Tool Gate · How it works
How the Agent Memory & Context Poisoning Exposure Probe gate works
How the Agent Memory & Context Poisoning Exposure Probe scores 6 OWASP-ASI06 controls to 100: a kill-chain gate forces POROUS when both write-validation and trust-retrieval are only partial — which is how a copilot scoring 78, in the CONTAINED range, still reads POROUS.
How the gate works
This tool grades an agent's memory, RAG index, or context store against six OWASP ASI06 lifecycle controls. Each control is marked from your own evidence and weighted into a 0–100 score — and then the score is run past a gate that can only make the verdict worse.
The 6 weighted controls
| Signal | Weight |
|---|---|
| Write-path validation & sanitization | 22 |
| Trust-aware retrieval (validate before recall) | 22 |
| Provenance on every memory entry | 16 |
| Scope isolation & read-only system memory | 16 |
| Eviction, TTL & temporal decay | 12 |
| Audit trail of what entered memory | 12 |
| Total | 100 |
The verdict bands
If both write-path validation and trust-aware retrieval sit at 1 or below - untrusted content can be written AND nothing checks trust on recall - the verdict is forced to POROUS regardless of the score. Poison persists as ground truth once both halves of the chain fail together; lift either control above 1 and the gate releases.
In the worked sample it scores 78 out of 100 and still reads POROUS — A self-write support copilot: provenance, isolation, decay, and audit all sit at 2 - solid - for a raw score of 78/100, which would normally read CONTAINED. But both chain controls sit at 1: write-path validation doesn't fully sanitize untrusted content, and trust-aware retrieval doesn't fully check trust before recall. With both halves of the kill chain open, a poisoned entry can be written and later recalled as ground truth - the gate forces POROUS regardless of the 78. The one thing to fix first: Write-path validation & sanitization.
Common questions
Can something score well on the How the Agent Memory & Context Poisoning Exposure gate works and still fail?
Yes. The weighted score is run past a worsen-only gate — the Kill-chain gate — that can only make the verdict worse. In the worked sample it scores 78 out of 100 and still reads POROUS, because a self-write support copilot: provenance, isolation, decay, and audit all sit at 2 - solid - for a raw score of 78/100, which would normally read CONTAINED. But both chain controls sit at 1: write-path validation doesn't fully sanitize untrusted content, and trust-aware retrieval doesn't fully check trust before recall. With both halves of the kill chain open, a poisoned entry can be written and later recalled as ground truth - the gate forces POROUS regardless of the 78.
What is a worsen-only gate?
A dispositive rule that can only lower a verdict, never raise it. One fatal flaw overrides an otherwise-good score, because a single disqualifying gap shouldn't hide behind a high average. The tool also names the one thing to fix first — here, "Write-path validation & sanitization".
A readiness aid, not a security audit. It scores the marks you enter for the architecture you describe - it never connects to, scans, or queries your memory store. Not a penetration test and not legal advice.
Embed this diagram
Free to share and embed with attribution (CC BY 4.0) — keep the link to redhub.ai.
Interactive — renders the live diagram
<iframe src="https://redhub.ai/visuals/tool/agent-memory-context-poisoning-exposure-probe.html" title="How the Agent Memory & Context Poisoning Exposure Probe gate works — RedHub AI" width="760" height="1845" loading="lazy" style="border:0;width:100%;max-width:760px"></iframe>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai/visuals/tool/agent-memory-context-poisoning-exposure-probe">How the Agent Memory & Context Poisoning Exposure Probe gate works</a> — by <a href="https://redhub.ai">RedHub AI</a>, the AI that tells you when to doubt it.</p>Image + link — a static picture for any blog
<a href="https://redhub.ai/visuals/tool/agent-memory-context-poisoning-exposure-probe"><img src="https://redhub.ai/visuals/tool/agent-memory-context-poisoning-exposure-probe-share.png" alt="Diagram of the Agent Memory & Context Poisoning Exposure Probe: six controls scoring 78 and a kill-chain gate forcing POROUS on partial write-validation and trust-retrieval." width="760" loading="lazy" style="max-width:100%;height:auto;border-radius:16px"></a>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai">RedHub AI</a> — the AI that tells you when to doubt it.</p>
This is how Agent Memory & Context Poisoning Exposure Probe works. More diagrams in the Visual Field Guide.