Add AISVS 1.0 mappings

Hi!

Attached files have two alternative proposals of adding AISVS mappings to OpenCRE. This took longer than expected and for the same reason there are now several attachments.

At this point I have been looking at these too long and would appreciate maintainers second pair of eyes having a look at the proposals.

Attachment contents

Conventions

Modelled after ASVS entries in OpenCRE:

• OWASP AISVS|name has the full requirement sentence (same way ASVS uses section).
• OWASP AISVS|id has the native requirement ID, for example 1.1.1.
• OWASP AISVS|hyperlink is a section-level link into the chapter file. AISVS has no per-requirement anchors, same limitation as ASVS.
• OWASP AISVS|description has the AISVS level and my rough confidence rating, plus a forced: <rating> suffix on rows where the mapping was a substitute for reviewers to focus on where I wasn't that sure.

The 6 proposed new CREs

All six are in the agentic-chapters (C9/C10) that postdate most standards currently in OpenCRE. Forcing any of these into an existing CRE creates just noise for users of CREs.

FORCED-MAPPING-RATIONALE-v2.md walks through each, but the short version is: least privilege does not express reversibility, privacy consent does not express canonicalised action parameters, an SDLC audit trail does not express cryptographic binding of a runtime chain, and OAuth revocation does not express confused-deputy prevention.

Deferred proposals

Following AISVS controls I decided to now intentionally force-fit rather than propose new CREs. Maintainer input is welcome on the deferred four.

One of these (5.3.2 → 515-021 network isolation) is still a wrong forced fit: network isolation cannot stop GPU-memory side channels. I am flagging it here because withdrawing the proposal is a scoping decision, not a claim that the gap disappears. If a later CREs adds compute-isolation coverage, that mapping could be added.

new_cre_proposals_v2.csv
forced_mapping_v2.csv
MAPPING-READABLE-v2.md
FORCED-MAPPING-RATIONALE-v2.md
AISVS-1.0-OpenCRE-mapping-v2-FORCED.xls
AISVS-1.0-OpenCRE-mapping-v2-FORCED.csv
AISVS-1.0-OpenCRE-mapping-v2-CONSOLIDATED.xls
AISVS-1.0-OpenCRE-mapping-v2-CONSOLIDATED.csv

Start by reviewing MAPPING-READABLE-v2.md, new_cre_proposals_v2.csv, and FORCED-MAPPING-RATIONALE-v2.md alongside the existing ASVS mappings in OpenCRE. Compare the proposed AISVS mappings and six new CREs with current conventions, then seek maintainer decisions on which proposals and forced mappings are accepted. Done means the reviewed mapping data and any approved CRE additions are ready to incorporate.