Invariant-based anomaly detection in the Policy Information Point (PIP)

Research Question

How can the Policy Information Point (PIP) detect when a governed asset's transient operating context is being used, intentionally or through task creep, to suppress or obscure a permanent invariant, and what decision signal should the PIP surface to the Policy Decision Point (PDP) when that suppression pattern is detected?

Findings

(Populated from §6 Synthesis above.)

Executive Summary

• The PIP should combine deterministic contradiction checks with a Bayesian-style surprise layer over the mismatch between permanent invariant metadata and transient task signals, then surface a typed anomaly object to the PDP instead of trying to resolve the policy conflict itself.
• The decisive distinction is between passive suppression, where framing and requested actions agree that invariants are not in play, and active or adversarial suppression, where the requested actions would touch invariant-bearing resources despite framing that says otherwise.
• Cynefin task-complexity declarations should modify the prior because high-invariant assets declaring Clear routine work while requesting broad access or state-changing tools are lower-probability combinations than comparable tasks declared as Complicated or Complex.
• A practical PIP output should therefore carry signal_type, confidence_score, surprise_score, implicated invariants, contradictory observations, provenance, and a recommended routing path so that monitoring, audit review, and remediation remain explainable and proportionate.

Key Findings

1. High confidence. The PIP is the correct runtime detection surface because it already synthesises the attribute values that connect Layer 3 Asset Metadata to Layer 8 Task Intent before the PDP evaluates policy.
2. High confidence. Invariant-shadowing should be typed into passive, active, and adversarial classes, because the operational response depends on whether the framing-to-action mismatch is absent, accidental, or linked to hostile context substitution.
3. Medium confidence. Bayesian surprise provides a principled ranking layer above deterministic contradiction rules, because it measures how strongly an observed task tuple shifts legitimacy beliefs for that invariant-bearing asset.
4. Medium confidence. Cynefin domain declarations should be treated as probabilistic context features, with Clear declarations lowering the expected probability of broad access or state change for high-invariant assets and Chaotic declarations increasing review pressure rather than relaxing control.
5. High confidence. Prompt injection should be modelled inside the PIP as hostile context substitution, and not merely as suspicious text, because the security-relevant event is the attempt to make transient input outrank registered invariant metadata.
6. Medium confidence. A practical PIP-to-PDP signal should be a typed and explainable anomaly object carrying score, confidence, implicated invariants, provenance, and recommended routing so that monitoring and audit review remain actionable.
7. Medium confidence. The anomaly object becomes materially stronger when it also carries lifecycle policy-version and machine-identity context, because adjacent governance failures can otherwise masquerade as task-framing anomalies.

Assumptions

• The PAP or asset-registration process produces enough invariant-class structure to seed priors for newly created assets. Justification: a surprise score needs a baseline, and new assets otherwise lack historical usage.
• Requested tools and data scopes are visible to the PIP before the PDP renders a final decision. Justification: active suppression cannot be detected if the PIP only sees the free-form prompt and not the planned operations.
• The calling context provides either an explicit Cynefin-style task declaration or enough structured metadata for the platform to infer one. Justification: the Cynefin-by-invariant matrix cannot influence priors without a complexity signal.

Analysis

• Deterministic contradiction rules are still needed to catch direct mismatches between framing and requested actions, while Bayesian surprise provides a ranking layer for borderline or context-dependent cases by measuring belief shift against prior expectations.
• OWASP and the prior prompt-injection item justify treating provenance and hostile override patterns as score multipliers, but they do not justify equating every suspicious string with active suppression, so action mismatch remains the decisive discriminator.
• The Cynefin framework helps because it changes what "normal" looks like for the task, but it remains a contextual prior rather than direct proof, so its contribution is medium-confidence and subordinate to invariant-action contradiction.
• NIST monitoring controls tilt the design toward typed, explainable routing objects rather than hidden scores, because anomaly detection that cannot be reviewed, correlated, or reported cleanly would fail the stated monitoring purpose.
• Adjacent PBAC items sharpen the trade-off: low-risk assets need low-friction monitoring, while high-invariant assets need higher-confidence escalation paths, so the signal must remain typed and proportional rather than binary.

Risks, Gaps, and Uncertainties

• The surprise formula is well founded conceptually, but this item does not establish production calibration thresholds for specific invariant classes, so implementation still needs empirical tuning.
• Cynefin declarations are partly behavioural and can be gamed or misclassified, so they should influence priors but should not be treated as authoritative evidence on their own.
• Prompt injection remains a partly unsolved prevention problem, so adversarial suppression detection will necessarily produce some false positives and false negatives.
• If tool plans are assembled late or outside the PIP's visibility boundary, active suppression may only be partially detectable at the point this item targets.

Open Questions

• How should invariant-class priors be learned and refreshed without letting manipulated traffic poison the baseline?
• What is the minimum structured tool-plan representation the PIP must receive to detect active suppression before execution begins?
• How should policy-version drift and suppression anomalies be jointly handled when both appear in the same request path?
• Which invariant classes deserve hard fail-closed thresholds versus step-up review thresholds?
• How should multimodal prompt injection alter the provenance-risk term for assets that ingest images, audio, or Portable Document Format (PDF) documents?

sources

• [x] Aligned Decision-Making 8-layer context architecture - completed item — - Layer 3 (Asset Metadata) and Layer 8 (Task Intent) that the PIP must synthesise
• [x] Formal intent specification and reward hacking - completed item — - structural root shared by intent mismatch and reward hacking; PIP detection as the runtime manifestation
• [x] Prompt injection threat landscape - completed item — - primary adversarial mechanism for transient context substitution
• [x] Failure mode taxonomy expansion - completed item — - suppression pattern classified as intent-alignment failure; PIP signal must be typed accordingly
• [x] Neurological context management - completed item — - prior-weighted relevance filtering as the architectural analogue for PIP anomaly detection
• [x] Cynefin framework - Snowden and Boone original article — - mainstream reference for the framework
• [x] The Cynefin Co overview of the Cynefin framework — - accessible domain definitions and response logics
• [x] Bayesian inference background — - seed background reference checked during investigation
• [x] Itti and Baldi, Bayesian Surprise Attracts Human Attention — - formal basis for surprise as posterior-vs-prior belief shift
• [x] National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 5 landing page — - control-catalog anchor
• [x] NIST SP 800-53 control extract, SI-4 (System Monitoring) — - monitoring, anomaly analysis, and alerting requirements
• [x] NIST SP 800-53 control extract, AU-6 (Audit Record Review, Analysis, and Reporting) — - review, correlation, reporting, and risk-adjusted audit analysis
• [x] eXtensible Access Control Markup Language (XACML) 3.0 core specification — - authoritative definitions of the Policy Administration Point (PAP), Policy Decision Point (PDP), Policy Enforcement Point (PEP), and Policy Information Point (PIP)
• [x] Open Worldwide Application Security Project (OWASP) Top 10 for Large Language Model (LLM) Applications — - project overview and LLM01 linkage
• [x] Open Worldwide Application Security Project (OWASP) LLM01 Prompt Injection — - prompt injection characterisation for PIP detection design
• [x] PAP dynamic policy profiling and proportionality - completed item — - adjacent Policy-Based Access Control (PBAC) control-topology derivation
• [x] Universal policy synchronisation and integrity - completed item — - adjacent lifecycle policy-integrity surface
• [x] Access control amplification under agentic operations - completed item — - operational blast-radius consequence when invariant checks are suppressed
• [x] Artificial Intelligence (AI) agent identity and access management - completed item — - machine-identity and bounded-delegation implications for routing