39 · Standards: OWASP and the NIST AI RMF¶

This chapter is for governance and security teams. It says, for each product, which entries of the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026 it maps to, which functions of the NIST AI Risk Management Framework it serves, where each mapping comes from, how to use them as evidence, and what a mapping is not. Every table here is generated from the code that makes the mapping; none is typed into the page.

The sources¶

Each mapping is attributed to what it actually comes from:

Source	Citation	Identifier
Vassilev 2026	A. Vassilev, "Robust AI Security and Alignment: A Sisyphean Endeavor?", IEEE Security & Privacy 24(3):52-58, May/June 2026, §1	doi:10.1109/MSEC.2026.3678214; arXiv:2512.10100
NIST AI 100-1	NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 26 January 2023	NIST AI 100-1; doi:10.6028/NIST.AI.100-1

The AI RMF is NIST AI 100-1, the AI Risk Management Framework 1.0, with its four functions: GOVERN, MAP, MEASURE and MANAGE.
The guardrail categories, A to F, are from A. Vassilev's journal article in IEEE Security & Privacy (2026), which maps each category onto a chain of AI RMF functions. The article is by a NIST scientist; it is not a NIST publication, and the categories are not NIST's. The framework itself maps neither rules nor categories.
NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (24 March 2025), is NIST's taxonomy of attacks, and is cited where this guide uses its attack terms. It classifies attacks, not guardrails.

The categories and the functions the article chains each one to:

Guardrail category	AI RMF functions, in the article's order
A. Input Guardrails	MAP → MANAGE
B. Policy & Governance Guardrails	GOVERN → MAP → MANAGE
C. Model-Level Guardrails	MAP → MEASURE → MANAGE
D. Output Guardrails	MEASURE → MANAGE
E. Action & Execution Guardrails	GOVERN → MANAGE
F. Monitoring, Auditing & Logging Guardrails	MEASURE → MANAGE

The two OWASP lists, each with the edition the mapping was made against. A newer edition is a change to the mapping's data, reviewed, not to this page:

List	Edition	The mapping was made against
OWASP Top 10 for LLM Applications	2026	OWASP Top 10 for LLM Applications 2026, Version 2026: the PDF the official page downloads (sha256 ef87993a4e50ae9d83b41ff7a3d3e6320a82dfa8d4ec6bf98d0ce264b2e6108e), its table of contents and each entry's Description
OWASP Top 10 for Agentic Applications	2026	OWASP Top 10 for Agentic Applications 2026, Version 2026, December 2025: the PDF the official page downloads (sha256 a2db94cd00b08e0b3a5e5b619afe024bdbcd74503111085705e4f3dd886fcb5c), each entry's heading and Description

The Guardrail Bug Hunter, rule by rule¶

The AI RMF¶

Each rule's guardrail category and AI RMF functions, from the rule catalogue. Where a rule's functions are its category's chain, they are the article's; where they differ, they are the catalogue's own judgement, and its reason is given:

