Security engineering

Can Kotoba support a NIST CSF 2.0 program?

Kotoba can contribute technical controls to a cybersecurity program. We do not claim complete NIST CSF 2.0 coverage, certification, or immunity from attacks. NIST does not certify CSF products. The useful question is which attack step a deployed control stops, and what evidence supports that claim.

Reviewed on 2026-09-09. Translations are machine-assisted; native-language review is not certified. Source evidence and the detailed threat model are available in English. This article is a scoped assessment, not a penetration test.

Three products, separate responsibilities

Kotoba declares effects and checks capability boundaries. Its guarded host-call kernel intersects requested resources, grants and local policy before invoking a handler. The provider must still enforce concrete paths, destinations and tenant scope.

Kotoba Cloud provides a client and organization-facing workflow. Its inspected public profile has hostedApply=false: a generic production-change approval service is not shipped by that setting. Specific library publication and key-rotation paths must be assessed separately. Authentication is not approval to deploy or spend.

Kotobase supplies data and object services with server-side authorization paths. A CID identifies bytes; it does not by itself prove their author, confidentiality, trusted approval, permanent availability or successful recovery. Those require separate controls and operating evidence.

A bounded current-to-target CSF profile

This is our selected product contribution map, not a complete organizational Profile or a percentage-compliant score. Customers must define scope, owners, risk tolerance and evidence for their own deployment.

Govern: Policy and risk registers provide a design baseline. Target: named decision owners, reviewed exceptions and recorded release sign-off.
Identify: Manifests and content identities help track artifacts. Target: a deployed asset inventory, data classification and dependency ownership.
Protect: Capability admission and guarded dispatch have implementation and local-test evidence. Target: qualified production bindings, scoped secrets, tenant tests and measured revocation.
Detect: The host can return denial and execution receipts. Target: a durable protected sink, correlated alerts, retention and demonstrated delivery to an accountable responder.
Respond: Response playbooks are documented. Target: exercised containment and communication, with measured response and revocation times.
Recover: Content identities support verification of restoration inputs. Target: protected backups, tested restores and customer-specific recovery objectives. A content hash is not a backup.

Attack graph: instructions do not grant authority

Assume an attacker controls text read by an AI agent, but not the host, signing keys or policy. The attacker tries to turn a suggestion into a customer-data export. The graph shows required control crossings; it is not an observed compromise or a claim that every deployed integration enforces them.

Untrusted document or tool response
AI proposes a sensitive operation
Effect and capability admission
Resource-scoped host and provider check

Authorized operation and recorded outcome
Denied operation; handler is not invoked

The denial branch requires an effective guard and a grant that excludes the target. If an operator grants broad export authority, harmful text may still induce an allowed action. Add narrow destinations, data classification, approval bound to the exact operation and independent host isolation.

Attack stories and the evidence they need

Prompt injection to data export

Attacker-controlled content asks an agent to send customer data outside its approved destination. In a guarded path, a missing effect or disjoint resource grant should stop dispatch. Verify the handler was never called. Residual risk: overbroad grants, provider redirects and a bypassing integration.

One tenant requests another tenant data

An authenticated caller supplies a different graph or resource identifier. Server-side checks must bind principal, tenant, operation and object on every route. Browser menus and a CID are not authorization. Inspect each endpoint and test denied reads and writes; no fleet-wide isolation claim follows from one kernel test.

An artifact changes after approval

A publisher or intermediary substitutes bytes. Require the expected content digest, trusted signer, validity and approval for the exact revision before use. A valid signature on malicious code remains possible; trusted signing and artifact identity are necessary but not sufficient.

A stale approval or revoked grant is reused

A caller retries a previously authorized action. Expiry checks help, but durable replay state, atomic consumption where required, current revocation and resource binding are separate duties. A generic host receipt is not a replay-prevention service.

Resource exhaustion and service disruption

An input or generated program consumes excessive work. Admission bounds, execution fuel, memory limits and supervisor deadlines address different stages. Test the actual production backend under load; a passing language fixture does not prove resistance to network flooding or host compromise.

Evidence loss during an incident

A service fails after an external action, or an attacker tampers with local logs. The host kernel can return receipts, but its recorder is optional and its journal is in memory. Deploy a durable protected recorder with failure handling and test recovery. A successful operation is not proof that an external audit log persisted.

What we verified, and what remains open

At the cited language revision, all 24 capability conformance fixtures passed locally under ClojureScript, including 9 component-binding and 2 host-dispatch cases. Expected allow and deny outcomes were checked. This is kernel evidence, not an end-to-end attack test of the live services.

The inspected assurance register remains operationally not qualified. Its stored crosswalk reports design and implementation evidence but no operating evidence for its encoded SOC and ISO controls. That is a statement about this snapshot, not a finding that every production control is absent.

Before an enterprise pilot, bind proposal, principal, environment, exact artifact and policy to a narrowly scoped operation. Exercise allowed and denied cases, concurrent replay, revocation, log failure and restore. Measure unauthorized effects reaching a handler, missing receipts, revocation delay and recovery time. Publish the tested scope and remaining gaps.