[{"data":1,"prerenderedAt":565},["ShallowReactive",2],{"$f1DeWyOVAo5eoT1im1z1n8QU--f_5anmwB1eYj29E2JA":3},{"newThing":4,"project":5,"cycle":9,"sections":21,"threads":536,"otherDocs":537,"documents":538,"images":539,"archiveItems":563,"links":564},null,{"id":6,"label":7,"liveBase":8},"bob-wire","Bob-Wire","https:\u002F\u002Fqpoint-io.github.io\u002Fbob-wire",{"id":10,"num":11,"dir":12,"name":13,"title":14,"focus":4,"status":15,"statusNote":4,"created":16,"completed":4,"mode":4,"report":4,"recordless":17,"thumbnail":18,"imageCount":19,"artifactCount":20,"lastActivity":16,"hasPickup":17,"hasInitialPrompt":17},"c17",17,"c17.owasp-policy-pack","owasp-policy-pack","OWASP LLM Top 10 — Policy Pack","active","2026-08-15",false,"\u002Fcycles\u002Fbob-wire\u002Fc17-control-definition.png",6,0,[22,124,189,240,323,387],{"key":23,"title":24,"empty":17,"ast":25},"why","Why",{"type":26,"children":27},"root",[28,36,77],{"type":29,"tag":30,"props":31,"children":32},"element","p",{},[33],{"type":34,"value":35},"text","Two c16 surfaces sit on either side of the same risk model but never touch:",{"type":29,"tag":37,"props":38,"children":39},"ul",{},[40,60],{"type":29,"tag":41,"props":42,"children":43},"li",{},[44,50,52,58],{"type":29,"tag":45,"props":46,"children":47},"strong",{},[48],{"type":34,"value":49},"Policy & Enforcement",{"type":34,"value":51}," decides ",{"type":29,"tag":53,"props":54,"children":55},"em",{},[56],{"type":34,"value":57},"what agents are allowed to do",{"type":34,"value":59}," (capability\u002Faction;\nthe Audit → Assist → Enforce ladder; tool allow-lists, approval gates, spend ceilings,\nkill switch).",{"type":29,"tag":41,"props":61,"children":62},{},[63,68,70,75],{"type":29,"tag":45,"props":64,"children":65},{},[66],{"type":34,"value":67},"Compliance & Frameworks",{"type":34,"value":69}," reports ",{"type":29,"tag":53,"props":71,"children":72},{},[73],{"type":34,"value":74},"what the fleet's behavior means",{"type":34,"value":76}," against external\nstandards (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF…), auto-mapping each finding to\nthe control it touches.",{"type":29,"tag":30,"props":78,"children":79},{},[80,82,87,89,94,96,101,103,108,110,115,117,122],{"type":34,"value":81},"The missing connective tissue is an ",{"type":29,"tag":45,"props":83,"children":84},{},[85],{"type":34,"value":86},"org opinion",{"type":34,"value":88}," on a standard. OWASP LLM Top 10 is\npurely ",{"type":29,"tag":53,"props":90,"children":91},{},[92],{"type":34,"value":93},"descriptive",{"type":34,"value":95}," — 10 risk categories, no stance on how strict you should be. To act\non it you assign, per control, a ",{"type":29,"tag":45,"props":97,"children":98},{},[99],{"type":34,"value":100},"posture",{"type":34,"value":102}," (Accept \u002F Audit \u002F Assist \u002F Enforce) and wire\nit to the ",{"type":29,"tag":45,"props":104,"children":105},{},[106],{"type":34,"value":107},"rules",{"type":34,"value":109}," that enforce that posture. That object — a ",{"type":29,"tag":45,"props":111,"children":112},{},[113],{"type":34,"value":114},"policy pack",{"type":34,"value":116}," — closes\nthe loop: applying it populates Policy & Enforcement, and the same control tags light up\nCompliance with ",{"type":29,"tag":53,"props":118,"children":119},{},[120],{"type":34,"value":121},"stated posture vs. observed reality",{"type":34,"value":123},".",{"key":125,"title":126,"empty":17,"ast":127},"objective","Objective",{"type":26,"children":128},[129,141],{"type":29,"tag":30,"props":130,"children":131},{},[132,134,139],{"type":34,"value":133},"A single hi-fi mockup of the ",{"type":29,"tag":45,"props":135,"children":136},{},[137],{"type":34,"value":138},"OWASP