Scholarlink

<p>Security assurance depends on clearly defined contextual conditions, including assumptions, environmental constraints, and stakeholder expectations. As artificial intelligence tools are increasingly used to analyze evidence and generate assurance artifacts, they often operate on incomplete or underspecified system descriptions. In such settings, AI systems may introduce plausible but unverified assumptions in order to produce coherent outputs. This paper refers to this risk as assumption injection: the silent introduction or modification of contextual assumptions that changes the basis on which assurance claims are interpreted. This paper proposes a governed context evolution mechanism for mitigating assumption injection in AI-assisted assurance workflows. The mechanism treats contextual incompleteness as an explicit and governed state by representing unresolved assumptions as context gaps. AI tools may analyze these gaps and propose advisory refinements, but they cannot modify the authoritative assurance context directly. Authoritative changes occur only through decision-gated promotion, provenance-aware DecisionRecords, and replay-based validation. A reference implementation and illustrative case study demonstrate how the mechanism separates advisory artifacts from authoritative state, preserves unresolved gaps, and rejects refinements that rely on undeclared structure. The evaluation is positioned as a proof of concept rather than a full industrial validation. Within these bounds, the case study demonstrates that explicit gap preservation and replay-derived promotion provide practical mechanisms for supporting auditability, traceability, and human control over contextual assumptions in AI-assisted assurance. The paper concludes by discussing scalability, analyst burden, semantic drift, conflict handling, and the conditions under which the mechanism would require further engineering before deployment in large assurance environments.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Governing AI reasoning to mitigate assumption injection in assurance workflows

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月20日

查看全文
  • Shao-Fang Wen

摘要

Security assurance depends on clearly defined contextual conditions, including assumptions, environmental constraints, and stakeholder expectations. As artificial intelligence tools are increasingly used to analyze evidence and generate assurance artifacts, they often operate on incomplete or underspecified system descriptions. In such settings, AI systems may introduce plausible but unverified assumptions in order to produce coherent outputs. This paper refers to this risk as assumption injection: the silent introduction or modification of contextual assumptions that changes the basis on which assurance claims are interpreted. This paper proposes a governed context evolution mechanism for mitigating assumption injection in AI-assisted assurance workflows. The mechanism treats contextual incompleteness as an explicit and governed state by representing unresolved assumptions as context gaps. AI tools may analyze these gaps and propose advisory refinements, but they cannot modify the authoritative assurance context directly. Authoritative changes occur only through decision-gated promotion, provenance-aware DecisionRecords, and replay-based validation. A reference implementation and illustrative case study demonstrate how the mechanism separates advisory artifacts from authoritative state, preserves unresolved gaps, and rejects refinements that rely on undeclared structure. The evaluation is positioned as a proof of concept rather than a full industrial validation. Within these bounds, the case study demonstrates that explicit gap preservation and replay-derived promotion provide practical mechanisms for supporting auditability, traceability, and human control over contextual assumptions in AI-assisted assurance. The paper concludes by discussing scalability, analyst burden, semantic drift, conflict handling, and the conditions under which the mechanism would require further engineering before deployment in large assurance environments.