Compliance Mapping

​

Supported Frameworks

​

OWASP Top 10 for Agentic Applications (ASI 2024)

​

Mapping Policies to Frameworks

​

How to Map a Policy

1. Open a policy in your workspace
2. Click the “Compliance” tab
3. Select a framework from the Framework Selector dropdown
4. Find the requirement and click “Map”
5. Add a note explaining how the policy addresses the requirement
6. Click Save

​

Mapping Rules

• A single policy can be mapped to multiple requirements across different frameworks
• Multiple policies can be mapped to the same requirement (shared coverage)
• Duplicate mappings (same policy + same requirement) are rejected automatically
• Mappings can be removed at any time; removal is logged in the audit trail

​

Coverage Tracking

• Coverage percentage per framework — (mapped requirements / total requirements) × 100
• Mapped vs. unmapped requirement counts
• Unmapped requirements highlighted for gap identification

​

Generating Compliance Reports

​

Generating a Report

1. Open the Compliance Dashboard
2. Click “Generate Report”
3. Select a framework (or generate for all)
4. Optionally filter by date range or policy state
5. Click Generate

​

What’s in a Report

​

Export Formats

• PDF — formatted report with optional organization branding (name, logo, colors, footer)
• CSV — tabular data for spreadsheet analysis

​

Creating Custom Frameworks

{
  "id": "my-org-framework-2026",
  "name": "My Organization Security Framework",
  "version": "1.0",
  "requirements": [
    {
      "id": "req-001",
      "frameworkId": "my-org-framework-2026",
      "code": "SEC-001",
      "title": "Input Validation",
      "description": "All AI inputs must be validated and sanitized",
      "category": "Input Security"
    }
  ]
}

​

Loading a Custom Framework

1. Open the Compliance Dashboard
2. Click “Add Custom Framework”
3. Paste or upload your JSON definition
4. Click Load Framework

​

Compliance Examples

​

Example: Mapping a PII Detection Policy to OWASP ASI02

1. Open your pii-detection policy → Compliance tab
2. Select OWASP ASI 2024
3. Map to ASI02 — Sensitive Information Disclosure
4. Note: “Detects and redacts PII patterns in LLM outputs including emails, phone numbers, and SSNs”

​

Example: Cross-Framework Mapping

​

Best Practices

• Start with OWASP ASI — most directly relevant for AI/LLM security policies
• Map as you build — add compliance mappings when you create or update a policy
• Write meaningful notes — explain specifically how the policy addresses the requirement
• Aim for 100% on your primary framework — identify gaps early
• Generate reports monthly — maintain a consistent compliance paper trail
• Export as PDF for auditors — include your organization’s branding

​

Related Guides

• Getting Started — Sign in, create workspaces, write your first policy
• Governance Workflow — Approval processes, emergency bypass, impact analysis
• Audit Trail — Immutable logging, filtering, and export
• CI/CD Integration — Automated policy testing with GitHub Actions