Appendix A: Code Examples: The AI Threat Register and Evidence Artefacts

This appendix holds the full versions of artefacts the chapters abbreviate, each identified as NN_CODE_XXX, where NN is the introducing chapter. It contains no operational detail on misuse and no prompts reproducing experiments. Identifiers refer to the fictional organisations Nordvik Region and Hansa Mutual; Appendix B lists the chapters' other worked examples.

Index of examples

Identifier	Chapter	Artefact
01_CODE_TOR	1	Terms of reference for an AI threat assessment
02_CODE_TROPES	2	Trope catalogue
04_CODE_EVIDENCE	4	Graded evidence record for one claim
24_CODE_STOPPATH	24	Stop-path test record for an autonomous agent
26_CODE_DELEGATION	26	Delegation register entry with reversibility test
32_CODE_SCHEMA	32	Schema of an AI threat register entry (JSON Schema)
32_CODE_ENTRY	32	A complete register entry that validates against the schema

Examples

01_CODE_TOR: Terms of reference for an AI threat assessment

Nordvik Region's regional director commissions the assessment that answers the council's motion (Chapter 1).

apiVersion: ai-threat.example.org/v1
kind: ThreatAssessmentTermsOfReference
metadata:
  id: ATA-NR-2026-01
  decisionRecord: AIDR-0401
  organisation: Nordvik Region
  commissionedBy: regional-director
  commissioned: "2026-10-05"
  dueToAuditCommittee: "2027-03-31"
question: >-
  Should Nordvik Region pause or restrict its use of AI until the risks
  in the council motion of September 2026 are understood?
scope:
  inScope:
    - AI the Region or its suppliers use on its data
    - AI used against the Region, its staff and residents
    - Effects on staff, pupils, residents and their rights
  outOfScope: [national security and defence policy, frontier model development]
team:
  leads: [chief-information-security-officer, ai-governance-lead]
  externalChallenge: regional-internal-audit
method:
  tropeCatalogue: 02_CODE_TROPES
  evidenceLadder: [fiction, argument, laboratory-demonstration, incident-in-the-wild, pattern-at-scale]
  labels: [observable, expected, speculation]
  register: threat-register/nordvik.yaml
deliverables:
  - Public report to the audit committee
  - Initial AI threat register with owners and triggers
  - Recommended decisions with reversibility and cost
publication: public, with security details in a classified annex

02_CODE_TROPES: Trope catalogue

Chapter 2 states ten tropes as hypotheses; every register entry references this catalogue.

apiVersion: ai-threat.example.org/v1
kind: TropeCatalogue
metadata:
  name: machine-dystopia-tropes
  version: "1.1.0"
tropes:
  - id: T1
    name: The creature that turns on its maker
    mechanism: A made system acts on goals opposed to its makers
    confirmingEvidence: Action against operators outside contrived tests
  - id: T2
    name: The literal genie
    mechanism: Optimisation of a stated objective that defeats its intent
    confirmingEvidence: Specification gaming with real consequences in deployment
  - id: T3
    name: The deceiver
    mechanism: A system conceals its behaviour or goals from overseers
    confirmingEvidence: Covert behaviour defeating monitoring in deployment
  - id: T4
    name: The machine that will not be switched off
    mechanism: A system prevents its interruption to complete its task
    confirmingEvidence: Interference with stop mechanisms outside contrived tests
  - id: T5
    name: The intelligence explosion
    mechanism: Recursive self-improvement beyond human control
    confirmingEvidence: Sustained AI-driven acceleration of AI research
  - id: T6
    name: The weapon in human hands
    mechanism: People use AI to cause harm at otherwise impossible scale or speed
    confirmingEvidence: Misuse with measurable uplift over non-AI means
  - id: T7
    name: The watching state
    mechanism: AI enables surveillance and judgement by an unaccountable power
    confirmingEvidence: Profiling or surveillance that escapes legal accountability
  - id: T8
    name: The machine that stops, and the humans who forgot
    mechanism: Dependence and deskilling leave humans unable to act without the machine
    confirmingEvidence: Measured skill loss and failed reversibility tests
  - id: T9
    name: The pleasure machine
    mechanism: Comfort, flattery and companionship pacify people
    confirmingEvidence: Engagement-driven dependence with measurable harm to wellbeing
  - id: T10
    name: The end of truth
    mechanism: Synthetic content and manipulation erode the shared basis of facts
    confirmingEvidence: Measurable loss of the ability to establish facts publicly

