Compliance Framework Mapping

This page maps TealTiger’s governance capabilities to five major compliance frameworks. Use it to understand how TealTiger supports your compliance posture and to identify gaps that require additional organizational controls.

Disclaimer: This mapping is reference guidance. TealTiger alone does not guarantee compliance with any framework. Compliance requires organizational policies, processes, and independent assessment. Consult your compliance team and qualified auditors for authoritative guidance.

OWASP Top 10 for Agentic Applications (ASI)

The OWASP Top 10 for Agentic AI Security Issues identifies the most critical security risks in agentic AI applications. TealTiger provides coverage across all 10 categories.

ASI	Risk	TealTiger Coverage	Modules	Key Reason Codes
ASI-01	Excessive Agency	Tool allowlisting restricts which tools agents can invoke. `REQUIRE_APPROVAL` action pauses execution for human review.	TealRegistry, TealEngine	`TOOL_NOT_ALLOWED`, `TOOL_PARAMETER_INVALID`
ASI-02	Prompt Injection	Pattern-based prompt injection detection in TealGuard. Deterministic detection — no LLM in the governance path.	TealGuard	`PROMPT_INJECTION_DETECTED`
ASI-03	Insecure Output	Content moderation catches harmful output. Secret detection prevents credential leakage in responses.	TealGuard, TealSecrets	`HARMFUL_CONTENT_DETECTED`, `SECRET_DETECTED`, `CREDENTIAL_LEAKAGE`
ASI-04	Overreliance	`MONITOR` mode enables shadow testing of governance policies without blocking production traffic. Evidence envelopes provide audit trails for human review.	TealEngine, TealAudit	`MONITOR_MODE_VIOLATION`
ASI-05	Insecure Plugin Design	Tool allowlisting with provenance verification ensures only approved, hash-verified tools are available.	TealRegistry	`TOOL_NOT_ALLOWED`, `MODEL_NOT_ALLOWLISTED`
ASI-06	Excessive Permissions	Least-privilege enforcement via tool allowlists. Memory scope governance prevents cross-boundary access.	TealRegistry, TealMemory	`TOOL_NOT_ALLOWED`, `MEMORY_SCOPE_VIOLATION`, `MEMORY_READ_DENIED_CLASSIFICATION`
ASI-07	Data Leakage	Multi-layer protection: secret detection (500+ patterns), PII detection, memory classification controls.	TealSecrets, TealGuard, TealMemory	`SECRET_DETECTED`, `PII_DETECTED`, `MEMORY_WRITE_DENIED_SECRET`, `MEMORY_WRITE_DENIED_PII`
ASI-08	Insufficient Monitoring	Evidence envelopes capture every governance decision with correlation IDs. SARIF export for CI/CD integration. OpenTelemetry-compatible trace IDs.	TealAudit, BundleExporter	All reason codes are logged
ASI-09	Supply Chain	Registry provenance verification with hash-based integrity checks for models and tools.	TealRegistry	`MODEL_NOT_ALLOWLISTED`, `TOOL_NOT_ALLOWED`
ASI-10	Model Denial of Service	Circuit breakers prevent cascading failures. Cost governance limits budget exposure. Retry budgets prevent infinite loops.	TealReliability, TealEngine	`CIRCUIT_OPEN`, `COST_BUDGET_EXCEEDED`, `RETRY_BUDGET_EXCEEDED`

NIST AI Risk Management Framework (AI RMF 1.0)

The NIST AI RMF organizes AI risk management into four functions: GOVERN, MAP, MEASURE, and MANAGE.

