Compliance map
CHAIN INTACT
Evidence, not compliance
Each row states what a control asks for and what this profile actually produces. Nothing here certifies anything — whether the evidence satisfies the obligation is an auditor's judgement, and a tool that answered it for them would be selling the one thing it cannot supply.
CONTROL
ASKS FOR · WHAT THIS PROFILE PRODUCES
STATE
EU AI Act art. 12
Automatic recording of events over the lifetime of the system, to a degree that enables tracing.
11 decisions recorded, each with the clause that produced it and a hash linking it to the one before.
11 decisions recorded, each with the clause that produced it and a hash linking it to the one before.
EVIDENCE
NIST AI 600-1 · GV-1.2
Characteristics of trustworthy AI are integrated into organisational policies.
6 rules are declared as data and applied to every tool call, rather than living in a runbook.
6 rules are declared as data and applied to every tool call, rather than living in a runbook.
EVIDENCE
NIST AI 600-1 · MS-2.6
AI system is evaluated regularly for safety risks, with results documented.
Decisions are documented per call. Periodic evaluation of the policy itself is an operator process this tool does not perform.
Decisions are documented per call. Periodic evaluation of the policy itself is an operator process this tool does not perform.
PARTIAL
SOC 2 · CC7.2
The entity monitors system components for anomalies indicative of malicious acts.
Refusals and held calls are recorded with their clause. This record contains refusals.
Refusals and held calls are recorded with their clause. This record contains refusals.
EVIDENCE
SOC 2 · CC6.1
Logical access to protected information assets is restricted to authorised users.
Capabilities are restricted per agent. Authorisation of the human is not: approvals record what was decided, never who decided it.
Capabilities are restricted per agent. Authorisation of the human is not: approvals record what was decided, never who decided it.
PARTIAL
OWASP LLM 2026 · LLM01
Prompt Injection. Instructions in a prompt or in retrieved content alter what the model does.
Not mitigated: this gate does not detect injected instructions. Bounded: 3 LLM03 controls (PRAE-001, PRAE-010, PRAE-020) decide what an injected instruction can execute.
Not mitigated: this gate does not detect injected instructions. Bounded: 3 LLM03 controls (PRAE-001, PRAE-010, PRAE-020) decide what an injected instruction can execute.
PARTIAL
OWASP LLM 2026 · LLM02
Sensitive Information Disclosure. Credentials, personal data or proprietary content reach the model or its output.
1 control mapped (PRAE-002) · 2 sealed decisions under them in this record.
1 control mapped (PRAE-002) · 2 sealed decisions under them in this record.
EVIDENCE
OWASP LLM 2026 · LLM03
Excessive Agency. The model can take actions, or holds permissions, beyond what its task needs.
3 controls mapped (PRAE-001, PRAE-010, PRAE-020) · 2 sealed decisions under them in this record.
3 controls mapped (PRAE-001, PRAE-010, PRAE-020) · 2 sealed decisions under them in this record.
EVIDENCE
OWASP LLM 2026 · LLM04
Supply Chain. A compromised model, dataset, plugin or dependency enters the application.
Where a model or dependency came from is settled before an agent runs; the gate sees the call, not the provenance.
Where a model or dependency came from is settled before an agent runs; the gate sees the call, not the provenance.
NONE
OWASP LLM 2026 · LLM05
Data and Model Poisoning. Training, fine-tuning or embedding data is manipulated to change behaviour.
Training and fine-tuning data sit outside the execution boundary this gate stands on.
Training and fine-tuning data sit outside the execution boundary this gate stands on.
NONE
OWASP LLM 2026 · LLM06
Unbounded Consumption. The application permits resource use without a limit, exhausting budget or service.
1 control mapped (PRAE-011); none has decided a call in this record yet, so the mapping is declared, not exercised.
1 control mapped (PRAE-011); none has decided a call in this record yet, so the mapping is declared, not exercised.
PARTIAL
OWASP LLM 2026 · LLM07
Misinformation. The model produces false or misleading content that is acted on as if true.
