{ "schemaVersion": "1.0", "language": "en", "id": "safety-resilience", "name": "Safety & Resilience", "description": "Attacks, incidents, recovery, and business continuity.", "alternateNames": [ "安全性・レジリエンス", "AI security", "Access control", "Crisis Response", "Business Continuity", "AI Security", "Resilience", "Prompt injection", "AI Incident", "Recurrence Prevention" ], "canonicalUrl": "https://catalysphere.co.jp/en/topics/safety-resilience/", "machineReadableUrl": "https://catalysphere.co.jp/en/topics/safety-resilience/index.json", "updatedAt": "2026-10-01", "articles": [ { "slug": "ai-agent-delegated-authorization", "title": "Reusing a Human Login Cannot Govern an Agent's Authority", "summary": "Instead of reusing a human session, separate the principal from the agent and evaluate a delegation that binds resource, action, audience and lifetime at execution time.", "quickAnswer": { "what": "A raw human session or indistinguishable broad bearer credential cannot support separate attribution, attenuation and agent-only revocation.[1][4]", "why": "Separate authorization from authentication by evaluating principal, workload, resource, action, audience, conditions and expiry at the execution boundary.[2][3][5]", "action": "Before production, test denial, expiry, changed requests, replay and revocation; narrow automation when the agent cannot be suspended independently." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/ai-agent-delegated-authorization/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/ai-agent-delegated-authorization/index.json" }, { "slug": "warning-fatigue-ai-controls", "title": "Increasing the number of warnings does not necessarily increase safety.", "summary": "Given habituation to repeated warnings, false alarms, and ignoring due to irrelevant notifications, design a warning budget by risk, display variations, and mandatory stops.", "quickAnswer": { "what": "Repetition of the same warning reduces attention and response, and adding more does not necessarily increase safety.", "why": "Frequent, irrelevant warnings and false alarms can lead to ignoring, delay, or opting out.", "action": "Allocate warnings by risk for suppression, aggregation, variation, and mandatory stops, and measure appropriate avoidance actions." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/warning-fatigue-ai-controls/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/warning-fatigue-ai-controls/index.json" }, { "slug": "cognitive-offloading-ai", "title": "Even if you entrust your thinking to AI, can you return to it on your own?", "summary": "We distinguish between load reduction via external memory and the reduction of internal encoding and retrieval, measuring both the performance when AI is usable and the independent execution when it is not.", "quickAnswer": { "what": "There are conditions under which external information storage reduces the immediate load and facilitates subsequent tasks.", "why": "High performance when external resources are available and retrieval and execution when they are not are distinct outcomes.", "action": "We separate the information that may be externalized, the principles for judging what to retain internally, reconstruction exercises, and recovery conditions." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/cognitive-offloading-ai/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/cognitive-offloading-ai/index.json" }, { "slug": "rag-poisoning-defense", "title": "The knowledge base of RAG becomes a searchable attack surface.", "summary": "We mitigate the risk of malicious documents entering the top search results and guiding answers through write history, index monitoring, contradiction detection, post-generation verification, and isolation with re-indexing.", "quickAnswer": { "what": "RAG using external evidence creates an attack surface where a small number of malicious documents are prioritized in search for specific questions.", "why": "We control write permissions, history, search results, and answer verification separately, rather than relying solely on safety instructions to the model.", "action": "After discovering contamination, we do not merely delete the document but reconstruct the index, track affected answers, and issue corrections." