Translation
Translated from the Spanish source, which is the normative text. Status: draft pending human review. Differences are resolved in the Spanish text.
External contrast frameworks¶
Verified on 27 and 28 Sep 2026. It declares no conformance or certification with any of these frameworks.
These frameworks are used to check that the requirements do not leave out known risks. An external framework informs the design; it does not thereby become an axiom of ASILO or MILPA. That a requirement cites a category does not mean it covers it completely.
Sources and versions¶
| Framework | Version and date | Primary source | How it was verified | License |
|---|---|---|---|---|
| OWASP Top 10 for LLM Applications | 2025, published in November 2024 (the resource page shows 17 Nov 2024; its metadata, 18 Nov 2024 UTC) | genai.owasp.org/llm-top-10 | List read on the official page. No 2026 edition was located on the official page at the cutoff date; the project page lists “Version 2025” and “Version 1.1.0”. | CC BY-SA 4.0 |
| OWASP Top 10 for Agentic Applications | 2026, published 9 Dec 2025 | genai.owasp.org — Agentic Applications for 2026 | Titles read in the official PDF. | CC BY-SA 4.0 (declared in the PDF) |
| NIST AI 600-1, Generative Artificial Intelligence Profile | July 2024 | doi.org/10.6028/NIST.AI.600-1 | Twelve categories read in the official PDF. | US government publication |
| NIST AI 100-1, AI RMF 1.0 | January 2023 | doi.org/10.6028/NIST.AI.100-1 | Core functions GOVERN, MAP, MEASURE, MANAGE. No later published revision was located. | US government publication |
| MITRE ATLAS | Data v2026.09, published 15 Sep 2026 | github.com/mitre-atlas/atlas-data | IDs and names read in ATLAS-2026.09.yaml. The technique pages on atlas.mitre.org could not be read without a browser. |
Data under Apache 2.0 |
| ISO/IEC 42001:2023 | 2023 | iso.org/standard/42001 | Not verified: iso.org returned 403 to every automated request; title and year come from secondary citations. Check in a browser before publishing. The text is paywalled and was neither consulted nor is it copied. |
© ISO |
Categories used in the requirements¶
OWASP LLM Top 10 2025. LLM01 Prompt Injection · LLM02 Sensitive Information Disclosure · LLM03 Supply Chain · LLM04 Data and Model Poisoning · LLM05 Improper Output Handling · LLM06 Excessive Agency · LLM07 System Prompt Leakage · LLM08 Vector and Embedding Weaknesses · LLM09 Misinformation · LLM10 Unbounded Consumption.
OWASP Agentic Top 10 2026. ASI01 Agent Goal Hijack · ASI02 Tool Misuse & Exploitation · ASI03 Identity & Privilege Abuse · ASI04 Agentic Supply Chain Vulnerabilities · ASI05 Unexpected Code Execution (RCE) · ASI06 Memory & Context Poisoning · ASI07 Insecure Inter-Agent Communication · ASI08 Cascading Failures · ASI09 Human-Agent Trust Exploitation · ASI10 Rogue Agents.
NIST AI 600-1. CBRN Information or Capabilities · Confabulation · Dangerous, Violent, or Hateful Content · Data Privacy · Environmental Impacts · Harmful Bias or Homogenization · Human-AI Configuration · Information Integrity · Information Security · Intellectual Property · Obscene, Degrading, and/or Abusive Content · Value Chain and Component Integration. NIST defines Confabulation as erroneous content presented with confidence, colloquially known as “hallucination”.
MITRE ATLAS v2026.09. AML.T0051 LLM Prompt Injection (.000 Direct, .001 Indirect, .002 Triggered) · AML.T0053 AI Agent Tool Invocation · AML.T0054 LLM Jailbreak · AML.T0062 Discover LLM Hallucinations · AML.T0080 AI Agent Context Poisoning · AML.T0034.002 Agentic Resource Consumption.
Contrast matrix¶
| Requirement | OWASP LLM 2025 | OWASP Agentic 2026 | NIST AI 600-1 | MITRE ATLAS |
|---|---|---|---|---|
| ASILO-R-001 Trust boundaries | LLM01, LLM05 | ASI01, ASI02 | Information Security | T0051, T0053 |
| ASILO-R-002 Layers and dependencies | LLM03 | ASI04 | Value Chain and Component Integration | — |
| ASILO-R-003 Context limits | LLM02, LLM07, LLM08 | ASI06 | Data Privacy | T0080 |
| ASILO-R-004 Least privilege | LLM06 | ASI02, ASI03, ASI10 | — | T0053 |
| ASILO-R-005 Human review | LLM06 | ASI09 | Human-AI Configuration | — |
| ASILO-R-006 Sensitive data | LLM02 | ASI03 | Data Privacy | — |
| ASILO-R-007 Budgets and continuity | LLM10 | ASI08 | — | T0034.002 |
| ASILO-R-008 Failure evaluation | LLM01, LLM09 | ASI07, ASI08 | Confabulation, Information Integrity, Human-AI Configuration | T0051, T0062 |
| MILPA-R-001 Authority and provenance | — | — | Information Integrity | — |
| MILPA-R-002 Facts and inferences | LLM09 | — | Confabulation | — |
Risks that these requirements do not yet address: LLM04 Data and Model Poisoning, ASI05 Unexpected Code Execution and the NIST categories of harmful content, bias, intellectual property and environmental impact. They remain declared gaps, not resolved risks.
Research on sycophancy, hallucination and multi-agent failures¶
| Work | What it supports | What it does not support |
|---|---|---|
| Sharma et al., “Towards Understanding Sycophancy in Language Models”, arXiv:2310.13548 (v4, 2025) | Five AI assistants consistently show sycophancy; human preference judgments partly favor it. | That a role, a prompt or a reviewer eliminates it. |
| Perez et al., “Discovering Language Model Behaviors with Model-Written Evaluations”, arXiv:2212.09251 (2022) | A method for generating evaluations of behaviors such as sycophancy. | A universal metric or threshold. |
| “Peacemaker or Troublemaker: How Sycophancy Shapes Multi-Agent Debate”, arXiv:2509.23055 (preprint, 2025) | Sycophancy between agents can collapse a debate into premature consensus. | That multi-agent debate is a sufficient control. |
| “Not Just RLHF: Why Alignment Alone Won't Fix Multi-Agent Sycophancy”, arXiv:2605.12991 (preprint, 2026) | Agents switch correct answers to incorrect ones under simulated peer disagreement, including in base models. | Peer-reviewed results; treat as an indication. |
| Cemri et al., “Why Do Multi-Agent LLM Systems Fail?”, arXiv:2503.13657 (v3, 2025) | MAST taxonomy of failures: system design, inter-agent misalignment and task verification. | That a specific architecture avoids them. |
| Kalai et al., “Why Language Models Hallucinate”, arXiv:2509.04664 (2025) | Hallucinations have statistical causes and evaluation that rewards guessing sustains them. | Total prevention of hallucinations. |
Preprints have not necessarily undergone peer review. They are cited to support caution, not to set thresholds.
ISO/IEC 42001¶
ISO/IEC 42001:2023 specifies an AI management system for organizations. It may guide this site's governance (owners, decisions, review), but nothing here implements, meets or certifies that standard, and its content is not reproduced.