Singapore SASH — Detecting Offensive Cyber Agents (Defence-in-Depth)

Singapore SASH — Detecting Offensive Cyber Agents (Defence-in-Depth) — 31% of in-scope requirements covered.

4 requirements · 4 in scope (1 designed · 3 advisory). The 31% is weighted over the in-scope base.

Singapore SASH: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. agent-identity · designed

    Agent Identity Standard — every acting agent is a first-class, bound principal

    Constitution: 52 delegated agent binding

  2. detection-triage · advisory

    Automated alert & triage — continuous posture signal on agent behaviour

    Constitution: 52 delegated agent binding · Audit events: kye.agent.posture_signal.v1

  3. ace-exchange · advisory

    Agentic Cybersecurity Exchange (ACE) — independently verifiable evidence to share

    Constitution: 13 resilience loop · Audit events: kye.replay.proof.v1

  4. evidence-replay · advisory

    Post-incident reconstruction — replay-derivable record of the agent action

    Constitution: 13 resilience loop, 21 delegated auditability · Audit events: kye.evidence.pack.v1, kye.replay.proof.v1

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Singapore SASH (Security Alert Standard / Honeypots) — 'Detecting Offensive Cyber Agents' defence-in-depth framework (2026): agent identity mechanisms, agent honeypots, automated alert/triage, a security alert standard, and the Agentic Cybersecurity Exchange (ACE). KYE Protocol™ governs the AUTHORITY, IDENTITY and EVIDENCE of agent actions — it makes a defending organisation's own agents first-class, identifiable principals whose actions are replay-provable, complementing detection-in-depth. KYE™ is not an intrusion-detection / honeypot product; it is the authority + evidence substrate the identity and alert layers assume. Starter requirement set; deepen by graft through the §70 rail. · License: SASH materials are Singapore-government publications; KYE™ registry paraphrases each mechanism's intent and cites the mechanism identifier for mapping purposes only.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Agent identity1010050%
Detection & triage1001025%
Alert standard & exchange1001025%
Evidence & replay1001025%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
sash.agent-identityAgent Identity Standard — every acting agent is a first-class, bound principaldesignedconstitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md
sash.detection-triageAutomated alert & triage — continuous posture signal on agent behaviouradvisoryconstitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md
audit_events: kye.agent.posture_signal.v1
sash.ace-exchangeAgentic Cybersecurity Exchange (ACE) — independently verifiable evidence to shareadvisoryconstitution_refs: constitution/13-RESILIENCE-LOOP.md
audit_events: kye.replay.proof.v1
sash.evidence-replayPost-incident reconstruction — replay-derivable record of the agent actionadvisoryconstitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/21-DELEGATED-AUDITABILITY.md
audit_events: kye.evidence.pack.v1, kye.replay.proof.v1

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.