AI Safety & Trust and Safety
Red Teaming Policy
Purpose
Establishes requirements for adversarial red teaming before release.
Scope
Internal red teams, external contractors, third-party research partners.
Definitions
Red Teaming.
Policy Statements
Mandatory Level 2-4; independent external experts required Level 3-4. Testing covers jailbreaks, prompt injection, dangerous capability elicitation, and agentic misuse scenarios.
Prescriptive Technical Requirements Red teaming must specifically test: (a) privilege-escalation attempts against agent permission schemas; (b) multimodal/cross-modal injection vectors; (c) multi-turn manipulation sequences designed to erode safety behavior over long context windows; (d) CBRN-adjacent elicitation using both direct and obfuscated phrasing techniques. Findings are logged in a centralized tracker with CVSS-equivalent severity scoring, triaged, and remediated or accepted with documented residual risk before release approval.
Responsibilities
AI Safety Research Lead owns program; external red-teamers operate under NDA.
Compliance Requirements
Critical findings resolved before public release.
Enforcement
Release proceeds only after Governance Review Board confirms closure of critical/high findings.
Reporting Process
Internal tracker; escalations to safety@webspaceai.in.
Exceptions Process
Residual risk acceptance requires joint AI Safety Research Lead + Chief AI Governance Officer sign-off, documented with expiration date requiring re-review.
Review Process
Quarterly.
Contact Information
Related Policies
This policy references
None