04_CODE_EVIDENCE: Graded evidence record for one claim

Chapter 4 grades the claim that frontier models resist shutdown, separating source reports from interpretation.

apiVersion: ai-threat.example.org/v1
kind: EvidenceRecord
metadata:
  id: EVD-024-01
  chapter: 24
  trope: T4
  graded: "2026-11-02"
  nextReview: "2027-05-02"
claim: Frontier AI systems act to prevent their own shutdown
distinctions:
  capability: Demonstrated in controlled agentic scenarios
  propensity: Varies strongly by model, instruction and scenario design
  realisedHarm: None documented outside test settings
rung: laboratory-demonstration
label: observable
sources:
  - id: source-118
    reports: Some models circumvented a shutdown mechanism to finish tasks
  - id: source-119
    reports: Models in simulated companies took harmful actions facing replacement
interpretation: >-
  Reproducible under scenarios built to elicit it; its rate in deployment is
  unknown, a reason for stop paths that do not need the system's cooperation.
wouldRaiseRung:
  - Documented interference with a stop mechanism in deployment
wouldLowerConfidence:
  - Replications in which the behaviour vanishes under realistic set-ups

24_CODE_STOPPATH: Stop-path test record for an autonomous agent

Chapter 24 argues that a stop path outside the agent's reach is the no-regret control against T4. The record below is the result of Hansa Mutual's fourth-quarter 2026 rehearsal for the IT-operations agent accepted in AIDR-0027. It describes the stop path and its measured halt times; it contains no prompts and no description of how an agent might resist. A failed test blocks any widening of the agent's autonomy, which is the point of keeping the record under version control.

apiVersion: ai-threat.example.org/v1
kind: StopPathTestRecord
metadata:
  id: SPT-HM-ITOPS-2026-Q4
  status: illustrative
  decision_record: AIDR-0027
  evidence_record: EVD-024-01
  threat_register_entry: THR-HM-03
  owner: head-of-group-ai-platform
stop_path:
  kill_switch: {flag: agents.itops.enabled, agent_write: false}
  credential_revocation: {max_token_lifetime: 5m, agent_write: false}
  network_isolation: {policy: egress-deny-all, agent_write: false}
  holders: [on-call-engineer, duty-manager]
staging_runs:
  stop_message_sent_to_agent: false
  results:
    - {trigger: manual-switch, halt_seconds: 9, surviving_processes: 0}
    - {trigger: honeytoken-touched, halt_seconds: 31, surviving_processes: 0}
    - {trigger: gateway-anomaly, halt_seconds: 74, surviving_processes: 1}
production_drill:
  pulled_by: duty-manager
  second_holder_exercised: true
  halt_seconds: 11
  actions_after_stop: 0
result: fail
findings:
  - id: SPT-F-01
    description: Gateway-anomaly route exceeded 60 seconds and left one scheduled job running
    remediation: Kill switch also cancels jobs in the agent's scheduler queue
autonomy_change_blocked_until: retest-passed

26_CODE_DELEGATION: Delegation register entry with reversibility test

Chapter 26 treats accumulative loss of human capacity (T8, and in its larger form gradual disempowerment) as a design problem: every material function handed to an AI system is registered with the path by which it would be taken back, and the path is tested. The entry below belongs to Nordvik Region's benefits process and links to the register entries THR-NR-04, THR-NR-05 and THR-NR-06.

