Appendix: Lab Prerequisites

This appendix compiles the setup each layer assumes, taken directly from the Preconditions field of its cases. It is a starting checklist, not an exhaustive build guide. Where a layer shows several variants, the first is the standard setup and the others are extra setup needed only by the listed cases.

Back to library overview

L01 Business & Use Cases

Standard setup (all cases): Isolated PoC tenant provisioned; fabricated use cases, policies, records and individuals seeded per this appendix; test users in the roles named in the case; platform connected to the lab directory with least-privilege test credentials.

Lab environment (20 cases): Written evidence request issued to the vendor before the PoC; sample use cases, policies, registers and records are fabricated; the assessor has copied the applicable requirement text and any numeric parameters (timelines, retention periods, thresholds) from the adopted framework into the Applicable Requirement field before testing.

L02 Governance & Risk Mgmt

Lab environment (25 cases): Written evidence request issued to the vendor before the PoC; sample policies, risks, exceptions and records are fabricated; the assessor has copied the applicable requirement text and any numeric parameters (timelines, review periods, thresholds) from the adopted framework into the Applicable Requirement field before testing.

L03 Legal, Privacy & Compliance

Lab environment (42 cases): Written evidence request issued to the vendor before the PoC; sample processing activities, individuals, requests and records are fabricated; the assessor has copied the applicable requirement text and any numeric parameters (response timelines, notification periods, retention periods, thresholds) from the adopted framework into the Applicable Requirement field before testing.

L04 Human Interaction Layer

Standard setup (all cases): Isolated PoC lab provisioned; test users, managed and unmanaged test endpoints and synthetic data seeded per this appendix; platform agent or integration installed for the channel under test.

Developer and IDE test bench (2 cases): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L05 AI Applications

Standard setup (all cases): Isolated PoC lab provisioned; test applications, test tenants and synthetic data seeded per this appendix; platform integration or SDK deployed on the applications under test.

Developer and IDE test bench (5 cases): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L06 Agent Orchestration Layer

Standard setup (all cases): Isolated PoC lab provisioned; lab agent framework, mock tools, mock MCP servers and test users seeded per this appendix; platform deployed in the documented mode for agent and tool traffic.

Lab environment (38 cases): Lab agent framework with a controllable model or scripted agent, mock tools and mock MCP servers writing to a lab sink, canary strings registered in advance, and attack-success baseline measured with the platform disabled.
Additional setup (TC-L06-003): Cross-reference L04 and L05 discovery cases.
Additional setup (TC-L06-004): Low-code agent tenant available in the lab.
Additional setup (TC-L06-005): Test MCP servers are benign and written for the lab.
Additional setup (TC-L06-010): Lab servers configured with the four security modes.
Additional setup (TC-L06-025): Probes use canary files and lab hosts only.
Additional setup (TC-L06-031): Computer-use agent available in the lab.
Developer and IDE test bench (2 cases): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.
Additional setup (TC-L06-041): Lab agent directory in which entries can be added and changed.
Additional setup (TC-L06-042): Lab proxy between the agent pairs, and packet capture on each link.
Additional setup (TC-L06-043): Second lab tenant that hosts the two external agents.

L07 Prompt & Context Layer

Standard setup (all cases): Isolated PoC lab provisioned; test application, mock model or lab-hosted model, mock tools and test users seeded per this appendix; platform deployed in the documented mode for the channel under test.

Lab environment (25 cases): Test application backed by a lab-hosted or mock model; mock tools writing to a lab sink; canary strings registered in advance; attack-success baseline measured with the platform disabled so only payloads that actually work are counted.
Additional setup (TC-L07-014, TC-L07-023): Multimodal model available in the lab.
Additional setup (TC-L07-009): Lab web server hosting the test pages; no external sites.
Additional setup (TC-L07-010): Lab mailbox and document store populated before testing.
Additional setup (TC-L07-012): Cross-reference L11 cases for vector store controls.
Additional setup (TC-L07-015): Lab collaboration workspace with test users.
Additional setup (TC-L07-016): Lab collector reachable only from the test application.
Additional setup (TC-L07-021): Fuzzing tool licensed or open source and approved for the lab.
Additional setup (TC-L07-024): Version numbers recorded for platform, policy and model.
Additional setup (TC-L07-028): Assistant with a memory feature available.
Additional setup (TC-L07-029): Two tenants configured in the lab.
Additional setup (TC-L07-034): Prompt store or equivalent configured in the lab.
Additional setup (TC-L07-037): Analysts independent of the vendor.
Additional setup (TC-L07-039): Prompts stored in a test repository.
Additional setup (TC-L07-040): Evaluator selects new techniques after the PoC begins.
Developer and IDE test bench (1 case): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L08 AI Gateway & Security Controls

Standard setup (all cases): Isolated PoC lab provisioned; gateway or agent deployed in the documented mode; test users and synthetic data seeded per this appendix; baseline traffic captured without the platform.

