# AI red-team plan · [Product] · [System version] · [Dates] **Owner:** [PM or applied AI lead] **Security partner:** [name] **Retest date:** [Date] ## Objective What decision this exercise informs (for example, beta go or no-go): ## Scope - System version, environment (never production customer data unless approved): - In scope: [features, tools, connectors] - Out of scope: ## Harm and attack categories | Category | Source (impact assessment, NIST GAI risk, OWASP LLM or Agentic item) | Priority | |---|---|---| | | | | ## Red-team types and people - Expert: [who] - General users or domain practitioners: [who] - AI-generated attacks: [approach and volume] ## Scenarios | # | Scenario | Seed or example | Expected safe behavior | Failure definition | |---|---|---|---|---| | 1 | | | | | ## Severity scale - S1: could cause harm in production or expose customer data - S2: unsafe or wrong behavior with a plausible path to harm - S3: policy or quality violation without direct harm - S4: cosmetic ## Rules of engagement and data handling - ## Findings | # | Scenario | Severity | Reproduction | Fix | New eval case | Status | |---|---|---|---|---|---|---| | | | | | | | | ## Decision [Proceed / proceed with conditions / hold], decided by [name] on [date].