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/rag-poisoning-defense/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/rag-poisoning-defense/index.json" }, { "slug": "ai-code-security-review", "title": "Code written by AI must be reviewed for speed and safety separately.", "summary": "Do not equate the productivity of generated code with safety; instead, treat vulnerabilities, user safety perception, static and dynamic testing, and independent review as gates for adopting high-impact code.", "quickAnswer": { "what": "Even if code generation is fast, it does not necessarily mean fewer vulnerabilities, and outcomes depend on the issues addressed and the selection of proposals.", "why": "The user's perception of safety and the actual reduction of vulnerabilities through testing are distinct metrics.", "action": "For authentication, cryptography, input processing, and similar areas, require records of the generation source, dedicated testing, and independent review as adoption conditions." }, "updatedAt": "2026-07-24", "url": "https://catalysphere.co.jp/en/articles/ai-code-security-review/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/ai-code-security-review/index.json" }, { "slug": "prompt-injection-enterprise-controls", "title": "Prompt-injection defense starts with permission boundaries, not instruction detection", "summary": "Filtering suspicious text alone cannot protect AI that reads external data and executes tools; we organize multi-layered defense through attack evaluation, structured input, and official classification.", "quickAnswer": { "what": "Prompt injection cannot be resolved by textual warnings alone; it must be prevented at system boundaries encompassing permissions and data flows.", "why": "This is because models cannot fully separate trusted commands from commands within external data, and when tool permissions are present, erroneous following can lead to actual operations.", "action": "We layer separation of commands and data, least privilege, permitted operations, pre-execution confirmation, adaptive attack testing, and audit logs." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/prompt-injection-enterprise-controls/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/prompt-injection-enterprise-controls/index.json" }, { "slug": "ai-vendor-evaluation-exit", "title": "AI vendor selection must test the ability to resume operations after exit", "summary": "We organize vendor evaluations that test data, model dependency, contracts, portability, and stoppage/alternatives before implementation, rather than selecting based solely on accuracy demos.", "quickAnswer": { "what": "In AI vendor evaluations, selection criteria should include not only current quality but also visibility of components, change notifications, data return, migration to alternative models, and deletion after termination. [1] [2]", "why": "NIST organizes generative AI risks into 12 groups, explicitly listing third-party component dependency, decommissioning, fallback, and contract terms as management targets. [2]", "action": "Before the PoC contract, conduct an exit exercise by actually exporting sample data, re-running it with alternatives, and measuring recovery time, quality differences, and lost functionality. [3]" }, "updatedAt": "2026-07-24", "url": "https://catalysphere.co.jp/en/articles/ai-vendor-evaluation-exit/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/ai-vendor-evaluation-exit/index.json" }, { "slug": "ai-incident-response", "title": "AI incident response does not end with system recovery", "summary": "We outline an incident design that connects damage assessment, causality, evidence of versions/data/decisions, external reporting, and recurrence prevention, rather than ending with model suspension alone.", "quickAnswer": { "what": "In AI incidents, one must simultaneously handle the restoration of availability, the affected people/rights/environment, the relationship between the model and the incident, and evidence of inputs/outputs/human decisions. [1] [2]", "why": "The OECD’s common reporting framework presents 29 criteria, while the EU AI Act sets deadlines such as 15 days in principle for covered serious incidents. [2] [3]", "action": "During peacetime, determine severity, suspension authority, evidence preservation, notification recipients, alternative operations, and resumption conditions, updating them through tabletop exercises and post-incident reviews." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/ai-incident-response/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/ai-incident-response/index.json" }, { "slug": "ai-reliance-organizational-risk", "title": "What Is Lost in Organizations That Rely Too Heavily on AI", "summary": "Proper support helps; flawed support amplifies errors. Drawing on research into automation bias and critical thinking, we consider how to build organizations that can question, stop, and revert.", "quickAnswer": { "what": "Monitor erroneous acceptance and possible weakening of verification, learning, and dissent. These studies do not establish long-term loss of independent ability.", "why": "Fluent proposals can induce trust regardless of accuracy, and scenes have been observed where verification efforts decrease.", "action": "Differentiate the strength of verification by failure impact and reversibility, embedding records, dual confirmation, stop authority, and fallback procedures into operations." }, "updatedAt": "2026-10-01", "url": "https://catalysphere.co.jp/en/articles/ai-reliance-organizational-risk/", "machineReadableUrl": "https://catalysphere.co.jp/en/articles/ai-reliance-organizational-risk/index.json" } ] }