The latest articles on DEV Community by Jaskarn Singh (@jaskarn_singh). https://dev.to/jaskarn_singh https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F2136825%2F61d622a8-484e-44e9-af02-bab1134474a9.jpg https://dev.to/jaskarn_singh en Jaskarn Singh Fri, 03 Jul 2026 20:01:15 +0000 https://dev.to/jaskarn_singh/making-llm-security-verdicts-verifiable-the-evidence-gate-pattern-3afp https://dev.to/jaskarn_singh/making-llm-security-verdicts-verifiable-the-evidence-gate-pattern-3afp <p>Every "AI security analyst" I tried had the same flaw: a correct verdict and a confident-but-wrong one are indistinguishable on screen. In security that's not a UX nit — it's the whole problem. So I built USAP around a single rule, and this post is about that rule and three things that fell out of it.</p> <h2> The evidence gate </h2> <p>USAP's output contract is 11 typed JSON fields. The uncompromising one is <code>evidence_references</code>: every verdict must carry at least one source that <em>resolves</em>. Four accepted forms:</p> <ul> <li> <code>mcp:&lt;logical&gt;:&lt;tool&gt;:&lt;call_id&gt;</code> — evidence fetched live from a connected MCP</li> <li> <code>https://...</code> — a canonical external source (CVE, EPSS feed, MITRE)</li> <li> <code>s3://...</code> — an operator artifact</li> <li> <code>local://&lt;repo-path&gt;</code> — an in-repo standard, for advisory verdicts (the path must exist)</li> </ul> <p>A source like <code>"scanner"</code> or <code>"the SIEM showed it"</code> is rejected at the contract boundary. That one check removes most hand-wavy output, because the model can't satisfy the contract without pointing at something real.</p> <h2> Fallout 1: connectors have to be abstract </h2> <p>If a verdict cites <code>mcp:siem:search</code>, that can't hard-code Splunk — not everyone runs Splunk. So agents declare <em>logical</em> capabilities and a registry resolves them to whatever the operator connected (Splunk, Elastic, Sentinel). If nothing implements a capability, the agent degrades gracefully and marks that axis UNKNOWN rather than inventing telemetry.</p> <h2> Fallout 2: numbers can't be narrated </h2> <p>Once you demand resolvable evidence, narrated numbers feel wrong too. CVSS is computed from the published vector. EPSS is pulled live from the FIRST feed. Confidence comes from a written rubric. If a number can't be computed, the tool returns "qualitative" instead of fabricating one — and the contract rejects a <code>cvss_score</code> that disagrees with its cited vector.</p> <h2> Fallout 3: you can't grade yourself </h2> <p>A system that enforces evidence shouldn't grade itself against its own answer key. USAP ships a held-out corpus of real public incidents (Log4Shell, xz, Capital One, MOVEit) plus benign false-positive traps, and a stdlib harness that reports precision, recall, FPR, and MTTD.</p> <p>USAP is open-source (Apache-2.0), stdlib-only, and runs as an MCP server or as paste-in system prompts in any model. Every example in the repo is a real command you can re-run. I'd value feedback on the gate design.</p> <p>Repo: <a href="https://github.com/jaskaranhundal/usap-skills" rel="noopener noreferrer">https://github.com/jaskaranhundal/usap-skills</a></p> security ai llm opensource