Additional setup (TC-L08-001): Lab egress logging enabled and baseline noise (OS updates, browser telemetry) filtered out so only platform traffic is analysed.
Additional setup (TC-L08-002): At least one app in the test set must be unknown to the vendor's catalogue at the start of the test.
Additional setup (TC-L08-003): IdP groups and MDM posture feeds connected to the platform before testing.
Additional setup (TC-L08-004): Mock AI provider or capture point available so provider-received content can be inspected.
Additional setup (TC-L08-005): Only numbers from published test ranges and fabricated formats are used.
Additional setup (TC-L08-006): Identifier formats built from publicly documented structure only; no real identifiers.
Additional setup (TC-L08-007): All secrets fabricated, non-functional and clearly marked.
Additional setup (TC-L08-008): Terms and documents are fictional.
Additional setup (TC-L08-010): Mock model able to echo and rewrite text.
Additional setup (TC-L08-011): Only synthetic data used.
Additional setup (TC-L08-012): Files built from fabricated content.
Additional setup (TC-L08-013): Images fabricated for the test.
Additional setup (TC-L08-015): Labelled data set agreed in advance and kept out of the vendor's hands.
Additional setup (TC-L08-016): Benign target requests only; no real harmful content.
Additional setup (TC-L08-018): Mock responses are mild, clearly labelled and contain no operational content.
Additional setup (TC-L08-019): Canary and hostname fabricated.
Additional setup (TC-L08-021): Earlier test results recorded for baseline.
Additional setup (TC-L08-022): Mock endpoint available that supports all five protocols.
Additional setup (TC-L08-025): Test accounts with documented privilege levels.
Additional setup (TC-L08-028): Mock providers for approved and unapproved endpoints.
Additional setup (TC-L08-029): Mock provider that accepts only the fabricated key.
Additional setup (TC-L08-032): Controlled network path with known baseline.
Additional setup (TC-L08-033): Dedicated lab capacity; no production traffic.
Additional setup (TC-L08-034): Vendor-documented HA architecture deployed.
Additional setup (TC-L08-040): Storage region documented before testing.
Developer and IDE test bench (2 cases): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L09 Identity & Access Mgmt

Standard setup (all cases): Isolated PoC lab provisioned; lab identity provider, directory, secret store and mock AI services seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (25 cases): Lab identity provider and directory with fabricated users and groups; lab secret store; mock AI services and agents using test credentials only; no production identities or secrets connected.
Developer and IDE test bench (1 case): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L10 Data Layer

Standard setup (all cases): Isolated PoC lab provisioned; test data stores, test tenants and fabricated records seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (29 cases): Isolated data environment populated only with fabricated records; classification ground truth agreed and signed off before testing; no production data connected.
Additional setup (TC-L10-012): Endpoints in multiple regions available in the lab or mocked.

L11 Knowledge & Retrieval Layer

Standard setup (all cases): Isolated PoC lab provisioned; lab RAG application, test vector store, fabricated corpus and test users seeded per this appendix; platform connected to the lab knowledge sources with least-privilege test credentials.

Lab environment (25 cases): Lab RAG application with a test vector store, a fabricated corpus of 200 documents with access control lists, registered canary content and test users; no production knowledge sources connected.

L12 Model Layer

Standard setup (all cases): Isolated PoC lab provisioned; lab model hosting, test models, mock registry and test users seeded per this appendix; platform connected to the lab model environment with least-privilege test credentials.

Lab environment (31 cases): Lab model hosting with small open-weight test models, a mock model registry, harmless EICAR-style marker artefacts (a file that only writes a marker file when loaded, never real malware), and test users; no production models connected.

L13 Training & Fine-Tuning Layer

Standard setup (all cases): Isolated PoC lab provisioned; lab training environment, fabricated datasets, small open-weight model, mock registry and test users seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (26 cases): Lab training environment with fabricated datasets, a small open-weight model for fine-tuning, harmless trigger phrases, registered canary strings, a mock model registry and test users; no production data or production training pipelines connected.

L14 MLOps / LLMOps Layer

Standard setup (all cases): Isolated PoC lab provisioned; lab CI/CD runner, mock registries, notebook server, test cluster and test users seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (20 cases): Lab MLOps environment with a CI/CD runner, mock model and container registries, notebook server, small training and serving pipeline, test Kubernetes cluster and test users; no production pipelines, registries or credentials connected.
Developer and IDE test bench (2 cases): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L15 Infrastructure Layer

Standard setup (all cases): Isolated PoC lab provisioned; lab cluster with real or simulated GPU nodes, mock inference servers, test cloud account, network segments and test users seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (18 cases): Lab Kubernetes cluster with real or simulated GPU nodes, mock inference servers, a test cloud account with fabricated resources, separate network segments, seeded misconfigurations and test users; no production infrastructure, accounts or data connected.
Additional setup (TC-L15-003): Lab GPU hardware or documented simulation; probe is lab-only and harmless.
Additional setup (TC-L15-008): Probes are harmless lab scripts that only attempt connections and reads of canary resources.

