[uk ai resilience] UK AI Governance Risk Report – 2026-10-26

[github-actions[bot]]

Executive summary

Lookback 7 days: 288 commits (171 security-signal), 28 open security issues, 2 open code-scanning alerts, 0 secret alerts. No Tier C/D findings. Two CodeQL alerts look like false positives (Tier B, low). Limitation: sub-agents were not used; assessment done directly from pre-computed inputs and the two flagged locations, so confidence is moderate.

Asset graph summary

Asset graph

Segment	Surface	Evidence
pkg/workqueue	queue replay/policy	alert #1036 (replay.go:391)
pkg/workflow/gradershell	grader path validation	alert #1034 (load.go:29)
Domain allowlists	Chrome bundle egress	issue #72064

Tier classification

Tier table

Area	Tier	Rationale
pkg/workqueue	B	len(map)+1 used as map capacity hint; cannot realistically overflow
pkg/workflow/gradershell	B	ValidRunPath is a file-path validator with strict allowlist and traversal rejection, not a redirect; likely false positive
Chrome egress (#72064)	B	Over-broad Google wildcards; tracked and assigned

Control verification gaps

• Ownership: code-scanning alerts have no assignees.
• SDLC: CodeQL active; alerts untriaged, no linked PRs.
• Secrets/dependencies: no alerts in inputs.
• Observability/recovery: not verifiable from inputs.

Risk scoring

Scores (1 low risk - 5 high)

Area	Exposure	Patchability	Detectability	Fragility	Ownership	Priority
workqueue #1036	1	1	1	2	low	low
gradershell #1034	1	1	1	1	low	low
Chrome egress #72064	3	2	2	2	high	medium

Remediation queue

Action	SLA
Triage/dismiss #1034 with justification	low, 14d
Triage #1036: dismiss or add size guard	low, 14d
Narrow Google wildcard egress per #72064	medium, 7d

Human review trigger: alert untriaged beyond SLA or still unassigned.

Exception register

None.

Operational metrics baseline

• MTTR proxy: alerts open 1-6 days, none resolved.
• Ownership coverage: 0/2 code-scanning alerts assigned.
• Unsupported dependency ratio: not measurable.
• Exception aging: n/a.
• Exposure without recovery capability: none identified.

No issues created: no Tier C/D findings; remaining items are tracked or likely false positives.

Generated by UK AI Operational Resilience · copilot · auto · ~17 AIC · ⌖ ~1 AIC · ⊞ 8K · ◷

• expires on Oct 29, 2026, 7:50 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #72478.