Repository navigation
Add a control map for OWASP ASI, FINOS AIGF and NIST CAISI - #15
Merged
Merged
Conversation
Maps each JamJet open-source control to the OWASP Top 10 for Agentic Applications 2026, the FINOS AIGF agentic catalogue (with mi-24 item by item) and the NCCoE agent identity and authorization themes. Every row names the component, the version or PR, and a status. Gaps are listed as Not covered.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🟡 Changes recommended
The map includes a future verification date, an undefined branch-only status, and unreleased tenant behavior presented as released.
1 open finding
What changed in this PR
Adds an open-source control map aligning JamJet capabilities and gaps with OWASP ASI, FINOS AIGF, and NIST guidance.
Changes:
- Documents framework mappings, release status, gaps, and pending dependencies.
- Adds the control map to the Reference index and navigation.
| File | Description |
|---|---|
content/docs/en/reference/control-map.mdx |
Adds the control mapping and supporting sources. |
content/docs/en/reference/index.mdx |
Links the map from the Reference landing page. |
content/docs/en/reference/meta.json |
Adds the map to Reference navigation. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| | Status | Meaning | | ||
| |---|---| | ||
| | Implemented (released) | In a published package or tagged release listed under Components. | | ||
| | Implemented (unreleased, PR) | Written and tested, but in an open pull request or a merged change that has not been published yet. The row names it. Do not rely on it until it ships. | |
The rows that cited open PRs and the approval-deadlines branch were written before that work merged. jamjet #140 to #146, jamjet-policy #12 and #14, agentboundary #5, engram #11 and jamjet-guardrails #44 are now on main but not published, so those rows stay unreleased and their links point at main and the merged PR numbers. Reading main also showed two released rows were wrong. In crates 0.5.0 the Agent Card's iteration and tool-call limits are compared with counters nothing increments and the circuit breaker never trips, so the ceilings and breaker rows now cite #146 as unreleased and the 0.5.0 row covers only the workflow token and cost budget, as Partial. New rows cover what main now enforces: Agent Card tool lists and allowed_delegations at the shared guard (#145), autonomy limits (#146), Ed25519 audit signing (#145), Cedar at ext-authz (jamjet-policy #14) and Engram revocation (engram #11). The status counts are recounted from the rows.
sunilp
marked this pull request as ready for review
October 11, 2026 03:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
reference/control-map: JamJet's open-source controls mapped to the OWASP Top 10 for Agentic Applications 2026 (ASI01 to ASI10), the FINOS AIGF agentic catalogue (mi-18 to mi-25, plus mi-24 item by item) and the NIST CAISI / NCCoE agent identity and authorization themes. Each row names the component, the version or PR, a status and a source link. It is linked from the Reference index and nav.Framework IDs and titles come from the fetched texts: the OWASP PDF (Version 2026, December 2025), finos/ai-governance-framework at a149dd1, and the NCCoE concept paper (initial public draft, 5 Feb 2026). JamJet Cloud is out of scope. The page states that the runtime is single-tenant and claims no tenant isolation.
Re-checked against main (2026-10-11)
Every row that cited a PR, a branch or unpublished work was re-checked against the code on main after jamjet #140 to #146, jamjet-policy #12 to #14, agentboundary #5, engram #11, jamjet-guardrails #44 and jamjet-docs #16 merged. None of that work is published yet, so its rows stay "Implemented (unreleased, PR #n)" or "Partial (unreleased, PR #n)". Branch links (approval-deadlines, scitt-alignment) now point at main, and branch citations now name the merged PR.
Two rows that claimed released behavior were wrong and are corrected: in crates 0.5.0 the Agent Card's iteration and tool-call limits are never counted and the circuit breaker never trips. The ASI08 breaker row now cites #146 (unreleased), and the ASI02 0.5.0 row covers only the workflow token and cost budget, as Partial.
New rows, each pointing at the enforcing code on main: Agent Card
allowed_tools/blocked_tools/require_approval_forandallowed_delegations(#145,node_guard.rs), Agent Card autonomy limits (#146,agent_limits.rs), Ed25519 audit signing for non-repudiation (#145, Partial: the runtime signs, approvers do not), Cedar at ext-authz (jamjet-policy #14) and Engram revocation (engram #11, Partial, ASI06).Status counts were recounted by script from the rows: 9 released, 26 unreleased, 21 partial, 13 not covered, 69 rows (was 11 / 21 / 17 / 14, 63 rows).
Found while checking, not changed here
open-source/enterprise.mdxtenancy and OAuth overclaims are corrected by docs: correct tenancy and OAuth claims the runtime does not support #16.allowed_tools(#145).Verification
npm run buildpasses (357 static pages). The rendered page has 8 tables and no unresolved reference links.🤖 Generated with Claude Code