Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / The press / This newsroom / The editor
The editor: its risk register
Dinis Cruz: every editorial call, the root key, the only person who instructs the agents.
Kind role · Assigned here 4 · In its register 4 · their team page
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R10 This newsroom's own agents are steered, leak or mislead | 12 high | AI and agents | owner | EU AI Act Art.50, NIST AI RMF MANAGE-2.4, ISO/IEC 42001 6.1.3, OWASP Top 10s LLM06:2025 |
| R10-1 Prompt injection through captured material | 12 high | AI and agents | owner | OWASP Top 10s LLM01:2025, NIST AI RMF MEASURE-2.7, EU AI Act Art.15 |
| R10-3 A status word stronger than its evidence | 12 high | AI and agents | owner | OWASP Top 10s LLM09:2025, EU AI Act Art.50 |
| R10-2 A vault key or token published | 10 medium | AI and agents | owner | OWASP Top 10s LLM02:2025, GDPR Art.32, ISO/IEC 27001 A.5.14 |
Where its risks sit
The standards its register touches
OWASP Top 10s (4), EU AI Act (2), NIST AI RMF (2), ISO/IEC 42001 (1), GDPR (1), ISO/IEC 27001 (1)