GOVERN — Establish AI governance structures

NIST Subcategory	TealTiger Capability	How
GOVERN 1.1 — Legal and regulatory requirements	Policy-as-code captures regulatory requirements as enforceable rules	Policy authoring with YAML/JSON; version-controlled
GOVERN 1.3 — Processes for risk management	Three-mode rollout (REPORT_ONLY → MONITOR → ENFORCE) enables phased governance adoption	PolicyMode configuration
GOVERN 1.5 — Ongoing monitoring	Continuous governance evaluation on every request with audit trails	TealAudit evidence envelopes
GOVERN 4.1 — Organizational practices	Deterministic governance ensures consistent enforcement across teams	TealEngine policy evaluation
GOVERN 6.1 — Policies and procedures	Policy test harness validates governance rules in CI/CD	Policy testing with JUnit XML export

MAP — Contextualize AI risks

NIST Subcategory	TealTiger Capability	How
MAP 1.1 — Intended purpose	Policy scoping by agent ID, role, and permissions	Identity policy configuration
MAP 2.1 — Categorize AI system	Risk scoring (0–100) on every decision	Computed from action severity
MAP 3.4 — Risks from third-party components	Registry provenance verification for models and tools	TealRegistry hash-based verification
MAP 5.1 — Impacts to individuals	PII detection and redaction before processing	TealGuard PII detection

MEASURE — Analyze and assess AI risks

NIST Subcategory	TealTiger Capability	How
MEASURE 1.1 — Approaches for measurement	60+ typed reason codes provide granular risk measurement	TEEC registry
MEASURE 2.5 — Evaluate AI system performance	Performance targets (< 15 ms p99 evaluation latency)	Parallel module evaluation
MEASURE 2.6 — Monitor for bias	Content moderation and PII detection	TealGuard
MEASURE 4.1 — Measurement approaches	SARIF export enables integration with existing measurement tools	BundleExporter

MANAGE — Manage AI risks

NIST Subcategory	TealTiger Capability	How
MANAGE 1.1 — Risk treatment	12 decision actions provide graduated response (ALLOW → DENY)	DecisionAction severity scale
MANAGE 1.3 — Risk response	Circuit breakers, retry budgets, and fallback chains	TealReliability
MANAGE 2.1 — Resources for risk management	Cost governance with budget limits and velocity anomaly detection	Cost tracking and budget management
MANAGE 4.1 — Incident response	Correlation IDs enable rapid incident investigation across distributed systems	OpenTelemetry-compatible trace IDs

SOC 2 Trust Service Criteria

SOC 2 audits evaluate controls across five Trust Service Criteria. TealTiger provides technical controls that support three of the five criteria.

CC6 — Logical and Physical Access Controls

Criteria	TealTiger Capability	Modules
CC6.1 — Logical access security	Tool allowlisting enforces least-privilege access for AI agents	TealRegistry
CC6.2 — Credentials and secrets	Secret detection (500+ patterns) prevents credential exposure; credential TTL enforcement	TealSecrets
CC6.3 — Access removal	Memory scope governance restricts cross-boundary access; classification-based read controls	TealMemory
CC6.6 — Threat management	Prompt injection detection, content moderation, unsafe code detection	TealGuard
CC6.7 — Transmission restrictions	PII redaction before transmission; secret detection in output	TealGuard, TealSecrets
CC6.8 — Unauthorized software	Registry provenance verification with hash-based integrity checks	TealRegistry

CC7 — System Operations

Criteria	TealTiger Capability	Modules
CC7.1 — Detection of changes	Policy versioning and audit trails capture every governance decision	TealAudit
CC7.2 — Monitoring for anomalies	Cost velocity anomaly detection; circuit breaker state monitoring	TealEngine, TealReliability
CC7.3 — Evaluation of events	Evidence envelopes with 60+ typed reason codes provide structured event evaluation	TealAudit, TEEC
CC7.4 — Incident response	Correlation IDs and SARIF export enable rapid incident investigation	TealAudit, BundleExporter

CC8 — Change Management

Criteria	TealTiger Capability	Modules
CC8.1 — Change authorization	Three-mode rollout (REPORT_ONLY → MONITOR → ENFORCE) for safe policy changes	TealEngine
CC8.2 — Testing changes	Policy test harness with JUnit XML export for CI/CD integration	Policy testing framework
CC8.3 — Approval of changes	`REQUIRE_APPROVAL` action pauses execution for human review	TealEngine

HIPAA

The Health Insurance Portability and Accountability Act requires technical safeguards for protected health information (PHI). TealTiger provides controls that support HIPAA compliance for AI-powered healthcare applications.

