Skip to main content
Grantex provides technical controls that can be mapped to widely used AI agent security and risk-management frameworks. This page documents current mapping posture and the corresponding Grantex feature areas without claiming formal third-party attestation unless separately stated.

​
OWASP Agentic Security Top 10

Published December 2025 — the first industry-standard threat taxonomy for autonomous AI agents.
RiskDescriptionGrantex ControlImplementation
ASI-01Agent goal hijackingScoped permissionsJWT scp claim limits actions regardless of agent intent. A hijacked agent cannot exceed its granted scopes.
ASI-03Identity & privilege abusePer-agent cryptographic identityEach agent gets a unique DID. The agt claim binds tokens to specific agents. Tokens are non-transferable.
ASI-05Privilege escalationDelegation invariantsChild scopes must be a strict subset of parent scopes. delegationDepth claim enforced at protocol level.
ASI-10Rogue agents (no revocation)Instant cascading revocationPOST /v1/tokens/revoke blocklists the JTI. All child delegations invalidated in the same operation.

​
EU AI Act

Binding August 2026 — the world’s first comprehensive AI regulation.
ArticleRequirementGrantex ControlImplementation
Art. 9Risk management per AI systemBudget controls + anomaly detectionPOST /v1/budget/allocate sets spending limits. Anomaly detection flags unusual patterns. Policy-as-code (OPA, Cedar) for fine-grained rules.
Art. 13Transparency for autonomous actionsConsent flow + Verifiable CredentialsHuman sees plain-English consent screen. VC-JWTs provide portable proof of authorization. SD-JWT enables selective disclosure.
Art. 14Human oversight — logged & auditablePrincipal dashboard + event streaming + revocationGET /v1/events/stream (SSE) surfaces actions in real time. Principal Sessions dashboard. One-click cascade revocation.

​
NIST AI Risk Management Framework

Active now as voluntary risk-management guidance; useful for US government and federal-contractor alignment where applicable.
ControlRequirementGrantex ControlImplementation
Govern 1.1AI roles & accountabilityGrant-to-human traceabilityEvery JWT carries sub (human principal), dev (developer), and agt (agent). The accountability chain is unbroken.
Map 5.1Agent action attributionAudit trail linked to grantsPOST /v1/audit/log records actions. Each entry references the grantId and agentId. Entries are hash-chained.
Measure 2.5Audit trails for autonomous operationsHash-chained, append-only auditAudit entries are append-only, hash-chained (tamper-evident), filterable by agent/grant/principal/time, and exportable via compliance evidence packs.

​
Full Compliance Matrix

RequirementFrameworkGrantex FeatureVerification Method
Scoped permissionsOWASP ASI-01JWT scp claimService verifies scope before executing action
Per-agent identityOWASP ASI-03DID per agent, agt claimSignature verification against agent’s public key
Delegation depth limitsOWASP ASI-05delegationDepth claimProtocol rejects invariant-violating delegations
Instant revocationOWASP ASI-10Redis blocklist + StatusList2021POST /v1/tokens/verify returns valid: false
Risk managementEU Art. 9Budgets, anomaly detection, policiesAPI endpoints + dashboard monitoring
TransparencyEU Art. 13Consent flow, VCs, SD-JWTConsent URL, credential verification
Human oversightEU Art. 14Events, principal sessions, revocationSSE stream, dashboard, API
AccountabilityNIST Govern 1.1sub + dev + agt claimsJWT decode traces action to human
Action attributionNIST Map 5.1Hash-chained audit entriesGET /v1/audit/entries with filters
Audit trailsNIST Measure 2.5Append-only, exportable auditEvidence pack export via API

​
Compliance Evidence Pack

Grantex can generate a compliance evidence pack that bundles all relevant data for auditors: 
# Generate a compliance evidence pack via CLI
grantex compliance export --format json --from 2026-01-01 --to 2026-03-28

# Or via API
curl -X POST https://api.grantex.dev/v1/compliance/evidence \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"from": "2026-01-01", "to": "2026-03-28"}'
The evidence pack includes:
  • All grants issued in the period
  • Token issuance and revocation events
  • Audit trail entries (hash-chained)
  • Agent registrations and delegation chains
  • Policy snapshots
  • Anomaly detection findings

​
Evidence And Standards Mappings

  • SOC 2 — readiness control mapping published; formal third-party attestation is not published. View mapping
  • IETF Internet-Draft — preparation track only; no IETF submission, working-group adoption, RFC approval, or standards status is claimed. Internal Commerce V1 C6T materials define the draft outline and review gates.
  • NIST AI RMF — mapping and whitepaper preparation track only; no NIST submission, public comment submission, NCCoE acceptance, or NIST approval is claimed. Internal Commerce V1 C6T materials define the candidate reference architecture and control-map outline.
  • OpenID AuthZEN — conformance mapping complete. View mapping