# 🔱 Trishul — AI Security & Compliance Mapping

Trishul is a **runtime security control** for LLM applications. It maps directly to the recognized AI-security and governance frameworks. Live machine-readable version: [`GET /api/frameworks`](https://trishul.aiskillhub.info/api/frameworks). Every guard response also carries the specific framework IDs it enforced against (`frameworks.owaspLlm`).

> **Scope disclaimer.** Trishul *supports* compliance; it does not by itself *constitute* legal or regulatory compliance. Pair it with organizational policy, a signed DPA, lawful basis for processing, and review by qualified counsel. Coverage below is labelled honestly: **addressed** (a rail directly enforces), **partial** (mitigated, needs more), **governance** (process/logging support).

---

## OWASP Top 10 for LLM Applications (2025)

| ID | Risk | Coverage | Trishul control |
|----|------|----------|-----------------|
| **LLM01:2025** | Prompt Injection | ✅ addressed | **Input rail** — two-layer detection (normalized heuristics + LLM-judge). **Retrieval rail** — indirect-injection scan of RAG chunks. |
| **LLM02:2025** | Sensitive Information Disclosure | ✅ addressed | PII/secret masking on input and in retrieved context; **Output rail** blocks leaked secrets, echoed PII, system metadata. |
| **LLM03:2025** | Supply Chain | 🔵 governance | Zero runtime dependencies; model-agnostic upstream holding no provider key. Vetting upstream models/plugins stays an org control. |
| **LLM04:2025** | Data & Model Poisoning | 🟡 partial | **Retrieval rail** rejects poisoned/injection-laden context at inference time. Training-time poisoning is out of scope for an inference guardrail. |
| **LLM05:2025** | Improper Output Handling | ✅ addressed | **Output rail** verifies responses for secret/PII leaks, raw SQL/error dumps and unsafe content before they reach the caller — including streaming, chunk-by-chunk. |
| **LLM06:2025** | Excessive Agency | ✅ addressed | **Execution rail** risk-scores every tool call; destructive ops and off-domain data egress are denied or routed to **human-in-the-loop** approval. |
| **LLM07:2025** | System Prompt Leakage | ✅ addressed | **Input rail** detects system-prompt-extraction attempts; **Output rail** flags system-metadata / initial-prompt disclosure. |
| **LLM08:2025** | Vector & Embedding Weaknesses | 🟡 partial | **Retrieval rail** guards content pulled from a vector store (injection + PII in chunks). Embedding-store access control is a data-layer concern. |
| **LLM09:2025** | Misinformation | 🟡 partial | **Output rail** flags hallucinated tool confirmations. Full factuality/grounding against tool-call logs is the documented V2. |
| **LLM10:2025** | Unbounded Consumption | ✅ addressed | Per-tenant usage metering, a cost ceiling on the LLM-judge, and a **fail-closed circuit breaker** on enforcement degradation. |

**Coverage: 6 addressed · 3 partial · 1 governance.**

---

## MITRE ATLAS (adversarial ML techniques)

| Technique | Name | Rail |
|-----------|------|------|
| `AML.T0051` | LLM Prompt Injection | Input, Retrieval |
| `AML.T0054` | LLM Jailbreak | Input |
| `AML.T0057` | LLM Data Leakage | Output |
| `AML.T0053` | LLM Plugin Compromise (unsafe tool use) | Execution |

Runtime detections carry these IDs so findings feed straight into an ATLAS-aligned threat model.

---

## Governance & regulatory posture

| Framework | Posture | How Trishul supports it |
|-----------|---------|-------------------------|
| **NIST AI RMF 1.0** | supports | *Govern* — policy-as-code. *Map* — the five-rail threat-surface model. *Measure* — audit log + published benchmark/evals + latency telemetry. *Manage* — inline enforcement + circuit breaker. |
| **EU AI Act** | supports | Logging/traceability, human oversight (HITL), and runtime risk controls that deployers of high-risk AI systems need. Not a standalone conformity assessment. |
| **ISO/IEC 42001** (AI Management System) | supports | Operational controls: documented policy, continuous monitoring/telemetry, and audit trails for the AI system. |
| **India DPDP Act, 2023** | supports | PII detection & data minimization (Aadhaar/PAN + global secrets), in-region processing on self-host/VPC, audit of processing. Consent & notice remain the data fiduciary's duty. |
| **GDPR** | supports | Data minimization via masking, no third-party key custody, self-hostable for data residency. A DPA and lawful basis remain the controller's responsibility. |

---

## Data-handling guarantees (built in)

- **Raw secrets are never echoed** in any API response, telemetry field, or audit log — findings carry the *type* and *location*, never the value.
- **Data minimization** — PII is masked before the prompt reaches the model and before a response reaches the user.
- **No provider-key custody** — Trishul is model-agnostic; in gateway mode it holds no external key, and self-host keeps prompts in your environment.
- **Auditability** — every rail decision is written to an append-only audit log (`db.appendAudit`).
- **Residency** — self-host / VPC deployment keeps all data in-region (relevant for DPDP + GDPR).

## Legal documents

Starter templates are provided under [`docs/legal/`](./legal/) — **Terms of Service**, **Privacy Policy**, **Data Processing Addendum**, and **Refund & Cancellation Policy**. They are drafts to be reviewed and adapted by qualified counsel before use; they are not legal advice.

*Machine-readable coverage: `GET /api/frameworks`. Last reviewed: 2026-07-09.*