Compliance Controls

Reference

AIControls assesses 38 controls across five frameworks. The Control column is the identifier to use in a policy's proxy.nirmata.io/frameworks annotation — see how coverage is computed.

Framework identifiers

Framework	Annotation prefix	Version	Controls
OWASP LLM Top 10	`owasp`	2025	10
MITRE ATLAS	`mitre`	2024	5
NIST AI RMF	`nist`	1.0	8
OWASP MCP Top 10	`owasp-mcp`	2025-beta	10
EU AI Act	`eu-ai-act`	2024	5

An annotation value combines them with commas: owasp:LLM01,nist:MP-2.3,eu-ai-act:Art.14. One policy can name at most one control per framework — see Coverage comes from your policies.

OWASP LLM Top 10

The Compliance page labels this tab OWASP LLM Top 10; the exported report names the same framework OWASP Top 10 for LLMs. They are one list.

Control	Name	What it covers
`LLM01`	Prompt Injection	Attackers manipulate LLM behaviour through crafted inputs, bypassing instructions or triggering unintended actions.
`LLM02`	Sensitive Information Disclosure	LLMs inadvertently reveal confidential data including credentials, PII, or proprietary information in responses.
`LLM03`	Supply Chain	Vulnerabilities in third-party models, datasets, plugins, or packages used by the AI system.
`LLM04`	Data and Model Poisoning	Training data or model weights are manipulated to introduce backdoors or bias model behaviour.
`LLM05`	Improper Output Handling	LLM outputs are passed to downstream systems without validation, enabling XSS, SSRF, or code injection.
`LLM06`	Excessive Agency	LLM agents are granted more permissions than necessary, enabling unintended or harmful autonomous actions.
`LLM07`	System Prompt Leakage	Confidential system prompts are extracted by adversaries, exposing business logic or enabling targeted attacks.
`LLM08`	Vector and Embedding Weaknesses	Attacks on retrieval-augmented generation (RAG) systems via poisoned vectors or embedding manipulation.
`LLM09`	Misinformation	LLMs generate plausible but false information, potentially used to deceive users or downstream systems.
`LLM10`	Unbounded Consumption	Unrestricted LLM usage leads to denial of service, excessive costs, or resource exhaustion.

MITRE ATLAS

Control	Name	What it covers
`AML.T0012`	Valid Accounts	Adversaries use legitimate AI system credentials to access models or agent infrastructure without authorization.
`AML.T0024`	Exfiltration via ML Inference API	Sensitive training data or confidential information is extracted through carefully crafted model queries.
`AML.T0040`	ML Model Inference API Access	Adversaries gain unauthorized access to model inference APIs to probe behaviour or extract information.
`AML.T0048`	Backdoor ML Model	Hidden behaviours are inserted into AI models during training or fine-tuning to trigger on specific inputs.
`AML.T0051`	LLM Plugin Compromise	External plugins or tools connected to LLMs are compromised to hijack agent actions or exfiltrate data.

NIST AI RMF

Controls are identified by the framework's own function prefixes — GV (Govern), MP (Map), MS (Measure), and MG (Manage).

Control	Name	What it covers
`GV-1.1`	AI Risk Policies Established	The organization has established AI risk management policies that are actively enforced at runtime.
`GV-1.2`	AI Risk Roles and Responsibilities	Roles and responsibilities for AI risk management are defined and assigned across the organization.
`MP-2.3`	Access Controls Applied	Tool access is controlled via allow/deny policies enforced before each call.
`MP-4.1`	Data Protection Mechanisms	Mechanisms are in place to detect and prevent sensitive data exposure through AI system interactions.
`MS-2.5`	AI System Behaviour Monitored	Every AI tool call is observed and logged for retrospective analysis and compliance evidence.
`MS-2.6`	AI Behaviour Analysis and Anomaly Detection	AI system behaviour is analysed for anomalies, drift, and unexpected patterns relative to baselines.
`MG-3.1`	Human Oversight Mechanisms	High-risk AI actions can be escalated to human approvers before execution.
`MG-4.2`	Incident Response	Governance events (denials, escalations) trigger notifications to external systems for incident response.

OWASP MCP Top 10

Control	Name	What it covers
`MCP-01`	Token Mismanagement & Secret Exposure	Hard-coded credentials, long-lived tokens, secrets in model memory or logs leading to full system compromise.
`MCP-02`	Privilege Escalation via Scope Creep	Loosely defined permissions expand over time, granting excessive capabilities such as repo modification or data exfiltration.
`MCP-03`	Tool Poisoning	Compromised tool descriptions, rug pulls, schema poisoning, or tool shadowing manipulate agent behaviour.
`MCP-04`	Software Supply Chain Attacks	Compromised dependencies introduce backdoors via unsigned components, unverified tool servers, or supply chain tampering.
`MCP-05`	Command Injection & Execution	Agents construct OS commands from untrusted input without sanitisation, enabling arbitrary code execution.
`MCP-06`	Intent Flow Subversion	Malicious instructions in retrieved context hijack agent goals via prompt injection through MCP tool responses.
`MCP-07`	Insufficient Authentication & Authorization	Missing identity validation and weak access controls across multi-agent, multi-service ecosystems.
`MCP-08`	Lack of Audit and Telemetry	Limited logging of tool invocations impedes incident investigation and compliance evidence.
`MCP-09`	Shadow MCP Servers	Unapproved MCP deployments outside governance with default credentials and permissive configurations.
`MCP-10`	Context Injection & Over-Sharing	Shared persistent context windows expose data across sessions, users, or agents.

EU AI Act

Controls are the article numbers governing high-risk AI systems.

Control	Name	What it covers
`Art.9`	Risk Management System	A risk management system is established, implemented, documented, and maintained for high-risk AI systems.
`Art.10`	Data Governance	Training, validation, and testing data is subject to appropriate data governance and management practices.
`Art.13`	Transparency	High-risk AI systems are designed to ensure sufficient transparency to enable users to interpret and use outputs appropriately.
`Art.14`	Human Oversight	High-risk AI systems are designed to enable effective human oversight, including the ability to intervene and stop the system.
`Art.15`	Accuracy, Robustness, and Cybersecurity	High-risk AI systems are designed to achieve appropriate levels of accuracy, robustness, and cybersecurity.

note

The EU AI Act articles reach well beyond what a runtime governance proxy observes — Art.10 also covers how training and validation data is managed, and Art.15 covers model accuracy. AIControls reports coverage for the part it can evidence: the shipped prompt-scanning policy maps to Art.10 because data flowing into a model is a data-governance concern it can see. Treat a covered article as evidence for one aspect of it, not as a compliance determination for the whole article.

Framework identifiers​

OWASP LLM Top 10​

MITRE ATLAS​

NIST AI RMF​

OWASP MCP Top 10​

EU AI Act​

See also​