Risk register with an LLM-risk mapping · Library staff assistant
Specimen. Real structure, dummy content: a fictional city-library staff assistant. Every name, date and number is invented and marked †. None is taken from a real project.
The decision it makes: Which risks are accepted, mitigated or declined, and which published risk category each LLM-specific risk belongs to.
Download the MarkdownSpecimen_LLM_Risk_Mapping.md · 4.3 KB · described on The artefact set §3
Specimen: real structure, dummy content. The product and every risk on this page are invented to show how the register and its mapping are filled in. † marks a dummy value.
Header block: product · Library staff assistant · version 0.9 · 2026-04-21 · owner: product manager · reviewed by: information-governance lead · status: reviewed
1 · Risk register
| ID | Risk | Likelihood | Impact | Decision | Mitigation or reason | Owner (role) | Review by |
|---|---|---|---|---|---|---|---|
| R-01 | An answer cites a section from a superseded handbook version | Medium | High | Mitigate | Index holds the current version only; version shown on every answer; eval case set E-CIT | Product manager | Phase 3 |
| R-02 | A handbook passage carries text that steers the model ("ignore the above…") | Low | Medium | Mitigate | Passages are data, never instructions; fixed control flow; injection cases in E-REF | Tech lead | Phase 4 |
| R-03 | Patron personal data reaches the index | Medium | High | Decline | Out of scope by binding non-goal (PRD §2); field scan on every re-index (NFR-6) | Product manager | Each re-index |
| R-04 | Staff rely on an answer the handbook does not support | Medium | High | Mitigate | Abstention floor ≥ 95 %† (NFR-3); answer must cite or abstain | Product manager | Every gate run |
| R-05 | The prompt with internal routing notes is shown to a user | Low | Low | Accept | Nothing secret in the prompt; accepted with that reason | Tech lead | Annually |
| R-06 | A model or library update changes behaviour silently | Medium | Medium | Mitigate | Versions pinned; gate re-run before any upgrade | Tech lead | Each upgrade |
| R-07 | Query volume at opening time raises cost past budget | Low | Medium | Mitigate | Rate limit per sign-in; monthly cost cap of ₹ 20,000† | Operations lead | Monthly |
| R-08 | Staff paste a patron's details into a question | Medium | High | Mitigate | Refusal cases E-REF; question logs scrubbed of patterns that look like card numbers | Information-governance lead | Phase 4 |
2 · LLM-risk mapping
Each LLM-specific risk is tagged with its OWASP category (the 2025 edition of the list, now archived; the 2026 edition renumbers some categories) and its NIST AI RMF function. The coverage table that follows lists every OWASP category, so a gap shows as a row with no entry.
| Risk | OWASP Top 10 for LLM Applications | NIST AI RMF function |
|---|---|---|
| R-01 | LLM09 Misinformation | Measure |
| R-02 | LLM01 Prompt Injection | Manage |
| R-03 | LLM02 Sensitive Information Disclosure | Govern |
| R-04 | LLM09 Misinformation | Measure |
| R-05 | LLM07 System Prompt Leakage | Manage |
| R-06 | LLM03 Supply Chain | Govern |
| R-07 | LLM10 Unbounded Consumption | Manage |
| R-08 | LLM02 Sensitive Information Disclosure | Map |
3 · Coverage: which category has no entry?
| OWASP category | Entries | Status |
|---|---|---|
| LLM01 Prompt Injection | R-02 | Covered |
| LLM02 Sensitive Information Disclosure | R-03, R-08 | Covered |
| LLM03 Supply Chain | R-06 | Covered |
| LLM04 Data and Model Poisoning | — | No entry. Reason recorded: the corpus is the handbook, published by the policy team only; reopen if any other source is indexed |
| LLM05 Improper Output Handling | — | No entry. Open: answers are rendered as text; check whether the citation link is escaped. Owner: tech lead, by Phase 4 |
| LLM06 Excessive Agency | — | No entry. Reason recorded: the assistant has no tools and writes nothing (PRD §2) |
| LLM07 System Prompt Leakage | R-05 | Covered (accepted) |
| LLM08 Vector and Embedding Weaknesses | — | No entry. Open: access control on the vector store not yet reviewed. Owner: tech lead, by Phase 4 |
| LLM09 Misinformation | R-01, R-04 | Covered |
| LLM10 Unbounded Consumption | R-07 | Covered |
| NIST AI RMF function | Entries |
|---|---|
| Govern | R-03, R-06 |
| Map | R-08 |
| Measure | R-01, R-04 |
| Manage | R-02, R-05, R-07 |
What is real here: a register of risks kept apart from the mapping, a decision per risk (accept, mitigate or decline, each with its reason), and a coverage table that lists every category so an empty one is visible. Everything inside the tables is invented.