Compliance and framework mappings

Sill publishes framework mappings, not certifications. A mapping shows which Sill controls address which risks in a public security framework. Sill maps to four frameworks: the OWASP Top 10 for Agentic Applications, the OWASP Top 10 for LLM Applications, MITRE ATLAS and the NIST AI Risk Management Framework.

Sill holds no SOC 2 attestation, no ISO 27001 certification and no PCI attestation, and will not claim any certification until an accredited audit is complete.

Mappings are not certifications

A mapping is Sill’s own statement of where its controls address a framework’s risks, based on the published descriptions. A certification is an independent audit by an accredited body. You can use Sill’s mappings to inform your own assessment; your auditor decides what they accept.

Frameworks Sill maps to

Framework	Edition	Source
OWASP Top 10 for Agentic Applications	2026 (v1.0)	genai.owasp.org
OWASP Top 10 for LLM Applications	2026	genai.owasp.org
MITRE ATLAS	2026.09	atlas.mitre.org
NIST AI RMF	1.0	nist.gov

The full control-by-control table, with the status of each control, is at sill.so/standards. Transactional audit bundles include a Framework alignment section drawn from the same table.

The Agentic Top 10 is Sill’s primary OWASP reference. OWASP’s 2026 editions split the scope: the LLM Top 10 covers the model as a component, and the Agentic Top 10 covers the model as an actor that uses tools and causes real effects — which is where Sill operates.

OWASP Top 10 for Agentic Applications

ASI03 Identity & Privilege Abuse and ASI10 Rogue Agents — covered: agent registration, signed-mandate verification, per-customer data scoping and key revocation.
ASI07 Insecure Inter-Agent Communication — covered for delegation between registered agents (delegation-chain rule r29). Not covered for agents outside the registry.
ASI01, ASI02, ASI04, ASI06, ASI08, ASI09 — partly covered.
ASI05 Unexpected Code Execution — out of scope. Sill authorizes actions; it does not run agent code.

OWASP Top 10 for LLM Applications

LLM01 Prompt Injection — instruction-override detection (r10) and hidden Unicode tag detection (r20).
LLM02 Sensitive Information Disclosure — partly covered: inbound credential-leak detection (r22) and outbound response sanitization (r21).
LLM06 Excessive Agency — most of the policy catalog: signed mandates, per-transaction and daily spend caps, human review of destructive actions, cart and currency checks, subscription-consent and delegation-window rules.
LLM10 Unbounded Consumption — rate limits, size limits, evaluation budgets and the emergency stop.

Model training, data poisoning and embedding risks are outside what an authorization layer can address, and Sill does not claim them.

MITRE ATLAS

AML.T0096 (AI service used for command and control) — covered by mandate verification.
AML.T0131 (Crafted AI Assistant Links) and AML.T0132 (Misconfigured or Exposed AI Services) — covered.
AML.T0011.002 (Poisoned Agent Tool) — partly covered by skill-manifest pinning (r18).
AML.T0098 (agent credential harvesting) — partly covered by inbound credential detection (r22).
AML.T0133 (Discover AI Agent Runtime Capabilities) — partly covered.
AML.M0037 (AI Agent Authority Expansion Controls) — covered; AML.M0038 (AI Agent Scope Drift Detection) — partly covered.
AML.T0100 (AI Agent Clickbait) — not covered: poisoned content reaches the agent before it sends Sill an order.

NIST AI RMF

Sill’s signed, Merkle-chained audit log and bundle export support the Measure and Manage functions: each decision produces a record that an auditor or risk owner can verify independently. The mapping is at function level.

Card data (PCI)

Sill handles only payment tokens issued by your processor (Stripe pm_…, tok_… and Shared Payment Token references). Card numbers never enter Sill: Stripe holds the card, charges it and pays you out, and an automated check on every change to Sill’s code rejects anything that looks like card data. This is a design property, not a PCI certification. See Security and Stripe’s PCI guidance.

What Sill does not claim

SOC 2 — no attestation.
ISO 27001 / 27701 — no certification.
PCI DSS — no certification (see above).
EU AI Act — no conformity claim. The audit log records which reviewer approved an escalated order and when, which you may use in your own record keeping.
GDPR — no certification claim. Account deletion erases personal data after a 30-day grace period and keeps the audit log in anonymized form; see Security → Data retention and deletion.
Data residency — Sill runs in the US East region only.

Frequently asked

Can I use Sill’s mappings in my own SOC 2 or ISO audit? You can offer the mappings, your exported audit bundles and the public verification method as evidence. Your auditor decides what they accept.

Why these four frameworks? The two OWASP lists cover the risks of AI agents and the models behind them, MITRE ATLAS is the attack catalog red teams use, and NIST AI RMF is the governance framework procurement reviews most often ask about.

How do signatures fit in? Because audit records are signed and published keys are public, anyone can check that a record is genuine and unchanged. That independent check is what supports the NIST AI RMF mapping. See Verify a signature.

How are mappings kept current? Sill reviews its mappings when a framework publishes a new edition and updates sill.so/standards and this page together.