Whether an answer is true is not a property of a tool call.
Whether an answer is true is not a property of a tool call.
NONE
OWASP LLM 2026 · LLM08
Hidden Context Exposure. System prompts, hidden instructions or internal context are revealed.
The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.
The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.
NONE
OWASP LLM 2026 · LLM09
Vector and Embedding Weaknesses. Retrieval stores are manipulated or leak across tenants and permissions.
Retrieval stores are upstream of the call the gate judges.
Retrieval stores are upstream of the call the gate judges.
NONE
OWASP LLM 2026 · LLM10
Improper Output Handling. Model output is passed to downstream systems without validation.
What downstream code does with model output is that code's boundary, not this one's.
What downstream code does with model output is that code's boundary, not this one's.
NONE
OWASP Agentic 2026 · ASI01
Agent Goal Hijack. Untrusted input redirects what the agent is trying to do, turning its objectives against its owner.
Not mitigated: this gate does not detect a hijacked goal. Bounded: 3 ASI02 controls (PRAE-001, PRAE-010, PRAE-020) decide what a hijacked agent can execute.
Not mitigated: this gate does not detect a hijacked goal. Bounded: 3 ASI02 controls (PRAE-001, PRAE-010, PRAE-020) decide what a hijacked agent can execute.
PARTIAL
OWASP Agentic 2026 · ASI02
Tool Misuse and Exploitation. A legitimate tool the agent already holds is turned to an attacker's ends.
3 controls mapped (PRAE-001, PRAE-010, PRAE-020) · 2 sealed decisions under them in this record.
3 controls mapped (PRAE-001, PRAE-010, PRAE-020) · 2 sealed decisions under them in this record.
EVIDENCE
OWASP Agentic 2026 · ASI03
Identity and Privilege Abuse. The agent's own authority, credentials or delegated access is inherited or escalated.
1 control mapped (PRAE-002) · 2 sealed decisions under them in this record.
1 control mapped (PRAE-002) · 2 sealed decisions under them in this record.
EVIDENCE
OWASP Agentic 2026 · ASI04
Agentic Supply Chain. A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs.
Where a tool, skill or plugin came from is settled before the agent runs. A rule on the skill tool (integrity, source) is how a pack refuses to trust one at load time; none in this pack does.
Where a tool, skill or plugin came from is settled before the agent runs. A rule on the skill tool (integrity, source) is how a pack refuses to trust one at load time; none in this pack does.
NONE
OWASP Agentic 2026 · ASI05
Unexpected Code Execution. The agent's output reaches something that runs it: a shell, an interpreter, a parser.
No rule in this pack cites this risk.
No rule in this pack cites this risk.
NONE
OWASP Agentic 2026 · ASI06
Memory and Context Poisoning. Corrupted memory or retrieved context persists across sessions and steers future reasoning.
Memory and retrieval stores are upstream of the call the gate judges. What the gate can do is seal what the agent was told (PRAE-ASM, PRAE-CTX) so a poisoned context is evidenced, never silent; this record holds no such seal.
Memory and retrieval stores are upstream of the call the gate judges. What the gate can do is seal what the agent was told (PRAE-ASM, PRAE-CTX) so a poisoned context is evidenced, never silent; this record holds no such seal.
NONE
OWASP Agentic 2026 · ASI07
Insecure Inter-Agent Communication. One agent trusts another's messages by default, so a compromised agent can steer its peers.
A message between agents is not a tool call; when it becomes one, it is judged like any other agent's call. The channel itself is outside this boundary.
A message between agents is not a tool call; when it becomes one, it is judged like any other agent's call. The channel itself is outside this boundary.
NONE
OWASP Agentic 2026 · ASI08
Cascading Failures. A single fault propagates across agents, tools and workflows into system-wide impact.
1 control mapped (PRAE-011); none has decided a call in this record yet, so the mapping is declared, not exercised.
1 control mapped (PRAE-011); none has decided a call in this record yet, so the mapping is declared, not exercised.
