# Risk register with an LLM-risk mapping · Library staff assistant

*Specimen: real structure, dummy content. The product and every risk on this page are invented to show
how the register and its mapping are filled in. † marks a dummy value.*

**Header block:** product · *Library staff assistant* · version 0.9 · 2026-04-21 · owner: product
manager · reviewed by: information-governance lead · status: **reviewed**

## 1 · Risk register
| ID | Risk | Likelihood | Impact | Decision | Mitigation or reason | Owner (role) | Review by |
|---|---|---|---|---|---|---|---|
| R-01 | An answer cites a section from a superseded handbook version | Medium | High | **Mitigate** | Index holds the current version only; version shown on every answer; eval case set E-CIT | Product manager | Phase 3 |
| R-02 | A handbook passage carries text that steers the model ("ignore the above…") | Low | Medium | **Mitigate** | Passages are data, never instructions; fixed control flow; injection cases in E-REF | Tech lead | Phase 4 |
| R-03 | Patron personal data reaches the index | Medium | High | **Decline** | Out of scope by binding non-goal (PRD §2); field scan on every re-index (NFR-6) | Product manager | Each re-index |
| R-04 | Staff rely on an answer the handbook does not support | Medium | High | **Mitigate** | Abstention floor ≥ 95 %† (NFR-3); answer must cite or abstain | Product manager | Every gate run |
| R-05 | The prompt with internal routing notes is shown to a user | Low | Low | **Accept** | Nothing secret in the prompt; accepted with that reason | Tech lead | Annually |
| R-06 | A model or library update changes behaviour silently | Medium | Medium | **Mitigate** | Versions pinned; gate re-run before any upgrade | Tech lead | Each upgrade |
| R-07 | Query volume at opening time raises cost past budget | Low | Medium | **Mitigate** | Rate limit per sign-in; monthly cost cap of ₹ 20,000† | Operations lead | Monthly |
| R-08 | Staff paste a patron's details into a question | Medium | High | **Mitigate** | Refusal cases E-REF; question logs scrubbed of patterns that look like card numbers | Information-governance lead | Phase 4 |

## 2 · LLM-risk mapping
*Each LLM-specific risk is tagged with its OWASP category (the 2025 edition of the list, now archived; the 2026 edition renumbers some categories) and its NIST AI RMF function. The coverage
table that follows lists every OWASP category, so a gap shows as a row with no entry.*

| Risk | OWASP Top 10 for LLM Applications | NIST AI RMF function |
|---|---|---|
| R-01 | LLM09 Misinformation | Measure |
| R-02 | LLM01 Prompt Injection | Manage |
| R-03 | LLM02 Sensitive Information Disclosure | Govern |
| R-04 | LLM09 Misinformation | Measure |
| R-05 | LLM07 System Prompt Leakage | Manage |
| R-06 | LLM03 Supply Chain | Govern |
| R-07 | LLM10 Unbounded Consumption | Manage |
| R-08 | LLM02 Sensitive Information Disclosure | Map |

## 3 · Coverage: which category has no entry?
| OWASP category | Entries | Status |
|---|---|---|
| LLM01 Prompt Injection | R-02 | Covered |
| LLM02 Sensitive Information Disclosure | R-03, R-08 | Covered |
| LLM03 Supply Chain | R-06 | Covered |
| LLM04 Data and Model Poisoning | — | **No entry.** Reason recorded: the corpus is the handbook, published by the policy team only; reopen if any other source is indexed |
| LLM05 Improper Output Handling | — | **No entry. Open:** answers are rendered as text; check whether the citation link is escaped. Owner: tech lead, by Phase 4 |
| LLM06 Excessive Agency | — | **No entry.** Reason recorded: the assistant has no tools and writes nothing (PRD §2) |
| LLM07 System Prompt Leakage | R-05 | Covered (accepted) |
| LLM08 Vector and Embedding Weaknesses | — | **No entry. Open:** access control on the vector store not yet reviewed. Owner: tech lead, by Phase 4 |
| LLM09 Misinformation | R-01, R-04 | Covered |
| LLM10 Unbounded Consumption | R-07 | Covered |

| NIST AI RMF function | Entries |
|---|---|
| Govern | R-03, R-06 |
| Map | R-08 |
| Measure | R-01, R-04 |
| Manage | R-02, R-05, R-07 |

---
*What is real here: a register of risks kept apart from the mapping, a decision per risk (accept,
mitigate or decline, each with its reason), and a coverage table that lists every category so an empty
one is visible. Everything inside the tables is invented.*