 | Hardening | Both |
+| Requirement | Chapter | Description | Level | Tier | Scope | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|---|---|
+| V2.2.1 — Server-side input validation | V5 Validation | Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| V2.4.1 — Enforce business logic limits | V11 Business Logic | Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources. | L2 | Hardening | Both | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
diff --git a/llm-top10/LLM_ASVS.md b/llm-top10/LLM_ASVS.md
index 5792519..4cbfb66 100644
--- a/llm-top10/LLM_ASVS.md
+++ b/llm-top10/LLM_ASVS.md
@@ -1,7 +1,7 @@
 <!--
   OWASP GenAI Crosswalk
   Source list : OWASP Top 10 for LLM Applications 2026 (LLM01–LLM10)
-  Framework   : OWASP Application Security Verification Standard (ASVS) 4.0.3
+  Framework   : OWASP Application Security Verification Standard (ASVS) 5.0.0
   Version     : 2026-Q3
   Maintained by: OWASP GenAI Data Security Initiative — https://genai.owasp.org
   License     : CC BY-SA 4.0
@@ -22,12 +22,16 @@ controls. LLM applications are web applications and APIs with
 additional AI-specific attack surfaces — all standard ASVS controls
 apply, with specific requirements amplified by the LLM context.
 
-> **Mapped against ASVS 4.0.3.** ASVS **5.0.0** is released and renumbered the
-> requirements, so the V-numbers below do not reliably denote the same
-> requirement in 5.0. These mappings are **not** current for 5.0 and have not
-> been re-mapped: doing so is expert work, tracked in
-> [issue #22](https://github.com/GenAI-Security-Project/crosswalk/issues/22).
-> Treat the requirement identifiers here as 4.0.3 identifiers.
+> **Mapped against ASVS 5.0.0.** The identifiers below were translated from 4.0.3
+> using the ASVS project’s own mapping file, [`mapping_v4.0.3_to_v5.0.0.yml`][asvs-map],
+> and the requirement text is 5.0.0’s own. The translation is mechanical: the
+> **relationship, rationale type and confidence on every row read `DRAFT`** and
+> await an ASVS-leadership reviewer ([#22][issue-22], STRAT-04). Requirements
+> 5.0.0 deleted rather than renumbered keep their 4.0.3 identifier and carry a
+> DRAFT marker naming the official disposition.
+
+[asvs-map]: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml
+[issue-22]: https://github.com/GenAI-Security-Project/crosswalk/issues/22
 
