OWASP LLM Top 10 — Policy Pack
To close: Commit the c17 pages and data files in bob-wire. · Write the Outcome. · Move it from CYCLES.md to HISTORY.md.
last activity Jun 19
Qpoint's rules page and its compliance page covered the same AI risks but never connected, and nothing said how strict a company wanted to be on each.
A locked model: each control belongs to one policy, which decides what happens when it's broken, and can count toward many frameworks. Five mockups and two wireframes show it.
What changed
The two changes that matter most, in plain words. Open any one to see it.
- 1
Each control belongs to one policy, which sets the response; frameworks only read whether the control is on.
One control, one policy, many frameworks · came from Mark Parsonopen →
- 2
One wireframe template shows any control: which standards it counts toward, how often it's broken, its settings, actions and history.
A page for any control · came from Mark Parsonopen →
- A first pass treated a whole standard as a pack of shared rules; the locked model replaced it. In words
- The design site's later policy and control-center work started from this model. In words
How we got here
Each change, traced back to the conversation it came from. A solid mark means the record names the source; a dashed one was matched by the draft and waits for review.
From the record: no recorded conversation behind this one.
bob-wire-c17-D1 A control is owned by exactly one policy, which sets its response (alert, human approval or block); frameworks are read-only views that many controls satisfy. Supersedes the policy-pack pass. — Mark Parson
Each control belongs to one policy, which sets the response; frameworks only read whether the control is on.
From the record: no recorded conversation behind this one.
bob-wire-c17-D1 A control is owned by exactly one policy, which sets its response (alert, human approval or block); frameworks are read-only views that many controls satisfy. Supersedes the policy-pack pass. — Mark Parson
One wireframe template shows any control: which standards it counts toward, how often it's broken, its settings, actions and history.
Thanks to
People outside Qpoint first. Every thank-you points at something they said or made.
Locked the governance model
The record names no one. The cycle folder was committed by Mark Parson (git); the pages are still uncommitted, so the credit is matched from that authorship.
All images
Every picture from this cycle. Click any one to step through them all.
The pairs
Everything captured · 3
The full record 1 decisions · 0 key-change entries · 644 words · 2 captures
The record stays as written, for agents and for audit: Key Changes, every decision, the artifacts and the visual record.
Open the record for c17 →