Public references
Rules mapped to public security guidance.
Our guardrails line up with the public guidance written for AI agents. A reviewer can read the overlap in one place, with the frameworks we map against named plainly.
Sill holds no security certification today. This page is a reference, not a certificate. You remain responsible for your own compliance.
Mappings
Control by control, line by line.
GUARDRAILS YOU CONFIGURE
| CONTROL | OWASP AGENTIC 2026 | OWASP LLM 2026 | MITRE ATLAS 2026.09 | NIST AI RMF |
|---|---|---|---|---|
| Allowlist of registered agents | ASI03, ASI10 | — | Initial Access | Manage |
| Require a signed permission from the user | ASI01, ASI03 | LLM06 | — | Manage |
| Rate limit per agent | ASI08 | LLM10 | Impact | Manage |
| Rate limit per IP | ASI08 | LLM10 | Impact | Manage |
| Maximum amount per transaction | ASI01 | LLM06, LLM10 | Impact | Manage |
| Daily spend cap per customer | ASI08 | LLM06, LLM10 | Impact | Manage |
| Human review on destructive actions | ASI08, ASI09 | LLM06 | Impact | Manage |
| No urgency manipulation | ASI09 (partial) | — | — | — |
| No drip pricing | ASI09 (partial) | — | — | — |
| Instruction-override detection | ASI01 | LLM01 | AML.T0051 (partial) | Measure |
| Country allow or deny | — | — | Initial Access | Manage |
| Aggregate rate cap across agents | ASI08 | LLM10 | Impact | Manage |
| Cart total must stay under the signed amount | ASI01 | LLM06 | — | Manage |
| Cart currency must match the signed permission | ASI01 | LLM06 | — | Manage |
| Each customer sees only their own data | ASI03 | LLM06 | Exfiltration | Manage |
| Skill manifest pinning | ASI02, ASI04 (partial) | LLM03 (partial) | AML.T0011.002 (partial) | Measure |
| Subscription requires explicit consent | ASI09 | LLM06 | — | Manage |
| Invisible-character detection | ASI01 | LLM01 | AML.T0051 (partial) | Measure |
| Credential-leak detection on incoming requests | ASI02 (partial) | LLM02 (partial) | AML.T0098 (partial) | Measure |
| Cap on how long a signed permission is valid | ASI03 | LLM06 | Evasion | Manage |
| Request body size limit | — | LLM10 | — | — |
| Emergency kill switch | ASI08 | LLM10 | Impact | Manage |
| Shared budget across agents from the same organization | ASI08 | LLM06, LLM10 | Impact | Manage |
| Rules you write yourself | merchant-defined | merchant-defined | merchant-defined | — |
ALWAYS ON
| CONTROL | OWASP AGENTIC 2026 | OWASP LLM 2026 | MITRE ATLAS 2026.09 | NIST AI RMF |
|---|---|---|---|---|
| Signature check on every signed request | ASI03, ASI10 | — | Initial Access, Evasion; AML.T0096 | Manage |
| Reject the same signed request sent twice | ASI03 | — | Evasion | Measure |
| Lock out an IP after repeated bad sign-ins | — | LLM10 | Credential Access | Manage |
| Reject a request bound to another site | ASI03 | — | Evasion | Manage |
| Anti-fingerprinting on identity reads | — | — | Discovery | — |
| Signature check on every incoming webhook | — | — | — | Manage |
| Evaluation budgets with a safe default when exceeded | ASI08 | LLM10 | Impact | Manage |
| Tamper-evident, linked audit chain | ASI06 (partial) | — | — | Measure, Manage |
| Personal data redacted at the storage layer | — | LLM02 (partial) | Exfiltration | Manage |
| Agent output sanitized before it leaves | — | LLM02, LLM05, LLM07 | — | — |
| Delegation chain verified before trust is granted | ASI07 (registered-agent) | — | — | Manage |
| Cart contents are fixed once the request is signed | ASI01 | LLM06 | — | Manage |
OUT OF SCOPE
Risks that come from training or hosting a model
Sill does not train, host, or retrieve for models.
Unexpected code execution
Sill is an authorization layer, not an execution sandbox.
Agent-to-agent delegation outside a registered agent
Delegation from a registered agent is covered. Chains that start outside a registered agent are outside what Sill verifies.
The agent’s own runtime, host or build chain
Those live inside the agent, outside the request Sill sees.