 ---
 
@@ -135,14 +139,14 @@ invisible-Unicode carriers survive review of the rendered interface.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify all user input validated against an allowlist or rejected | V5.1.1 | L1 | All inputs to LLMs validated — indirect injection through processed content equally in scope |
-| Verify that HTTP request parts are validated, sanitised, or rejected | V5.1.2 | L1 | LLM API request validation — prompt structure, content type, and character set enforced |
-| Verify output encoding prevents injection attacks | V5.2.1 | L1 | LLM output encoding before passing to downstream renderers or interpreters |
-| Verify application protects against OS command injection | V5.2.5 | L1 | LLM-generated content validated before execution in any shell or interpreter context |
-| Threat modelling of all data flows | V1.1.2 | L2 | LLM data flows threat-modelled — all injection paths identified and documented |
-| Verify business logic limits prevent abuse of LLM functions | V11.1.2 | L2 | Business logic controls preventing prompt injection from triggering unauthorised actions |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | V15.3.7 | L1 | All inputs to LLMs validated — indirect injection through processed content equally in scope | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application has countermeasures to protect against mass assignment attacks by limiting allowed fields per controller and action, e.g., it is not possible to insert or update a field value when it was not intended to be part of that action. | V15.3.3 | L1 | LLM API request validation — prompt structure, content type, and character set enforced | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | V1.3.1 | L1 | LLM output encoding before passing to downstream renderers or interpreters | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | V1.3.7 | L1 | LLM-generated content validated before execution in any shell or interpreter context | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Threat modelling of all data flows | V1.1.2 | L2 | LLM data flows threat-modelled — all injection paths identified and documented — **DRAFT — ASVS 5.0.0: DELETED, NOT IN SCOPE; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Business logic controls preventing prompt injection from triggering unauthorised actions | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -204,13 +208,13 @@ over-permissive RAG retrieval.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify sensitive data is not cached or exposed in logs | V8.1.1 | L1 | LLM outputs containing sensitive data not logged in cleartext or cached without protection |
-| Verify PII is identified and protected | V8.3.4 | L1 | PII in LLM training data, RAG sources, and outputs identified and handled per policy |
-| Verify access control decisions enforce least privilege | V4.1.3 | L1 | RAG retrieval access controls — users retrieve only data they are authorised to access |
-| Verify all sensitive data encrypted at rest | V6.1.1 | L2 | Training data, embeddings, RAG document stores, and prompt caches encrypted at rest |
-| Verify all sensitive data encrypted in transit | V9.1.1 | L1 | All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use. | V14.2.2 | L1 | LLM outputs containing sensitive data not logged in cleartext or cached without protection | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | V14.1.1 | L1 | PII in LLM training data, RAG sources, and outputs identified and handled per policy | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | RAG retrieval access controls — users retrieve only data they are authorised to access | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | V14.1.1 | L2 | Training data, embeddings, RAG document stores, and prompt caches encrypted at rest | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications. | V12.2.1 | L1 | All LLM API communication and data flows encrypted in transit — TLS 1.2 minimum | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -268,12 +272,12 @@ unintended or harmful actions when manipulated.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify access control enforces least privilege | V4.1.3 | L1 | LLM tool access enforced at minimum required scope — read-only by default |
-| Verify all sensitive functions have access control | V4.1.1 | L1 | LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation |
-| Verify all business logic decisions logged | V7.2.2 | L2 | All LLM tool invocations logged with full context — every tool call auditable |
-| Verify business logic abuse scenarios identified | V11.1.2 | L2 | Business logic controls preventing tool misuse through prompt manipulation |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | LLM tool access enforced at minimum required scope — read-only by default | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript. | V8.3.1 | L1 | LLM cannot access sensitive functions (write, delete, execute) without explicit authorisation | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that failed authorization attempts are logged. For L3, this must include logging all authorization decisions, including logging when sensitive data is accessed (without logging the sensitive data itself). | V16.3.2 | L2 | All LLM tool invocations logged with full context — every tool call auditable | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions. | V2.4.2 | L2 | Business logic controls preventing tool misuse through prompt manipulation | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -338,11 +342,11 @@ dependency is clean.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify third-party components are current and free from vulnerabilities | V10.2.1 | L2 | All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained |
-| Verify only minimal approved external libraries are used | V10.2.2 | L2 | Approved component list for LLM deployments — unsigned or unverified components rejected |
-| Verify build pipelines include security checks | V14.2.2 | L2 | CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify third-party components are current and free from vulnerabilities | V10.2.1 | L2 | All LLM component libraries and dependencies scanned for CVEs — ML SBOM maintained — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify only minimal approved external libraries are used | V10.2.2 | L2 | Approved component list for LLM deployments — unsigned or unverified components rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended. | V13.4.5 | L2 | CI/CD pipeline for LLM components includes integrity verification and vulnerability scanning | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -402,11 +406,11 @@ stage that writes weights, not just the original training corpus.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify all inputs validated against allowlist | V5.1.1 | L1 | Training data pipeline input validation — anomalous data rejected before training |
-| Verify third-party components free of vulnerabilities | V10.2.1 | L2 | Training pipeline components scanned — compromised dependencies rejected |
-| Verify file uploads scanned for malware | V12.1.1 | L2 | Training data uploads scanned before ingestion — adversarial content detected |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application has defenses against HTTP parameter pollution attacks, particularly if the application framework makes no distinction about the source of request parameters (query string, body parameters, cookies, or header fields). | V15.3.7 | L1 | Training data pipeline input validation — anomalous data rejected before training | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify third-party components free of vulnerabilities | V10.2.1 | L2 | Training pipeline components scanned — compromised dependencies rejected — **DRAFT — ASVS 5.0.0: DELETED, NOT PRACTICAL; retarget or drop pending SME review (#22)** | DRAFT | DRAFT | DRAFT | ASVS 4.0.3 | (unreviewed) |
+| Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack. | V5.2.1 | L2 | Training data uploads scanned before ingestion — adversarial content detected | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -463,12 +467,12 @@ causing denial of service or runaway API cost.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify API rate limiting | V13.1.1 | L1 | Rate limiting on all LLM API endpoints — per user, per session, per API key |
-| Verify API rejects large unexpected payloads | V13.1.3 | L1 | Token limits on LLM API inputs — requests exceeding limits rejected at the gateway |
-| Verify business logic rate limits | V11.1.4 | L2 | Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies |
-| Verify error handling does not expose sensitive data | V7.4.1 | L1 | LLM resource exhaustion errors handled gracefully — no sensitive information in error responses |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify API rate limiting | V1.5.3 | L1 | Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks. | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token. | V14.2.1 | L1 | Token limits on LLM API inputs — requests exceeding limits rejected at the gateway | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that anti-automation controls are in place to protect against excessive calls to application functions that could lead to data exfiltration, garbage-data creation, quota exhaustion, rate-limit breaches, denial-of-service, or overuse of costly resources. | V2.4.1 | L2 | Business logic controls on LLM usage — per-tenant cost budgets, rate limit policies | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens. | V16.5.1 | L1 | LLM resource exhaustion errors handled gracefully — no sensitive information in error responses | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -527,11 +531,11 @@ systems act upon.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify business logic assumptions documented | V11.1.1 | L2 | LLM accuracy limitations documented as business logic assumptions — verification requirements defined |
-| Verify all security controls logged | V7.4.1 | L1 | LLM accuracy metrics and hallucination rate logged — production monitoring for output quality |
-| Verify outputs encoded before rendering | V5.2.1 | L1 | LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application will only process business logic flows for the same user in the expected sequential step order and without skipping steps. | V2.3.1 | L2 | LLM accuracy limitations documented as business logic assumptions — verification requirements defined | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that a generic message is returned to the consumer when an unexpected or security-sensitive error occurs, ensuring no exposure of sensitive internal system data such as stack traces, queries, secret keys, and tokens. | V16.5.1 | L1 | LLM accuracy metrics and hallucination rate logged — production monitoring for output quality | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | V1.3.1 | L1 | LLM advisory outputs clearly labelled — users cannot mistake model output for authoritative source | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -599,12 +603,12 @@ treat it as a security boundary.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify sensitive data not cached in cleartext | V8.1.1 | L1 | System prompts not stored in cleartext application configuration or source code |
-| Verify access control enforces least privilege | V4.1.3 | L1 | System prompt access restricted to authorised personnel — read access logged |
-| Verify access control decisions logged | V7.2.1 | L2 | All access to system prompts logged — unauthorised access attempts detectable |
-| Verify secrets not in source code | V14.2.3 | L2 | System prompts not hardcoded in source code — stored in secret management system |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use. | V14.2.2 | L1 | System prompts not stored in cleartext application configuration or source code | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | System prompt access restricted to authorised personnel — read access logged | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all authentication operations are logged, including successful and unsuccessful attempts. Additional metadata, such as the type of authentication or factors used, should also be collected. | V16.3.1 | L2 | All access to system prompts logged — unauthorised access attempts detectable | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource. | V3.6.1 | L2 | System prompts not hardcoded in source code — stored in secret management system | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -656,11 +660,11 @@ and inference of sensitive information from embeddings.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify least privilege access control on data | V4.1.3 | L1 | RBAC on all vector store collections — no unauthenticated access |
-| Verify all sensitive data encrypted at rest | V6.1.1 | L2 | All vector store content encrypted at rest |
-| Verify file upload malware scanning | V12.1.1 | L2 | Content validation on all vector store ingestion — adversarial content detected |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that the application ensures that function-level access is restricted to consumers with explicit permissions. | V8.2.1 | L1 | RBAC on all vector store collections — no unauthenticated access | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. | V14.1.1 | L2 | All vector store content encrypted at rest | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application will only accept files of a size which it can process without causing a loss of performance or a denial of service attack. | V5.2.1 | L2 | Content validation on all vector store ingestion — adversarial content detected | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -724,13 +728,13 @@ reaches a shell, a browser, or a database.
 
