What — the asset. The noun the other frameworks describe verbs about: ten asset classes, derived from what an AI system does rather than remembered from what people happen to list. → What do we want to protect in an AI system
When — the lifecycle. An asset tells you what is exposed, not when the exposure becomes damage, and for most AI attacks those are different moments.
Who — the authority. Every action runs under some identity, and the hard case is a correctly scoped credential making a call the agent was steered into.
Where — the trust boundary. Instructions and data share one channel, so every place untrusted content crosses into a privileged context is a boundary, and boundaries are what controls attach to.
Why — the objective. What the attacker gets and what it costs, which is what decides whether a finding matters to a particular business rather than in general.