OWASP LLM Top 10
Guardrail toolkits prevent at the model boundary. fasten records and governs at the write boundary. A serious AI deployment wants both. This page is what fasten guarantees to a supervisor or regulator, category by category, in plain English.
Prevent
Guardrail toolkits
Intercept prompts and responses at the model boundary. Refuse jailbreaks. Redact PII. Score for hallucination. Great at stopping. Not designed to prove what happened.
Govern
membrane
Belief-arbitration layer on fasten. Every model output is a claim; source authority decides what commits. Suppressed alternatives kept as evidence, not merged.
Prove
fasten
Tamper-evident audit substrate under everything. Every decision the system committed to is a hash-chained row a supervisor can hold the entity to. Verifiable offline.
One card per OWASP LLM Top 10 category. Click the marker under each card for a deeper cut.
AI outputs are ranked, not trusted. An injected instruction loses to your system of record and is recorded as a suppressed claim, not committed.
Every belief in membrane names a winning source. When an injected prompt gets a model to produce a claim about state, the source-authority policy suppresses that claim in favour of the system of record. Both the winner and the suppressed alternative land in the audit trail. Injection cannot commit to state; it can only leave a suppressed footprint the auditor can search.
Sensitive fields are redacted before persistence. Every commit is over the redacted form, so the tamper-evident record cannot leak what was scrubbed.
A redaction stage runs before every audit-row write. The row's identity hash commits to the redacted payload. Recovering the original from the chain is not possible even for an operator with full read access. The scan for LLM02 is a query against the actor kind that produced the row, not a raw grep against sensitive fields.
Every row pins the semantic form it was recorded under. A supply-chain compromise cannot silently redefine what a stored record means.
Each row carries a canonical form identifier plus the model provenance (model id, model version, prompt hash). A verifier that does not recognise the form refuses to accept the row into a chain check. Downstream compromise of a model or vendor library shows up as a form-version drift instead of a silent semantic shift.
Hash chain detects any post-write tampering deterministically. Run the offline verifier and get a yes-or-no answer, not a hunch.
Rows are linked by SHA-256 references so a tampered row breaks the chain at its exact position. The verifier prints the first break, if any, with no ambiguity. Because verification runs offline against a snapshot, the entity being audited cannot influence what the verifier sees.
AI outputs that violate the source authority policy are suppressed and kept as evidence, never silently merged into state.
membrane's belief arbitration records the winning claim plus every alternative it beat. A malformed or off-policy output never enters the committed state; it enters the suppressed-alternatives ledger where it stays for audit and drift analysis.
Write-layer kill switch. Freeze any actor, human or AI, and every subsequent attempt is refused and recorded.
Freezing a source is one API call. Writes from a frozen source get a clear refusal and land in the chain as an attempted write. Reversal is one click. The same primitive covers a drifting model and a fatigued human approver; you do not need two policies for two actor kinds.
Every emit lands in the tamper-evident chain. A leaked prompt is discoverable in one place, not scattered across logs across services.
Because every write threads through a single audit substrate, a search against the system-prompt fingerprint runs once and covers every actor that touched the entity. Zero matches means the prompt did not enter recorded state; a match names the row and the actor.
Every claim carries the actor that produced it. Poisoned embeddings show up as a disagreement waterfall against the system of record.
Retrieval hits produced by a vector store are recorded under their own actor kind in the audit trail. When they disagree with the system of record, the disagreement enters the suppressed-alternatives ledger, along with the retrieval source. A drift toward embedding poisoning is visible as a shift in the disagreement rate for that actor.
The suppressed-alternatives ledger is the misinformation record. Every rejected AI claim is preserved for audit and drift analysis.
membrane never silently merges an AI claim into state. Either the claim wins over the system of record on authority (rare, deliberate) or it is suppressed and kept. The rate of suppressed AI claims per belief is a live per-field misinformation signal, not a metric to compute from partial telemetry.
Kill switch stops a runaway source at the write boundary. Cost overruns are audit-visible and attributable to a specific actor.
A runaway model or agent is one freeze away from being stopped. Every subsequent attempt is refused with a clear signal to the caller and a row on the chain. Post-mortem attribution takes one query: which actor was refused the most times in the window.
Four primitives fasten records that OWASP LLM Top 10 does not ask about, each answering a question a supervisor or regulator will ask.
One field distinguishes user, agent, service, and schedule. A fatigued approver is audited with the same tool as a hallucinating model.
Restore the exact state the system committed to at any earlier timestamp. Not a stitched reconstruction from partial telemetry.
A signed pack over any audit window. External auditors verify offline against the public key. Merkle roots for inclusion proofs.
Every primitive maps to specific clauses in modern model-risk guidance. Board accountability becomes a query against actor kind, not a policy document.
Every answer on this page runs against a live membrane instance. Bring up the dev stack, seed a project, and every card here becomes a queryable surface. For the auditor's recipe including a Python one-liner and a CI job template, follow the technical runbook.
fasten is Apache-2.0. membrane runs on top. Together they answer the LLM Top 10, plus the questions your supervisor will actually ask.