LLM Top 10 pack",{"type":34,"value":140}," that demonstrates:",{"type":29,"tag":142,"props":143,"children":144},"ol",{},[145,156,168,179],{"type":29,"tag":41,"props":146,"children":147},{},[148,150,155],{"type":34,"value":149},"The 10 controls, each with runtime-reach (Strong \u002F Partial \u002F Not instrumented),\nthe shared rules that satisfy it, live findings mapped to it, and an interactive\n",{"type":29,"tag":45,"props":151,"children":152},{},[153],{"type":34,"value":154},"posture selector",{"type":34,"value":123},{"type":29,"tag":41,"props":157,"children":158},{},[159,161,166],{"type":34,"value":160},"The ",{"type":29,"tag":45,"props":162,"children":163},{},[164],{"type":34,"value":165},"shared-rules",{"type":34,"value":167}," panel — one rule, many controls (the many-to-many made visible).",{"type":29,"tag":41,"props":169,"children":170},{},[171,172,177],{"type":34,"value":160},{"type":29,"tag":45,"props":173,"children":174},{},[175],{"type":34,"value":176},"stated-vs-actual gap",{"type":34,"value":178}," — the hero number: controls where you set Assist\u002FEnforce\nbut, because the live system mode is Audit, the mapped findings were only observed.",{"type":29,"tag":41,"props":180,"children":181},{},[182,187],{"type":29,"tag":45,"props":183,"children":184},{},[185],{"type":34,"value":186},"Apply-pack",{"type":34,"value":188}," affordance that cross-links to the real c16 Policy & Enforcement and\nCompliance surfaces.",{"key":190,"title":191,"empty":17,"ast":192},"scope","Scope",{"type":26,"children":193},[194,201,221,227],{"type":29,"tag":195,"props":196,"children":198},"h3",{"id":197},"in",[199],{"type":34,"value":200},"In",{"type":29,"tag":37,"props":202,"children":203},{},[204,216],{"type":29,"tag":41,"props":205,"children":206},{},[207,214],{"type":29,"tag":208,"props":209,"children":211},"code",{"className":210},[],[212],{"type":34,"value":213},"app\u002Fpages\u002Fc17\u002Fmockups\u002Fm1\u002Fowasp-policy-pack-v1\u002Fpack.vue",{"type":34,"value":215}," — the pack mockup.",{"type":29,"tag":41,"props":217,"children":218},{},[219],{"type":34,"value":220},"Cycle index + registry entry; reuse c16 design language and fixture.",{"type":29,"tag":195,"props":222,"children":224},{"id":223},"out",[225],{"type":34,"value":226},"Out",{"type":29,"tag":37,"props":228,"children":229},{},[230,235],{"type":29,"tag":41,"props":231,"children":232},{},[233],{"type":34,"value":234},"Changes to the real qcontrol app or to c16.",{"type":29,"tag":41,"props":236,"children":237},{},[238],{"type":34,"value":239},"A real pack data model \u002F persistence (postures are local reactive state).",{"key":241,"title":242,"empty":17,"ast":243},"extra","The modeling decision (the point of the prototype)",{"type":26,"children":244},[245,257,318],{"type":29,"tag":30,"props":246,"children":247},{},[248,250,255],{"type":34,"value":249},"A pack is ",{"type":29,"tag":45,"props":251,"children":252},{},[253],{"type":34,"value":254},"not",{"type":34,"value":256}," a monolithic policy that owns its own rules. Control↔rule is\nmany-to-many (LLM06 needs tool-allow-list + approval-gate + kill-switch; egress-allow-list\nserves both LLM02 and LLM03), and frameworks overlap (OWASP \u002F NIST \u002F ATLAS all touch\nexcessive agency). So:",{"type":29,"tag":37,"props":258,"children":259},{},[260,308],{"type":29,"tag":41,"props":261,"children":262},{},[263,268,270,276,278,284,285,291,293,299,300,306],{"type":29,"tag":45,"props":264,"children":265},{},[266],{"type":34,"value":267},"Rules are atomic and