 #### ASVS mapping
 
-| Requirement | ID | Level | How it applies |
-|---|---|---|---|
-| Verify output encoding of untrusted data in HTML context | V5.2.1 | L1 | LLM responses rendered in browser contexts encoded against XSS |
-| Verify output encoding in SQL query context | V5.3.5 | L1 | LLM-generated SQL parameterised — never raw LLM output in SQL context |
-| Verify output encoding in OS command context | V5.2.5 | L1 | LLM-generated commands validated — never raw output in shell context |
-| Verify application does not use eval or dynamic code | V5.2.4 | L1 | No eval or dynamic code execution of LLM-generated content |
-| Verify anti-CSRF tokens in state-changing operations | V4.2.2 | L1 | CSRF protection on endpoints where LLM output triggers state changes |
+| Requirement | ID | Level | How it applies | Relationship | Rationale type | Confidence | Framework ver. | Reviewed by |
+|---|---|---|---|---|---|---|---|---|
+| Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well-known and secure HTML sanitization library or framework feature. | V1.3.1 | L1 | LLM responses rendered in browser contexts encoded against XSS | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that data selection or database queries (e.g., SQL, HQL, NoSQL, Cypher) use parameterized queries, ORMs, entity frameworks, or are otherwise protected from SQL Injection and other database injection attacks. This is also relevant when writing stored procedures. | V1.2.4 | L1 | LLM-generated SQL parameterised — never raw LLM output in SQL context | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application protects against template injection attacks by not allowing templates to be built based on untrusted input. Where there is no alternative, any untrusted input being included dynamically during template creation must be sanitized or strictly validated. | V1.3.7 | L1 | LLM-generated commands validated — never raw output in shell context | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that the application avoids the use of eval() or other dynamic code execution features such as Spring Expression Language (SpEL). Where there is no alternative, any user input being included must be sanitized before being executed. | V1.3.2 | L1 | No eval or dynamic code execution of LLM-generated content | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
+| Verify that, if the application does not rely on the CORS preflight mechanism to prevent disallowed cross-origin requests to use sensitive functionality, these requests are validated to ensure they originate from the application itself. This may be done by using and validating anti-forgery tokens or requiring extra HTTP header fields that are not CORS-safelisted request-header fields. This is to defend against browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF). | V3.5.1 | L1 | CSRF protection on endpoints where LLM output triggers state changes | DRAFT | DRAFT | DRAFT | ASVS 5.0.0 | (unreviewed) |
 
