Control-by-control framework mappings
Sill maintains a public mapping between every shipped guardrail and the OWASP Top 10 for Agentic Applications, the OWASP LLM Top 10, MITRE ATLAS, and the NIST AI RMF. OWASP’s 2026 editions draw the scope line explicitly: the LLM Top 10 covers the model as a component; the Agentic Top 10 covers the model as an actor with tools and downstream consequences — the boundary where Sill operates, and its primary OWASP reference. The tables below list each control, the framework risks it addresses, and where coverage is partial.
These are mappings — Sill’s reading of how its controls address each framework’s named risks. They are not certifications or attestations. Sill claims no security certification today and will not until an accredited audit completes. Merchants remain responsible for their own regulatory compliance.
Control-by-control mappings
EVERY CONTROL BELOW IS SHIPPEDEach control below is shipped. A cell asserts only that the named control addresses the named framework risk, per Sill’s reading of the public control descriptions — “(partial)” marks coverage of one facet, not the whole risk. Mapping is not certification, and Sill holds no security certification today. The full status table — including planned and out-of-scope controls — lives in docs/security/framework-mappings.md.
Verify it yourself — Sill’s signing key is published at edge.sill.so/.well-known/jwks.json. Every signed agent card and ARD catalog can be reproduced against it using only published standards — RFC-8785 JCS canonicalization and ed25519 — with no access to Sill’s code.
GUARDRAIL RULES — YOU CONFIGURE THESE PER POLICY
| CONTROL | OWASP AGENTIC 2026 | OWASP LLM 2026 | MITRE ATLAS 2026.07 | NIST AI RMF |
|---|---|---|---|---|
| Allowlisted agents onlyr01 | ASI03, ASI10 | — | Initial Access | Manage |
| Require valid IntentMandater02 | ASI01, ASI03 | LLM06 | — | Manage |
| Per-agent rate limitr03 | ASI08 | LLM10 | Impact | Manage |
| Per-IP rate limitr04 | ASI08 | LLM10 | Impact | Manage |
| Max per-transaction spendr05 | ASI01 | LLM06, LLM10 | Impact | Manage |
| Daily spend cap per userr06 | ASI08 | LLM06, LLM10 | Impact | Manage |
| Human review on destructive actionsr07 | ASI08, ASI09 | LLM06 | Impact | Manage |
| No urgency manipulationr08 | ASI09 (partial) | — | — | — |
| No drip pricingr09 | ASI09 (partial) | — | — | — |
| Instruction-override detectionr10 | ASI01 | LLM01 | AML.T0051 (partial) | Measure |
| Geofence (country allow/deny)r12 | — | — | Initial Access | Manage |
| Aggregate rate cap across agentsr13 | ASI08 | LLM10 | Impact | Manage |
| Cart total ≤ Intent ceilingr14 | ASI01 | LLM06 | — | Manage |
| Cart currency must match Intentr15 | ASI01 | LLM06 | — | Manage |
| Per-customer data scoping (BOLA)r17 | ASI03 | LLM06 | Exfiltration | Manage |
| Skill-manifest integrity (pinning)r18 | ASI02, ASI04 (partial) | LLM03 (partial) | AML.T0011.002 (partial) | Measure |
| Subscription requires explicit consentr19 | ASI09 | LLM06 | — | Manage |
| Unicode tag-block detectionr20 | ASI01 | LLM01 | AML.T0051 (partial) | Measure |
| Credential-leak detection (inbound)r22 | ASI02 (partial) | LLM02 (partial) | AML.T0098 (partial) | Measure |
| Mandate validity window capr23 | ASI03 | LLM06 | Evasion | Manage |
| Mandate body size limitr25 | — | LLM10 | — | — |
| Emergency kill switchr28 | ASI08 | LLM10 | Impact | Manage |
| Cross-agent org budget capr31 | ASI08 | LLM06, LLM10 | Impact | Manage |
| Merchant-authored rule (DSL)r_custom | merchant-defined | merchant-defined | merchant-defined | — |
ALWAYS-ON PROTECTIONS — ENFORCED AUTOMATICALLY
| CONTROL | OWASP AGENTIC 2026 | OWASP LLM 2026 | MITRE ATLAS 2026.07 | NIST AI RMF |
|---|---|---|---|---|
| Mandate signature verification (ed25519) | ASI03, ASI10 | — | Initial Access, Evasion; AML.T0096 | Manage |
| Mandate replay protectionr11 | ASI03 | — | Evasion | Measure |
| Failed-auth source-IP lockoutr24 | — | LLM10 | Credential Access | Manage |
| Site-id binding (misdirected-mandate reject) | ASI03 | — | Evasion | Manage |
| Anti-fingerprinting (identity-class coalescing) | — | — | Discovery | — |
| Webhook signature verification (HMAC)r27 | — | — | — | Manage |
| Deterministic evaluation budgets (fail-closed) | ASI08 | LLM10 | Impact | Manage |
| Tamper-evident audit chain (Merkle + ed25519) | ASI06 (partial) | — | — | Measure, Manage |
| PII-redaction architecture | — | LLM02 (partial) | Exfiltration | Manage |
| Agent-bound output sanitizationr21 | — | LLM02, LLM05, LLM07 | AML.T0100 (partial) | — |
| Delegation-chain verificationr29 | ASI07 (registered-agent) | — | — | Manage |
| Cart immutability (folds into envelope signing)r16 | ASI01 | LLM06 | — | Manage |
WHAT WE DON’T CLAIM
See the mappings in action.
Install Sill Discovery in about 90 seconds. The same controls that map to OWASP, ATLAS, and NIST start producing signed audit records on your traffic the moment the embed loads.