Audience. Engineers integrating fasten and membrane into an AI stack.
For the plain-English overview aimed at buyers and compliance readers, see
/why/owasp-llm-top-10/.
This page names the primitive that answers each category and points at the
module or endpoint that implements it. Recipes with SQL, exit codes, and
CI steps live under linked subpages so this catalog stays scannable.
The frame
fasten is the tamper-evident audit substrate. Every write becomes a hash-chained row with a stable identity, correlated by request_id, verified offline.
membrane is the belief layer on top of fasten. Every AI output passes through source-authority arbitration; alternatives that lose are suppressed and recorded, not merged. Actor kind covers user, agent, service, schedule.
fasten fleet is the data plane. Aggregation, compliance reports, tamper-evident archive, tiered retention.
Guardrail toolkits prevent at the model boundary. fasten records and governs at the write boundary. A serious deployment wants both.
The ten categories
LLM01Prompt injection
Primitive
Membrane source-authority ranking. Model outputs enter as low-authority claims. An injection-produced claim gets suppressed against a system-of-record entry and is recorded as a suppressed alternative.
Where implemented
Belief-arbitration in the membrane reducer.
Deeper coverage
Pre-model rails for pattern-based injection detection are on the roadmap.
LLM02Sensitive information disclosure
Primitive
Redaction module in the fasten Python core scrubs configured fields from row detail before persistence. Every row identity hash commits over the redacted form.
Where implemented
The redaction stage runs during row emission, before the hash is computed and the row is appended.
Deeper coverage
Post-model output-side scanning rails on the roadmap.
LLM03Supply chain
Primitive
Every row carries a canonical form identifier that pins its semantic form. A verifier refuses to accept rows whose form is unknown to the verifier, so an SDK compromise cannot silently redefine what a stored record means.
Where implemented
The row schema and the offline verifier both.
Deeper coverage
Model provenance anchor (model id, model version, prompt hash) on the roadmap.
LLM04Data and model poisoning
Primitive
Rows are linked by SHA-256 references so any post-write tampering is detected deterministically. The offline verifier prints the first break, if any.
Ingest-time provenance attestation rails on the roadmap.
LLM05Improper output handling
Primitive
Membrane suppresses claims that violate source authority and preserves them as evidence rather than merging silently. The materialized belief carries the winner plus the suppressed alternatives.
Where implemented
Belief materialization in the membrane repository.
Deeper coverage
Structured-output validation rails on the roadmap.
LLM06Excessive agency
Primitive
Write-layer kill switch. Freezing an actor causes subsequent writes from that actor to be refused with an HTTP 409 and recorded as attempted writes. Same primitive covers a drifting model and a fatigued human approver.
Where implemented
The frozen-sources feature in the membrane API + Frozen Sources panel in the UI.
Deeper coverage
N-way write-layer verbs on the roadmap: transform, quarantine, escalate.
LLM07System prompt leakage
Primitive
Every emit lands in the tamper-evident chain. A leaked prompt is discoverable through a single search across the substrate, not scattered across service logs.
Where implemented
Chain-wide search via the reader endpoint.
Deeper coverage
Proactive prompt-fingerprint scanning rails on the roadmap.
LLM08Vector and embedding weaknesses
Primitive
Every belief names the actor that produced it and its actor kind. Retrieval hits produced by a vector store show up as their own actor kind; disagreements with the system of record land in the suppressed-alternatives ledger.
Where implemented
Actor kind field on every belief plus suppressed-alternatives arrays.
Deeper coverage
Model provenance anchor plus embedding-drift monitoring rails on the roadmap.
LLM09Misinformation
Primitive
Suppressed alternatives on every belief are the misinformation ledger. A live rate of suppressed AI claims per belief is a per-field misinformation signal.
Where implemented
The belief store, exposed by the beliefs endpoint.
Deeper coverage
Self-check policy requiring cited evidence for high-stakes fields on the roadmap.
LLM10Unbounded consumption
Primitive
Kill switch stops a runaway actor at the write boundary. Refused writes are recorded, making cost overruns audit-visible and attributable.
Where implemented
Frozen-sources feature same as LLM06.
Deeper coverage
Rate-limit and budget rails on the roadmap.
Beyond the taxonomy
Four primitives fasten records that OWASP LLM Top 10 does not ask about. Each answers a question a supervisor or regulator will ask in practice.
Same primitive for human and AI. Actor kind on every row covers user, agent, service, schedule. A fatigued human approver at 6pm is audited with the same tool as a hallucinating model at 10am.
Bitemporal replay. Every row carries the fields required to restore state at any earlier timestamp: prev_hash, canonical form identifier, monotonic sequence, verified-at timestamp. Historical replay is deterministic.
Signed evidence pack. A signed pack over an audit-row window. RFC 6962 Merkle root, Ed25519 detached signature, offline verification against public key. Consumable by external GRC integrators.
Regulatory anchoring. Every primitive maps to a specific line in modern model-risk guidance. Board accountability becomes a query against actor kind, not a policy document.
Adopter reading the runbook next? Verification recipe with Python one-liner, exit codes, and CI job template lives at verify offline.