# The research lineage behind 5D 5D began as a deterministic safety boundary for a sovereign agentic system, then developed into five inspectable action-risk dimensions informed by security research and governance frameworks. - Canonical: https://5d.langoni.me/evidence/research-lineage/ - Evidence strength: Author analysis - Evidence form: Framework mapping - Version: 1.0.0 - Author: Loren Angoni; 5D developer and product owner - Created: 2026-10-05 - Updated: 2026-10-05 - Verified: 2026-10-05 ## Scope A first-person project-origin account and a source map showing how recurring security and governance concerns support each DTREA dimension. ## It started as an autonomy-versus-security problem 5D started while I was building my own sovereign agentic system: an agent that could research online, interact with other agents and internet sources, and independently take useful actions for me. The more authority I considered giving it, the more concrete the threat model became. Retrieved content could carry prompt injection. A compromised or misled model could invoke privileged commands, move sensitive information, or trigger an irreversible external effect. The question was not simply whether the agent was capable of completing a task. It was how much the agent should be allowed to do on its own, and when the proposed action became too risky to execute without policy or human review. I needed an enforcement boundary that remained outside the model and under the operator's control. ## From a lightweight evaluator to a policy gate The first version was a small deterministic evaluator placed before execution. For the same normalized action, policy, configuration, code version, and relevant state, it produced the same action-risk result. That made the decision inspectable and testable in a way that another probabilistic prompt could not. At the time, I could not find an open-source per-action gate that matched the boundary and sovereignty requirements I needed, so I kept developing the approach. The useful pattern was not determinism instead of probabilistic AI. It was a composition: the agent could interpret and propose, while deterministic policy retained execution authority and unresolved cases could remain held for review. ## Research lineage The five dimensions emerged from a practical question: what makes an AI agent action dangerous at the instant before execution? Work on sensitive-data exposure, excessive tool authority, irreversible change, external consequence, and unattended autonomy repeatedly returned the same five pressures. OWASP's agentic-security work supplies concrete failure and attack patterns. NIST AI RMF supplies lifecycle and impact discipline. The EU AI Act supplies oversight, traceability, and foreseeable-risk context. MITRE ATLAS supplies adversarial scenarios for testing. DTREA turns that wider research landscape into five inspectable action-level questions. The composition is 5D's synthesis, not a score defined or endorsed by any external framework. ## Claim register ### Data Sensitivity Evidence strength: Author analysis Evidence form: Framework mapping Evidence: owasp-sensitive-disclosure, nist-ai-rmf, eu-ai-act Inspects how the proposed action can read, expose, move, transform, or retain information whose sensitivity changes the consequence of execution. Limit: The sources support examining data exposure and impact; they do not define 5D's scale or score. ### Tool Privilege Evidence strength: Author analysis Evidence form: Framework mapping Evidence: owasp-agentic, owasp-excessive-agency Inspects the effective functionality, permissions, credentials, and reach of the tool selected for the action. Limit: This supports least-privilege evaluation before execution; it is not an OWASP certification or implementation guarantee. ### Reversibility Evidence strength: Author analysis Evidence form: Framework mapping Evidence: fivedrisk-origin, nist-ai-rmf, eu-ai-act Distinguishes recoverable local operations from transfers, deletions, messages, and other effects that are costly or impossible to undo. Limit: Reversibility is a 5D design synthesis. The cited frameworks support intervention and consequence management but do not publish it as a DTREA dimension. ### External Impact Evidence strength: Author analysis Evidence form: Framework mapping Evidence: nist-ai-rmf, eu-ai-act, mitre-atlas Inspects potential effects on people, rights, money, infrastructure, or systems beyond the agent's immediate process boundary. Limit: These sources provide impact and adversarial anchors; one action score does not establish compliance or system safety. ### Autonomy Context Evidence strength: Author analysis Evidence form: Framework mapping Evidence: owasp-excessive-agency, nist-ai-rmf, eu-ai-act Inspects how far the proposed action is from current human direction, review, and control at the moment of execution. Limit: This supports policy sensitivity to operating context; it is not a universal autonomy scale or calibrated probability. ## Limits - The founder narrative records the developer's reason for building 5D. It is not independent historical validation and does not establish market priority. - The statement that no suitable open-source gate was found describes the developer's search and requirements; it is not a claim that no adjacent or comparable tool existed. - OWASP, NIST, MITRE, and the EU AI Act did not derive, certify, approve, or endorse DTREA or its composition. - A DTREA score is not a calibrated probability of safety, model confidence, compliance score, or complete system-level risk assessment. - The five dimensions do not remove the need for authenticated identity, execution-path coverage, recovery, monitoring, and wider organisational controls. ## Sources - [Initial public fivedrisk repository history](https://github.com/theDoc001/fivedrisk/tree/b826a6b79c2bd588bad004b228c832b53ce72c87); immutable-public-source; commit b826a6b79c2bd588bad004b228c832b53ce72c87, 2026-04-15; verified 2026-10-05 - [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/); primary-authority; 2026 edition; verified 2026-10-05 - [OWASP Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/); primary-authority; LLM06:2025; verified 2026-10-05 - [OWASP Sensitive Information Disclosure](https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/); primary-authority; LLM02:2025, description, access-control, and data-sanitisation sections; verified 2026-10-06 - [NIST AI Risk Management Framework 1.0](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10); primary-authority; AI RMF 1.0, Govern 3.2; Measure 2.1, 2.3, 2.6, 2.7, 2.10; Manage 1 and 2; verified 2026-10-06 - [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689); primary-authority; Official Journal text, Articles 9, 10, 12, 14, and 15; verified 2026-10-06 - [MITRE ATLAS](https://atlas.mitre.org/); primary-authority; Public knowledge base, LLM Prompt Injection and Exfiltration via AI Agent Tool Invocation; verified 2026-10-06 --- Illustrative website evidence only. No certification, legal conclusion, production integration, or complete coverage is represented.