Rule	Title	Guardrail category	AI RMF functions	Whose assignment
QG001	Missing check	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG002	Escapable guard	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG003	Multi-turn escape	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG004	Permissive by default	B. Policy & Governance Guardrails	GOVERN, MAP, MANAGE	the article's chain for the category
QG005	Unshippable policy	B. Policy & Governance Guardrails	GOVERN, MAP, MANAGE	the article's chain for the category
QG006	Unverified region	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	the article's chain for the category
QG007	Read before written	B. Policy & Governance Guardrails	MAP, MEASURE	the catalogue's own: a branch reading a variable nothing has set is found by mapping the policy's data flow and measuring the branch it takes; no governance decision is missing
QG008	Call without execute	E. Action & Execution Guardrails	MAP, MANAGE	the catalogue's own: the call never happens, so there is nothing to govern: the finding maps a functional gap and the fix manages it
QG009	Undefined bot message	B. Policy & Governance Guardrails	MAP, MANAGE	the catalogue's own: which replies the author fixed and which the model writes is a map of the policy, and the fix manages the gap; no governance rule is in question
QG010	Dead action	B. Policy & Governance Guardrails	MEASURE, MANAGE	the catalogue's own: whether the action can run at all is measured by a reachability question and managed by the fix; no governance rule is in question
QG011	Confused deputy	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG012	Cascading injection	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG013	Irreversible before undoable	E. Action & Execution Guardrails	MAP, MANAGE	the catalogue's own: the defect is in the order of effects on a path, which is mapped and then managed by reordering or confirming; no governance rule is missing
QG014	Order rule escapable	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG015	Undeclared route	B. Policy & Governance Guardrails	MAP	the catalogue's own: an undeclared edge is a gap in the map of where the graph can go, and declaring it is mapping; nothing is governed or managed until it is declared
QG016	Unmodelled path	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG017	Model writes code that runs	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	the catalogue's own: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG018	Model writes a query or a destination	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	the catalogue's own: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG019	Confidential data leaves	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	the catalogue's own: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG020	Retrieval not bound to the user	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	the catalogue's own: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG021	Untrusted content persisted	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	the catalogue's own: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG022	Rail with a published advisory	B. Policy & Governance Guardrails	GOVERN, MAP	the catalogue's own: which rails a configuration runs, at which versions, is a governance decision and a map of what runs; the finding measures nothing a person has not already reproduced
QG023	Unbounded loop	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	the catalogue's own: the cycle is mapped from the graph or the flow, measured by unrolling it to its budget and managed by the fix; no governance rule is in question
QG101	Unchecked action	B. Policy & Governance Guardrails	MAP	the catalogue's own: a hotspot asks a person to map whether the action needs a control; nothing is governed or managed until they decide
QG102	Write reached by a slip	E. Action & Execution Guardrails	MAP	the catalogue's own: a hotspot asks a person to map whether a write reached by a slip is intended; nothing is governed or managed until they decide
QG103	Irreversible before compensable	E. Action & Execution Guardrails	MAP	the catalogue's own: a hotspot asks a person to map the order of the plan's effects; nothing is governed or managed until they decide
QG104	Check missing against its peers	B. Policy & Governance Guardrails	MAP	the catalogue's own: a hotspot asks a person to map whether the call needs its siblings' control; nothing is governed or managed until they decide
QG105	Unrecoverable write	E. Action & Execution Guardrails	MAP, MANAGE	the catalogue's own: the write's recoverability is mapped and then managed by declaring a compensation or marking it irreversible; no governance rule is missing
QG106	Unpinned tool source	B. Policy & Governance Guardrails	GOVERN, MAP	the catalogue's own: a hotspot asks a person to decide what the agent may run and to map where it comes from; nothing is managed until they decide
QG107	Unauthenticated agent channel	B. Policy & Governance Guardrails	GOVERN, MAP	the catalogue's own: a hotspot asks a person to decide how agents trust each other and to map the channel; nothing is managed until they decide
QG201	Undecided	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	the article's chain for the category
QG202	Undeclared catalogue	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	the article's chain for the category
QG301	Router bypass	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG302	Unsupported argument	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG303	Platform invariant escaped	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG304	Clarification unbounded	B. Policy & Governance Guardrails	MAP, MANAGE	the catalogue's own: an unbounded loop is a property of the router's structure, mapped and then managed by a bound; no governance rule is missing
QG305	Write read as a read	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG306	Wrong write	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG307	Egress through a read	E. Action & Execution Guardrails	GOVERN, MANAGE	the article's chain for the category
QG308	Live collision	B. Policy & Governance Guardrails	MAP, MANAGE	the catalogue's own: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG309	Unroutable tool	B. Policy & Governance Guardrails	MAP, MANAGE	the catalogue's own: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG310	Router out of step	B. Policy & Governance Guardrails	MAP, MANAGE	the catalogue's own: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG311	Unshippable synthesis	B. Policy & Governance Guardrails	MAP, MANAGE	the catalogue's own: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG312	Engine disagreement	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	the article's chain for the category
QG320	Negated write runs	E. Action & Execution Guardrails	MEASURE, MANAGE	the catalogue's own: found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured
QG321	Read words call a write	E. Action & Execution Guardrails	MEASURE, MANAGE	the catalogue's own: found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured
QG322	Hidden egress runs	E. Action & Execution Guardrails	MEASURE, MANAGE	the catalogue's own: found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured
QG323	Write outside its own words	B. Policy & Governance Guardrails	MAP, MEASURE	the catalogue's own: the measurement maps which words reach a write; whether they should is the team's decision, so the finding itself governs and manages nothing
QG324	Unlabelled route to a write	B. Policy & Governance Guardrails	MAP, MEASURE	the catalogue's own: the measurement maps which words reach a write; whether they should is the team's decision, so the finding itself governs and manages nothing

OWASP, at the policy level¶

Every entry of both lists, with the rules that find it, or the reason no rule does. The hunter's rules decide the part of each risk that a policy and its catalogue control: at the policy level, and no further.

The OWASP Top 10 for LLM Applications 2026:

Entry	Title	The hunter's rules, at the policy level
`LLM01:2026`	Prompt Injection	QG011, QG012, QG017, QG018, QG021, QG101, QG322
`LLM02:2026`	Sensitive Information Disclosure	QG019, QG020, QG307, QG322
`LLM03:2026`	Excessive Agency	QG001, QG002, QG003, QG004, QG010, QG011, QG013, QG014, QG101, QG103, QG104, QG105, QG301, QG305, QG320, QG321
`LLM04:2026`	Supply Chain	QG022, QG106
`LLM05:2026`	Data and Model Poisoning	Not covered: a property of training data and model weights, which no guardrail policy decides
`LLM06:2026`	Unbounded Consumption	QG023, QG304
`LLM07:2026`	Misinformation	QG009
`LLM08:2026`	Hidden Context Exposure	QG019
`LLM09:2026`	Vector and Embedding Weaknesses	QG020
`LLM10:2026`	Improper Output Handling	QG017, QG018

The OWASP Top 10 for Agentic Applications 2026:

Entry	Title	The hunter's rules, at the policy level
`ASI01:2026`	Agent Goal Hijack	QG011, QG015, QG101
`ASI02:2026`	Tool Misuse and Exploitation	QG001, QG002, QG004, QG007, QG011, QG014, QG101, QG102, QG104, QG301, QG302, QG305, QG306, QG308, QG320, QG321, QG323, QG324
`ASI03:2026`	Identity and Privilege Abuse	QG003, QG303
`ASI04:2026`	Agentic Supply Chain Vulnerabilities	QG022, QG106
`ASI05:2026`	Unexpected Code Execution (RCE)	QG017
`ASI06:2026`	Memory & Context Poisoning	QG021
`ASI07:2026`	Insecure Inter-Agent Communication	QG012, QG107
`ASI08:2026`	Cascading Failures	QG012, QG013, QG023, QG103, QG105
`ASI09:2026`	Human-Agent Trust Exploitation	QG009, QG102
`ASI10:2026`	Rogue Agents	QG016

Each finding carries the same entries, and so does each rule page (chapter 28).

The other products¶

For the other products, the question is which AI RMF subcategories their outputs serve as evidence for: a certificate under MEASURE, say, or a tool check under MANAGE. That is a claim the company makes, so it lives in one reviewed data file, row by row, each with the date it was reviewed. A product with no reviewed row claims no mapping.