reusable",{"type":34,"value":269}," — ",{"type":29,"tag":208,"props":271,"children":273},{"className":272},[],[274],{"type":34,"value":275},"tool-allow-list",{"type":34,"value":277},", ",{"type":29,"tag":208,"props":279,"children":281},{"className":280},[],[282],{"type":34,"value":283},"approval-gate",{"type":34,"value":277},{"type":29,"tag":208,"props":286,"children":288},{"className":287},[],[289],{"type":34,"value":290},"dlp-deny",{"type":34,"value":292},",\n",{"type":29,"tag":208,"props":294,"children":296},{"className":295},[],[297],{"type":34,"value":298},"egress-allow-list",{"type":34,"value":277},{"type":29,"tag":208,"props":301,"children":303},{"className":302},[],[304],{"type":34,"value":305},"spend-ceiling",{"type":34,"value":307},", … own their enforcement logic once.",{"type":29,"tag":41,"props":309,"children":310},{},[311,316],{"type":29,"tag":45,"props":312,"children":313},{},[314],{"type":34,"value":315},"A pack references rules and maps them to controls + a posture",{"type":34,"value":317}," — never duplicates them.",{"type":29,"tag":30,"props":319,"children":320},{},[321],{"type":34,"value":322},"This keeps rules reusable across every future framework pack (SOC 2, NIST AI RMF…) and\navoids two packs fighting to enforce the same lever.",{"key":241,"title":324,"empty":17,"ast":325},"Data",{"type":26,"children":326},[327],{"type":29,"tag":30,"props":328,"children":329},{},[330,332,338,340,346,348,354,356,362,364,370,371,377,379,385],{"type":34,"value":331},"Reuses ",{"type":29,"tag":208,"props":333,"children":335},{"className":334},[],[336],{"type":34,"value":337},"app\u002Fdata\u002Fc16-fleet.ts",{"type":34,"value":339}," (qcontrol ",{"type":29,"tag":208,"props":341,"children":343},{"className":342},[],[344],{"type":34,"value":345},"\u002Fapi",{"type":34,"value":347}," shape) — ",{"type":29,"tag":208,"props":349,"children":351},{"className":350},[],[352],{"type":34,"value":353},"findings",{"type":34,"value":355}," (framework strings\ncarry ",{"type":29,"tag":208,"props":357,"children":359},{"className":358},[],[360],{"type":34,"value":361},"LLM02",{"type":34,"value":363}," \u002F ",{"type":29,"tag":208,"props":365,"children":367},{"className":366},[],[368],{"type":34,"value":369},"LLM06",{"type":34,"value":363},{"type":29,"tag":208,"props":372,"children":374},{"className":373},[],[375],{"type":34,"value":376},"LLM10",{"type":34,"value":378},"), ",{"type":29,"tag":208,"props":380,"children":382},{"className":381},[],[383],{"type":34,"value":384},"agents",{"type":34,"value":386},". The pack model itself lives inline in the\npage as a prototype (no new fixture).",{"key":241,"title":388,"empty":17,"ast":389},"Status",{"type":26,"children":390},[391,499,505,517],{"type":29,"tag":37,"props":392,"children":395},{"className":393},[394],"contains-task-list",[396,424],{"type":29,"tag":41,"props":397,"children":400},{"className":398},[399],"task-list-item",[401,407,409,415,416,422],{"type":29,"tag":402,"props":403,"children":406},"input",{"checked":404,"disabled":404,"type":405},true,"checkbox",[],{"type":34,"value":408}," Pack mockup ",{"type":29,"tag":208,"props":410,"children":412},{"className":411},[],[413],{"type":34,"value":414},"m1",{"type":34,"value":269},{"type":29,"tag":208,"props":417,"children":419},{"className":418},[],[420],{"type":34,"value":421},"pack.vue",{"type":34,"value":423}," (interactive posture per control, shared-rules reuse\npanel, stated-vs-actual gap, apply-pack cross-links to c16 Policy & Compliance)",{"type":29,"tag":41,"props":425,"children":427},{"className":426},[399],[428,431,433,438,440,446,447,453,455,460,462,467,469,474,476,481,483,489,491,497],{"type":29,"tag":402,"props":429,"children":430},{"checked":404,"disabled":404,"type":405},[],{"type":34,"value":432}," ",{"type":29,"tag":45,"props":434,"children":435},{},[436],{"type":34,"value":437},"Refactor