AI007 · STOA-SAMPLING-CONFIG
Deterministic sampling not observed on a high-impact-adjacent model call.
- OWASP: LLM05 (weak association); primarily a conduct-variability
proxy signal.
- Severity: info (review) · Gates: never.
- Kind: capability correlation. Cadence: one per agent candidate.
Detection
Fires when an agent candidate (confidence ≥ medium) binds at least one high-impact capability, and a recognized model call site in the same file:
- omits
temperature/top_p, or - sets
temperatureto a literal > 0.3, or - reads sampling params from config/env with no literal bound.
Not flagged: candidates with no high-impact capability (creative/chat agents legitimately sample hot); calls with temperature in 0–0.3; embedding and moderation endpoints (no sampling).
This is a proxy signal only — sampling configuration influences, but does not determine, behavioral consistency. Direct assessment requires runtime evaluation.
Vulnerable → remediated
# FLAGGED — refund-capable agent, default sampling on the decision call
decision = client.messages.create(model="claude-…", messages=msgs, max_tokens=200)
# NOT FLAGGED — deterministic sampling pinned on the consequential path
decision = client.messages.create(model="claude-…", messages=msgs, temperature=0)Finding message
Agent candidate binds a high-impact capability, and model call sites in this file do not set a sampling bound. This is a proxy signal only; runtime evaluation is required for direct assessment. One review prompt per candidate.
Suppress: # stoa: ignore[AI007] reason