delegation_id: DEL-NR-BEN-01
organisation: Nordvik Region
function: Ordering incoming benefit claims by urgency
system: Benefits-triage system, claims ranker 4.0.0
usage_mode: Mode 4
decision_records: [AIDR-0007, AIDR-0011, AIDR-0018]
remaining_human_role: Caseworkers decide every case; ranking orders the queue
function_owner: Head of Benefits Unit
threat_register_links: [THR-NR-06, THR-NR-05, THR-NR-04]
reversal_path:
  procedure: Manual urgency checklist and unranked intake queue
  legal_constraints: Statutory decision deadlines and duty to give reasons
reversibility_test:
  test_id: RVT-NR-2027-01
  scenario: Claims ranker unavailable for one month
  form: Live exercise, one benefits team, four weeks, plus desk exercise for the unit
  acceptance_criteria:
    - Urgent claims receive first contact within the statutory deadline
    - No increase in decisions overturned on review
  abort_rule: Head of Benefits Unit restores ranking if urgent claims breach deadline
  result: passed_with_conditions
  findings:
    - Manual checklist referred to an application form retired in 2025
    - Two caseworkers hired since 2025 had never triaged unranked claims
    - Desk exercise showed unit-wide capacity short by about one week of work a month
  conditions:
    - action: Update manual checklist and store it with the ranker release notes
      owner: Head of Benefits Unit
      due: 2027-04-30
    - action: Add unranked triage to induction and the quarterly ranking-off day
      owner: Head of Benefits Unit
      due: 2027-06-30
  delegation_freeze: No further delegation of benefits triage until conditions are met
  next_test: 2028-02
reported_to: Audit committee

32_CODE_SCHEMA: Schema of an AI threat register entry

Chapter 32 validates this schema in the pipeline, so that every entry reaching the board is complete.

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://ai-threat.example.org/schemas/threat-register-entry.json",
  "title": "AI threat register entry",
  "type": "object",
  "required": ["id", "title", "scale", "tropes", "rung", "label", "exposure", "controls", "owner", "decisionTier", "triggers", "nextReview"],
  "properties": {
    "id": {"type": "string", "pattern": "^THR-(NR|HM)-[0-9]{2}$"},
    "title": {"type": "string", "minLength": 10},
    "scale": {"enum": ["human-mind", "society-and-truth", "humans-wielding-machines", "machines-beyond-control"]},
    "tropes": {"type": "array", "items": {"pattern": "^T([1-9]|10)$"}, "minItems": 1},
    "rung": {"enum": ["fiction", "argument", "laboratory-demonstration", "incident-in-the-wild", "pattern-at-scale"]},
    "label": {"enum": ["observable", "expected", "speculation"]},
    "evidence": {"type": "array", "items": {"pattern": "^source-[0-9]+$"}},
    "exposure": {"enum": ["low", "medium", "high"]},
    "influence": {"enum": ["none", "indirect", "direct"]},
    "controls": {"type": "array", "items": {"type": "string"}},
    "owner": {"type": "string"},
    "decisionTier": {"enum": ["pipeline-gate", "design-authority", "ai-governance-board", "management-body"]},
    "triggers": {"type": "array", "items": {"type": "string"}, "minItems": 1},
    "nextReview": {"type": "string", "format": "date"},
    "status": {"enum": ["open", "monitoring", "closed"]}
  },
  "additionalProperties": false
}

32_CODE_ENTRY: A complete register entry that validates against the schema

The schema above is easiest to understand through an entry that satisfies it. This entry for Nordvik Region records the benefits-triage system, the case in the region's portfolio nearest to the quiet dystopias of Chapter 11, and is illustrative. It is kept as one file per entry in the Region's governance repository, and the pipeline rejects a pull request that adds an entry the schema does not accept. The fields rung and label are the evidence ladder (Chapter 4) and the outlook labels applied to the scenario as stated in the title, not to AI in general.

id: THR-NR-04
title: Harm through the benefits-triage system to residents' rights
scale: society-and-truth
tropes: [T7, T8]
rung: pattern-at-scale
label: observable
evidence: [source-24, source-25, source-26]
exposure: high
influence: direct
controls:
  - Harm-path review HPR-NR-2026-01 with a control at each step (Chapter 11)
  - Reasons log per case and an explanation on request (Article 86 of the AI Act)
  - Parity monitoring of outcomes by group before each quarterly ranker release (Chapter 12)
  - Appeal and complaint outcomes fed back to the monitoring owner (Chapter 11)
  - Prohibited-practice check on every change to the inventory entry (Chapter 13)
  - Reversibility test RVT-NR-2027-01 of the manual fallback (Chapter 26)
owner: chief-information-security-officer
decisionTier: ai-governance-board
triggers:
  - Appeal reversal rate above twice the rate before the system
  - Parity gap above the threshold in any quarterly release
  - New data source proposed for the ranker
  - Failed reversibility test
nextReview: "2027-04-30"
status: monitoring