Decision poisoning is the manipulation of a model’s input state so that it produces a misleading but still schema-valid answer. In enterprise workflows, the danger is not broken syntax, but a valid verdict that causes a policy, routing or approval system to behave incorrectly.
How Decision Poisoning Works
Decision poisoning is not a syntax failure, it is a state-manipulation problem. The attacker, buggy upstream data, or a compromised workflow step feeds a model enough plausible context that it returns a valid-looking answer that is still wrong for the policy or routing decision being made.
This matters because many enterprise workflows treat “schema-valid” as “safe to automate.” In practice, a poisoned decision can pass validation, move through orchestration, and still trigger the wrong approval, denial, escalation, or case assignment.
Why It Breaks Automated Decisions
Decision systems often rely on hidden assumptions, such as stable context, trustworthy inputs, and consistent business rules. When those assumptions are manipulated, the model may remain technically compliant with the expected output format while the real decision logic is distorted.
The risk is especially sharp in workflows that are only lightly reviewed by humans. A well-formed output can carry the appearance of correctness, which makes it easier for incorrect classifications, approvals, or routing choices to survive downstream checks.
Where Decision Poisoning Enters the Workflow
Decision poisoning usually enters before the final model output, not at the last line of code. Common entry points include upstream prompts, retrieved context, tickets, policy text, reference data, labels, and any other input that helps shape the model’s verdict.
Because the output can still look valid, the real control point is the integrity of the decision inputs. The more a workflow reuses prior context across steps, the more important it becomes to treat that context as part of the security boundary.
Operational Consequences of a Poisoned Verdict
When a model’s answer is trusted as a decision, a poisoned verdict can misroute incidents, approve the wrong request, suppress a needed escalation, or send a case into the wrong control path. Those failures are often hard to spot because the system appears to have behaved normally.
In regulated or high-impact processes, the consequence is not just bad output but bad automation confidence. Once teams believe the decision layer is reliable, poisoned verdicts can persist longer and affect more workflows before anyone notices the pattern.
Risk and Threat Considerations
Decision poisoning is dangerous because it attacks the trust boundary around machine-made judgments, not just the text of the response. A valid schema can hide a manipulated conclusion, which makes the failure harder to detect than a broken format or an obvious injection attempt.
Failure mechanism: The attacker or faulty upstream source alters the model’s context, so the model produces a credible but incorrect verdict that downstream systems accept as authoritative.
Impact: Incorrect policy enforcement, misrouted work, approval bypass, or denial of legitimate actions can follow, especially where humans assume the output was already checked for correctness.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Decision poisoning is context manipulation that skews model outputs. |
| Recommendation — Harden and monitor the context supply chain to prevent poisoned inputs from shaping decisions. | ||
| MITRE ATLAS | Adversarial AI techniques | ATLAS catalogs adversarial AI methods including context poisoning and prompt injection. |
| Recommendation — Map suspected poisoning to ATLAS techniques and hunt for compromised context paths. | ||
| NIST AI RMF | AI Risk Management Framework | AI RMF governs trustworthiness, validity, and harmful AI failure modes in decision systems. |
| Recommendation — Use the AI RMF to evaluate decision integrity, provenance, and human oversight controls. | ||
Practitioner Guidance
What to watch for: Treat output validity and decision integrity as separate checks. A system can be structurally correct and still operationally compromised if the inputs that shape the verdict were manipulated.
Governance implication: Assign ownership for the data, prompts, rules, and retrieval sources that influence automated decisions, then review them with the same seriousness as the decision engine itself. For broader threat modeling of agentic and model-mediated workflows, OWASP Agentic AI Top 10 and the MITRE ATLAS adversarial AI threat matrix are useful references for understanding poisoning, context manipulation, and misuse patterns.
Practitioner takeaway: If a model’s verdict can drive policy, routing, or approval, protect the decision inputs as carefully as the model output.