onto the locked governance model",{"type":34,"value":439}," (",{"type":29,"tag":208,"props":441,"children":443},{"className":442},[],[444],{"type":34,"value":445},"policy-controls-v1",{"type":34,"value":363},{"type":29,"tag":208,"props":448,"children":450},{"className":449},[],[451],{"type":34,"value":452},"governance.vue",{"type":34,"value":454},")\n— supersedes the pack pass. The model: a ",{"type":29,"tag":45,"props":456,"children":457},{},[458],{"type":34,"value":459},"Policy owns a disjoint set of Controls + one\nresponse",{"type":34,"value":461}," (alert \u002F human-approval \u002F block); a ",{"type":29,"tag":45,"props":463,"children":464},{},[465],{"type":34,"value":466},"Control",{"type":34,"value":468}," is the atomic enforceable check\n(owned by exactly one policy) and is ",{"type":29,"tag":45,"props":470,"children":471},{},[472],{"type":34,"value":473},"satisfied by many Frameworks",{"type":34,"value":475}," (read-only views,\ncoverage % = active ÷ referenced); a ",{"type":29,"tag":45,"props":477,"children":478},{},[479],{"type":34,"value":480},"Control violation fires its owning policy's\nresponse",{"type":34,"value":482},". Two linked views (Policies | Frameworks) over one shared reactive activation\nset — toggling a control recomputes framework coverage live. Model in\n",{"type":29,"tag":208,"props":484,"children":486},{"className":485},[],[487],{"type":34,"value":488},"app\u002Fdata\u002Fc17-governance.ts",{"type":34,"value":490},"; violations derived from ",{"type":29,"tag":208,"props":492,"children":494},{"className":493},[],[495],{"type":34,"value":496},"c16-fleet",{"type":34,"value":498}," findings.",{"type":29,"tag":195,"props":500,"children":502},{"id":501},"model-locked",[503],{"type":34,"value":504},"Model (locked)",{"type":29,"tag":506,"props":507,"children":511},"pre",{"className":508,"code":510,"language":34},[509],"language-text","Policy    --owns-->        Control   (1-to-many, disjoint — sets the response)\nFramework --satisfied by-> Control   (many-to-many, read-only — coverage %)\nControl   --violated-->    its owning policy's response fires\n",[512],{"type":29,"tag":208,"props":513,"children":515},{"__ignoreMap":514},"",[516],{"type":34,"value":510},{"type":29,"tag":30,"props":518,"children":519},{},[520,522,527,529,534],{"type":34,"value":521},"A control is ",{"type":29,"tag":45,"props":523,"children":524},{},[525],{"type":34,"value":526},"owned by one policy, satisfies many frameworks.",{"type":34,"value":528}," Activation drives coverage;\na control set once (no policy overlap); framework coverage is ",{"type":29,"tag":53,"props":530,"children":531},{},[532],{"type":34,"value":533},"coverage",{"type":34,"value":535},", not conformance.",[],[],[],[540,545,549,553,556,559],{"src":18,"kind":541,"order":542,"capturedAt":543,"route":544},"hero",4999,"2026-08-15T16:44:17.367Z","\u002Fc17\u002Fwireframes\u002Fwf1\u002Fpolicy-definition-v1\u002Fcontrol-definition",{"src":546,"kind":541,"order":542,"capturedAt":547,"route":548},"\u002Fcycles\u002Fbob-wire\u002Fc17-index.png","2026-08-15T16:41:09.034Z","\u002Fc17\u002F",{"src":550,"kind":551,"order":552,"capturedAt":543,"route":544},"\u002Fcycles\u002Fbob-wire\u002Fc17-control-definition-2.png","slice",2,{"src":554,"kind":551,"order":555,"capturedAt":543,"route":544},"\u002Fcycles\u002Fbob-wire\u002Fc17-control-definition-3.png",3,{"src":557,"kind":551,"order":558,"capturedAt":543,"route":544},"\u002Fcycles\u002Fbob-wire\u002Fc17-control-definition-4.png",4,{"src":560,"kind":561,"order":562,"capturedAt":543,"route":544},"\u002Fcycles\u002Fbob-wire\u002Fc17-control-definition-full.png","full",9000,[],[],1794599417541]