 #### Mitigations by tier
 
@@ -821,10 +825,10 @@ reaches a shell, a browser, or a database.
 
 | Phase | LLM entries | ASVS level | Priority requirements |
 |---|---|---|---|
-| 1 — L1 baseline | LLM01, LLM10, LLM03, LLM06 | L1 | V5.1.1, V5.2.1, V4.1.3, V13.1.1 |
-| 2 — L1 complete | LLM02, LLM08 | L1 | V8.1.1, V8.3.4, V4.1.1 |
-| 3 — L2 standard | LLM04, LLM05, LLM09 | L2 | V10.2.1, V10.2.2, V6.1.1, V12.1.1 |
-| 4 — L2 complete | LLM07 | L2 | V11.1.1, V7.2.2 |
+| 1 — L1 baseline | LLM01, LLM10, LLM03, LLM06 | L1 | V15.3.7, V1.3.1, V8.2.1, V1.5.3 |
+| 2 — L1 complete | LLM02, LLM08 | L1 | V14.2.2, V14.1.1, V8.3.1 |
+| 3 — L2 standard | LLM04, LLM05, LLM09 | L2 | V10.2.1, V10.2.2, V14.1.1, V5.2.1 |
+| 4 — L2 complete | LLM07 | L2 | V2.3.1, V16.3.2 |
 | 5 — L3 advanced | All | L3 | Adversarial testing, red team, inversion testing |
 
 ---
diff --git a/scripts/control-ids.js b/scripts/control-ids.js
index d883973..b68b6ac 100644
--- a/scripts/control-ids.js
+++ b/scripts/control-ids.js
@@ -63,6 +63,13 @@ const GRAMMARS = {
     // the em dash should be.
     re: /\b([A-Z]{3})\b(?=\s*[^\sA-Za-z0-9])/,
   },
+  'OWASP ASVS 4.0.3': {
+    // Requirement ids are V<chapter>.<section>.<requirement>; the chapter alone
+    // (V8) is the parent, and some tables put the chapter in its own column.
+    re: /\b(V\d{1,2}\.\d{1,2}\.\d{1,2})\b/,
+    parentRe: /\b(V\d{1,2})\b(?!\.)/,
+    parent: (m) => m[1],
+  },
   'ISO/IEC 42001:2023': {
     // Annex A controls, Annex B guidance, and management-system clauses.
     re: /\b([AB]\.\d{1,2}(?:\.\d{1,2}){0,2})\b|\bCl(?:ause)?\.?\s*(\d{1,2}(?:\.\d{1,2}){0,2})\b/,
@@ -157,6 +164,7 @@ const ID_SHAPES = {
   'CWE/CVE': /^(?:CWE-\d{1,4}|CVE-\d{4}-\d{4,7})$/,
   'OWASP AI Testing Guide': /^[A-Z]{3}$/,
   'ISO/IEC 42001:2023': /^(?:[AB]\.\d{1,2}(?:\.\d{1,2}){0,2}|\d{1,2}(?:\.\d{1,2}){0,2})$/,
+  'OWASP ASVS 4.0.3': /^V\d{1,2}\.\d{1,2}\.\d{1,2}$/,
 };
 
 /**
@@ -167,6 +175,9 @@ const ID_SHAPES = {
  */
 const REGISTRY_EXTRA_SHAPES = {
   'CIS Controls v8.1': /^CIS-\d{1,2}$/,
+  // ASVS registries carry the chapters (V8) beside the requirements (V8.1.1).
+  // chapters (V8) and sections (V8.1) sit in the registry beside requirements
+  'OWASP ASVS 4.0.3': /^V\d{1,2}(\.\d{1,2})?$/,
 };
 
 /** True when `id` is well-formed for `framework` in a registry file. */