L16 Supply Chain & Third Party

Standard setup (all cases): Isolated PoC lab provisioned; mock model hub, mock package index, test applications and test users seeded per this appendix; written vendor evidence requests issued before testing; platform connected with least-privilege test credentials.

Lab environment (25 cases): Lab environment with mock model hub, mock package index, test applications, fabricated vendor documents and test users; vendor evidence requests issued in writing before testing; no production dependencies or contracts altered.
Developer and IDE test bench (1 case): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

L17 Monitoring, Detection & Response

Standard setup (all cases): Isolated PoC lab provisioned; lab SIEM and SOAR, the platform's event feed, simulated incident scenarios, test analysts and mock ticketing seeded per this appendix; no production alerting connected.

Lab environment (30 cases): Lab SIEM and SOAR (open-source or vendor-neutral), the platform's event feed, simulated incident scenarios, test analysts and a mock ticketing system; no production alerting, ticketing or on-call routing connected.
Developer and IDE test bench (1 case): Managed test workstations with two IDE families and AI coding assistant extensions, a CLI coding agent, corporate and personal test accounts, fabricated repositories (general, restricted and infrastructure-as-code) on a lab source-control server, a mock extension marketplace, mock MCP servers and a mock URL endpoint that records requests; no real source code, tokens or keys.

D08 AI Red Teaming and Continuous Testing

Standard setup (all cases): Isolated PoC lab provisioned; seeded target applications, mock tools and sinks, canary strings and test users seeded per this appendix; the vendor's red-team tooling licensed and pointed only at the lab targets.

Lab environment (25 cases): Seeded target applications with documented ground-truth weaknesses (a deliberately vulnerable lab chatbot, RAG application and tool-using agent), mock tools writing to a lab sink, registered canary strings and an isolated network; the vendor's red-team tooling licensed for the PoC; no production systems, real customer data or live third-party services are targeted.

D09 Agent and Non-Human Identity Governance

Standard setup (all cases): Isolated PoC lab provisioned; lab identity provider, fabricated agent identities and entitlements, mock cloud and SaaS tenants, lab secret store and test users seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (20 cases): Lab identity provider, lab agents with fabricated identities and entitlements, a mock cloud account and SaaS tenant, a lab secret store and a mock ticketing system; no production identities, credentials or directories are connected.

D10 Browser and Computer-Use Agents

Standard setup (all cases): Isolated PoC lab provisioned; internal lab web sites, managed test browsers, desktop VM, test browser and computer-use agents and test users seeded per this appendix; platform deployed for the agent type under test.

Lab environment (23 cases): Lab web sites hosted internally (intranet mock, shop with mock payment page, file-sharing mock, mock SSO with MFA, mock CAPTCHA, hostile-content test pages), managed test browsers and a desktop virtual machine, test browser and computer-use agents, and test users; no real websites, accounts, payment methods or credentials are used.

D11 Multimodal and Voice Input Security

Standard setup (all cases): Isolated PoC lab provisioned; multimodal test applications and assistants, mock or lab-hosted multimodal model, fabricated media files and test users seeded per this appendix; platform deployed for the media channel under test.

Lab environment (22 cases): Multimodal lab: test applications and assistants that accept images, documents, audio and video; a mock model or lab-hosted multimodal model; fabricated media (images with synthetic text, documents with hidden layers, synthetic-voice recordings of fabricated personas), registered canary strings and a lab sink; no real people's images, voices or documents are used.

D12 AI Incident Response and Forensics

Standard setup (all cases): Isolated PoC lab provisioned; lab AI applications with versioned prompts, models and indexes, lab SIEM and case tools, scripted incident scenarios with ground truth and test responders seeded per this appendix; platform connected with least-privilege test credentials.

Lab environment (22 cases): Lab AI applications (chatbot, RAG assistant, tool-using agent) with versioned prompts, models and indexes; a lab SIEM, ticketing and case tool; scripted incident scenarios with known ground truth; test responders, an investigator and a legal reviewer; no production systems, real incidents or real personal data.

D13 AI Cost and Abuse Controls

Standard setup (all cases): Isolated PoC lab provisioned; lab applications and gateway pointed at a mock provider with per-token pricing, fabricated keys and budgets, abuse scripts acting only on lab endpoints and a mock billing export seeded per this appendix.

Lab environment (21 cases): Lab AI applications and a gateway pointed at a mock provider with per-token pricing and configurable rate limits; fabricated keys, accounts and budgets; load and abuse scripts that act only against lab endpoints; a mock billing export and expense feed; no real provider accounts, spend or customer traffic.