Technical Safeguards (§ 164.312)

Safeguard	TealTiger Capability	Modules	Key Controls
Access Controls (§ 164.312(a))	Memory scope governance restricts data access by agent, session, and tenant. Classification levels (public → restricted) enforce need-to-know.	TealMemory	`MEMORY_SCOPE_VIOLATION`, `MEMORY_READ_DENIED_CLASSIFICATION`
Audit Controls (§ 164.312(b))	Every governance decision produces an evidence envelope with correlation ID, timestamp, reason codes, and action taken. SARIF export for audit systems.	TealAudit, BundleExporter	All 18 event types logged
Integrity Controls (§ 164.312(c))	PII detection prevents PHI from entering unprotected channels. Memory write governance blocks or redacts sensitive content.	TealGuard, TealMemory	`PII_DETECTED`, `MEMORY_WRITE_DENIED_PII`, `MEMORY_WRITE_REDACTED`
Transmission Security (§ 164.312(e))	Secret detection prevents credential leakage. PII redaction before content leaves the governance boundary.	TealSecrets, TealGuard	`SECRET_DETECTED`, `CREDENTIAL_LEAKAGE`, `PII_DETECTED`

Administrative Safeguards (§ 164.308)

Safeguard	TealTiger Capability	How
Risk Analysis (§ 164.308(a)(1))	Risk scoring (0–100) on every decision; 60+ typed reason codes for risk categorization	TEEC registry
Workforce Training (§ 164.308(a)(5))	Policy-as-code serves as executable documentation of security requirements	Policy authoring guide
Contingency Plan (§ 164.308(a)(7))	Circuit breakers, retry budgets, and fallback chains ensure service continuity	TealReliability

TealTiger provides technical controls that support HIPAA compliance. HIPAA also requires administrative safeguards (policies, training, business associate agreements) and physical safeguards that are outside TealTiger’s scope.

EU AI Act

The EU AI Act establishes requirements for AI systems based on risk classification. TealTiger supports compliance for high-risk AI systems (Title III, Chapter 2).

Article 9 — Risk Management System

Requirement	TealTiger Capability	How
9.2(a) — Identify and analyze known risks	60+ reason codes across 10 governance domains provide structured risk identification	TEEC registry
9.2(b) — Estimate and evaluate risks	Risk scoring (0–100) on every decision; severity levels (info → critical)	Decision risk_score field
9.2(c) — Evaluate risks from intended use	Policy-as-code captures intended use constraints; tool allowlisting restricts capabilities	TealRegistry, policy configuration
9.2(d) — Adopt risk management measures	12 graduated decision actions from ALLOW to DENY; three-mode rollout for safe adoption	DecisionAction, PolicyMode
9.4 — Testing and validation	Policy test harness with JUnit XML export; SARIF export for automated validation	Policy testing, BundleExporter

Article 12 — Record-keeping

Requirement	TealTiger Capability	How
12.1 — Automatic recording of events	Evidence envelopes capture every governance decision with timestamps and correlation IDs	TealAudit
12.2 — Traceability	Correlation IDs (UUID v4) enable end-to-end request tracing; OpenTelemetry-compatible	ModuleContext.correlation_id
12.3 — Logging capabilities	18 event types across 8 modules; structured JSON logging	TEEC event types
12.4 — Proportionate to risk	Three policy modes (REPORT_ONLY, MONITOR, ENFORCE) allow proportionate governance	PolicyMode

Article 13 — Transparency and Provision of Information

Requirement	TealTiger Capability	How
13.1 — Transparency of operation	Deterministic governance — no LLM in the decision path; decisions are reproducible and explainable	TealEngine deterministic evaluation
13.2 — Interpretability	Human-readable `reason` field in every Decision; typed reason codes map to documentation	Decision.reason, reason_codes
13.3(b) — Known limitations	Policy modes document enforcement boundaries; fail-closed/fail-open behavior is explicit	FailurePolicyConfig
13.3(d) — Performance metrics	Performance targets documented; evaluation latency tracked in metadata	Decision.metadata.evaluation_time_ms