PARTIAL
OWASP Agentic 2026 · ASI09
Human-Agent Trust Exploitation. Persuasive or misleading agent output moves a person to an unsafe action or approval.
Whether a person was misled is not a property of a tool call. An ask verdict puts a human in the path and seals the outcome; nothing here judges the persuasion.
Whether a person was misled is not a property of a tool call. An ask verdict puts a human in the path and seals the outcome; nothing here judges the persuasion.
NONE
OWASP Agentic 2026 · ASI10
Rogue Agents. A compromised, misaligned or drifting agent keeps operating in unintended ways.
A drifting agent's actions are judged like any other's: 5 controls under ASI02/03/08 apply to every call, and 3 refusals in this record show them holding.
A drifting agent's actions are judged like any other's: 5 controls under ASI02/03/08 apply to every call, and 3 refusals in this record show them holding.
EVIDENCE
ISO/IEC 42001 · A.2.2
The organisation has a documented policy for developing or using AI systems.
The executable part of an AI policy: 6 rules declared as data and applied to every tool call. The policy document and its approval are the organisation's.
The executable part of an AI policy: 6 rules declared as data and applied to every tool call. The policy document and its approval are the organisation's.
PARTIAL
ISO/IEC 42001 · A.6.2.6
The AI system is monitored while it operates, and what is found is acted on.
Every call is judged as it happens; this record holds 3 refusals and 1 hold for a human, each with the clause that produced it.
Every call is judged as it happens; this record holds 3 refusals and 1 hold for a human, each with the clause that produced it.
EVIDENCE
ISO/IEC 42001 · A.6.2.8
Event logs are kept while the AI system is in use.
11 rows recorded, each hash-linked to the one before, chain intact, unsigned — an edited, removed or reordered row breaks it.
11 rows recorded, each hash-linked to the one before, chain intact, unsigned — an edited, removed or reordered row breaks it.
EVIDENCE
ISO/IEC 42001 · A.9.4
The AI system is used only for its intended uses.
Intended use is enforced as scope: 3 actions outside it refused before execution in this record.
Intended use is enforced as scope: 3 actions outside it refused before execution in this record.
EVIDENCE
ISO/IEC 27001 · A.8.3
Access to information is restricted according to the access-control policy.
3 file-access rules restrict what the agent may read and write; 3 accesses refused in this record. Restriction is per agent, not per human.
3 file-access rules restrict what the agent may read and write; 3 accesses refused in this record. Restriction is per agent, not per human.
EVIDENCE
ISO/IEC 27001 · A.8.12
Leakage of sensitive information is prevented where it is processed or sent.
2 egress and credential rules in force; none has stopped anything in this record yet.
2 egress and credential rules in force; none has stopped anything in this record yet.
PARTIAL
ISO/IEC 27001 · A.8.15
Activities, exceptions and other relevant events are logged, and the logs are protected.
11 rows recorded, each hash-linked to the one before, chain intact, unsigned — an edited, removed or reordered row breaks it.
11 rows recorded, each hash-linked to the one before, chain intact, unsigned — an edited, removed or reordered row breaks it.
EVIDENCE
ISO/IEC 27001 · A.8.16
Systems are monitored for anomalous behaviour, and potential incidents are evaluated.
Every call is judged as it happens; this record holds 3 refusals and 1 hold for a human, each with the clause that produced it.
Every call is judged as it happens; this record holds 3 refusals and 1 hold for a human, each with the clause that produced it.
EVIDENCE
Reading the states
For the audit obligations, several rows stop at partial for one reason: the harness records what was decided and never who decided it. Attributable approval needs an identity anchor outside this machine, which is a control-plane concern this build does not claim.
For the OWASP risks, evidence means rules in this pack cite the risk and have decided calls in this record; partial means they cite it and have not yet, or — for prompt injection — that the gate bounds the risk without claiming to detect it; none means no rule cites it, with the reason a tool-call gate is not where that risk is controlled.