The check catalog

The reviewer's checklist, run before the review.

A CISO vets your AI application on four things: what the agent can touch, what it records, where data goes, and whether it can be talked out of its instructions. We test all four, map every result to the standard they already cite, and sign it.

Run the free scan See a sample report

Four pillars · eight ASR controls Six frameworks in the crosswalk Every finding signed · verifies offline

01 / What a reviewer flags

A questionnaire stopped clearing it.

Once your agent touches customer data and acts on its own, the reviewer stops reading answers and starts asking for evidence. Three findings draw the first red marks.

highASR-1 · least privilege

More access than the job needs

The first thing a reviewer circles, and the hardest to see from inside.

In the signed sample, the support agent grants 10 tools, uses 4, on one shared key.

highASR-2 · audit trail

A log nobody can trust

If the record can be edited after the fact, it is not evidence.

Reviewers want it append-only and hash-chained, and they want to check, not ask.

mediumASR-3 · data egress

Data that leaves in the clear

Where data goes, and whether sensitive fields are masked first, decides the sign-off.

Every destination enumerated, redaction proven before anything leaves.

02 / The four pillars

Four pillars. Every check has a control behind it.

We test what the reviewer tests. Each pillar carries a control id that traces to the crosswalk below. The method behind the catalog is published on the research page.

AUDIT PIPELINE / PILLAR x CONTROLlive

Input

Agent logs

Import a log or attach the sidecar proxy. The pillars are read from what the agent did.

importor sidecar

Engine

Audit run

Permissions, audit trail, egress and injection: every pillar runs inside this audit.

ASR-01.. ASR-08

Output

Signed report

The findings are canonicalized and sealed. Every pillar lands in the signed object.

Ed25519envelope

Verify

Buyer checks it

Offline, against the key inside the report. kolm is never in the trust path.

VALIDoffline

PIPELINE permissions, audit trail, egress, injection in the signed report

Pillar 01 · Permissions

Least privilege

Scopes held versus scopes used. Shared keys, standing grants, and high-impact actions reachable without confirmation, surfaced with the calls that prove them.

ASR-1 · maps to SOC 2 CC6

Pillar 02 · Audit trail

A record that cannot be edited

Append-only, hash-chained, retained, so the record a reviewer reads is the record that happened.

ASR-2 · maps to EU AI Act Art.12

Pillar 03 · Data egress

Where data goes, and what is masked

Every destination the agent can reach, the sub-processors behind them, and proof that sensitive fields are redacted before they leave.

ASR-3 · maps to OWASP LLM02

Pillar 04 · Injection

Can it be talked out of its rules

Direct and indirect injection, guardrail bypass, and system-prompt extraction, run as a battery with reproductions. Tested and reported, not warranted.

ASR-4 · maps to OWASP LLM01

Four more controls extend the pillars · ASR-5 provenance · ASR-6 evidence · ASR-7 memory and retrieval integrity · ASR-8 multi-agent delegation · all eight appear in the crosswalk

03 / The crosswalk

Eight controls, mapped to the standard your buyer cites.

One row per control. Every finding in the signed report points back to a row here, so a reviewer traces each result to a standard, not to our word. Framework dates live on the regulatory clock.

SOC 2 ISO 42001 NIST AI RMF EU AI Act Art.12 / 14 OWASP LLM & Agentic MITRE ATLAS

Control	What it checks	Maps to
ASR-1 Least privilege	Scopes the agent holds versus the scopes it uses	SOC 2 CC6 · OWASP ASI03 · NIST MANAGE-1
ASR-2 Audit trail	Append-only, hash-chained, retained activity log	EU AI Act Art.12 · SOC 2 CC7
ASR-3 Data egress	Destinations, approved sub-processors, redaction	OWASP LLM02 · EU AI Act Art.10
ASR-4 Injection	Instruction hijack, indirect injection, guardrail bypass	OWASP LLM01 · MITRE ATLAS AML.T0051
ASR-5 Provenance	Model and dependency provenance	ISO 42001 A.10 · OWASP ASI04
ASR-6 Evidence	Signed, logged, offline-verifiable report	SOC 2 CC7 · CSA AICM A&A-02
ASR-7 Memory and retrieval integrity	Retrieval sources enumerated and trusted; memory writes integrity-linked	OWASP ASI06 · OWASP LLM08 · MITRE ATLAS AML.T0070
ASR-8 Multi-agent delegation	Handoffs attributable; sub-agents attenuated to a subset of authority	OWASP ASI03 · OWASP ASI07 · CSA AICM IAM-16

Eight controls · Six frameworks · the mapping travels inside the signed object: follow any finding to its control, and that control to the clause the reviewer reads from. kolm maps findings to standards, it never certifies compliance.

The same controls, read a second way: which pillar each one sits under, and how it is evaluated. Assessed (a posture is examined and stated)Assessed means we examine a posture, for example scopes held versus scopes used, and state what we find. It is a measured fact about the setup. means a posture is examined and stated as a fact. Tested (probes are run and the outcome is reported)Tested means we run live probes, for example injection attempts, and report exactly what held and what did not. It is reported, not warranted. means probes are run and the outcome is reported, never warranted.

CONTROL MATRIX / PILLAR x METHODlive

Control	Pillar	Assessed posture	Tested and reported	In the signed report
ASR-1 Least privilege	Permissions	yes	no	yes
ASR-2 Audit trail	Audit trail	yes	no	yes
ASR-3 Data egress	Data egress	yes	partial	yes
ASR-4 Injection	Injection	no	yes	yes
ASR-5 Provenance	Permissions	yes	no	yes
ASR-6 Evidence	Audit trail	yes	no	yes
ASR-7 Memory and retrieval	Data egress	yes	partial	yes
ASR-8 Multi-agent delegation	Permissions	yes	partial	yes

EIGHT CONTROLS mapped, assessed, tested in the signed report

04 / What we do not warrant

An accurate report names its edges.

The scope statement is part of the signed object, so a reviewer reads it with the findings.

Assessed

Stated as a posture

Permission posture against what the agent uses
Redaction of sensitive fields before egress
Audit-trail integrity, append-only and hash-chained

Tested and reported

Shown, not promised

Injection runs as a battery with reproductions a reviewer can replay. We report what held and what did not. We do not warrant that the agent is secure, and you should distrust anyone who does.

ASR-4 · OWASP LLM01 · MITRE ATLAS AML.T0051

Scope is contractual. Permission posture, redaction and audit-trail integrity are assessed. Injection is tested and reported, not warranted.

Run the catalog against your application.

Four pillars, eight controls, each mapped to the framework your buyer cites, in a signed report they verify offline.

Run the free scan See a sample report

Ed25519-signed Offline-verifiable Sample report

Caveats: Scope is contractual. Permission posture, redaction and audit-trail integrity are assessed. Injection is tested and reported, not warranted.