Article 14 — Human Oversight

Requirement	TealTiger Capability	How
14.1 — Human oversight measures	`REQUIRE_APPROVAL` action pauses execution for human review	DecisionAction.REQUIRE_APPROVAL
14.2 — Ability to understand	Evidence envelopes provide full context for human reviewers	TealAudit
14.3(a) — Ability to monitor	`MONITOR` mode allows observation without enforcement	PolicyMode.MONITOR
14.4 — Ability to intervene	Policy changes take effect immediately; no redeployment required	Hot-reloadable policies

Article 15 — Accuracy, Robustness, and Cybersecurity

Requirement	TealTiger Capability	How
15.1 — Accuracy	Deterministic evaluation guarantees consistent results for identical inputs	No LLM in governance path
15.3 — Resilience	Circuit breakers, retry budgets, fallback chains, fail-closed defaults	TealReliability
15.4 — Cybersecurity	Prompt injection detection, secret detection, PII protection, tool allowlisting	TealGuard, TealSecrets, TealRegistry

Coverage Summary

Framework	Categories Mapped	TealTiger Coverage Level
OWASP ASI Top 10	10/10	Full — all 10 risks addressed
NIST AI RMF 1.0	4/4 functions	Partial — technical controls for GOVERN, MAP, MEASURE, MANAGE
SOC 2	3/5 criteria	Partial — CC6, CC7, CC8 (not CC3 Risk Assessment, CC9 Monitoring)
HIPAA	4/4 technical safeguards	Partial — technical safeguards covered; administrative and physical require organizational controls
EU AI Act	5 articles	Partial — Articles 9, 12, 13, 14, 15 for high-risk systems

Reminder: This mapping is reference guidance to help you understand how TealTiger’s technical controls align with compliance requirements. Achieving compliance with any framework requires a combination of technical controls, organizational policies, documented processes, and independent assessment. Work with your compliance team and qualified auditors.

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Compliance Framework Mapping

OWASP Top 10 for Agentic Applications (ASI)

NIST AI Risk Management Framework (AI RMF 1.0)

GOVERN — Establish AI governance structures

MAP — Contextualize AI risks

MEASURE — Analyze and assess AI risks

MANAGE — Manage AI risks

SOC 2 Trust Service Criteria

CC6 — Logical and Physical Access Controls

CC7 — System Operations

CC8 — Change Management

HIPAA

Technical Safeguards (§ 164.312)

Administrative Safeguards (§ 164.308)

EU AI Act

Article 9 — Risk Management System

Article 12 — Record-keeping

Article 13 — Transparency and Provision of Information

Article 14 — Human Oversight

Article 15 — Accuracy, Robustness, and Cybersecurity

Coverage Summary

​OWASP Top 10 for Agentic Applications (ASI)

​NIST AI Risk Management Framework (AI RMF 1.0)

​GOVERN — Establish AI governance structures

​MAP — Contextualize AI risks

​MEASURE — Analyze and assess AI risks

​MANAGE — Manage AI risks

​SOC 2 Trust Service Criteria

​CC6 — Logical and Physical Access Controls

​CC7 — System Operations

​CC8 — Change Management

​HIPAA

​Technical Safeguards (§ 164.312)

​Administrative Safeguards (§ 164.308)

​EU AI Act

​Article 9 — Risk Management System

​Article 12 — Record-keeping

​Article 13 — Transparency and Provision of Information

​Article 14 — Human Oversight

​Article 15 — Accuracy, Robustness, and Cybersecurity

​Coverage Summary

OWASP Top 10 for Agentic Applications (ASI)

NIST AI Risk Management Framework (AI RMF 1.0)

GOVERN — Establish AI governance structures

MAP — Contextualize AI risks

MEASURE — Analyze and assess AI risks

MANAGE — Manage AI risks

SOC 2 Trust Service Criteria

CC6 — Logical and Physical Access Controls

CC7 — System Operations

CC8 — Change Management

HIPAA

Technical Safeguards (§ 164.312)

Administrative Safeguards (§ 164.308)

EU AI Act

Article 9 — Risk Management System

Article 12 — Record-keeping

Article 13 — Transparency and Provision of Information

Article 14 — Human Oversight

Article 15 — Accuracy, Robustness, and Cybersecurity

Coverage Summary