Compliance Frameworks
Next: Finish the frameworks cleanup page by page: Policies' frameworks strip (X1, X2), Compliance's percentage (X5), tracking that stages policies at Observe (F8), SOC 2's mappings. Take after captures. Check Peterson's revised intents against intents-redline.md §5 when they land.
This week is about compliance frameworks, and our CISO advisor Mark Peterson is leading what they should mean in Qpoint.
In progress. Framework detail is composed in the lab, with one Track verb on the listing and the detail, and five product tours are live, one of them built from a close reading of OWASP's agentic paper. Policies' frameworks strip, the listing's percentage and tracking that stages policies are still to do.
Documents
With file names, on their own page →Start here
Documents
- Thread `intents-pr5`: evaluation (2026-11-05)
- Redline: the two framework intents against the Oct 19 model
- The addressable tour: where Qpoint is strongest against the OWASP® Agentic Top 10
- Your agents against the OWASP® Top 10 for Agentic Applications — dashboard map and tour
- Tours — which pages are real (2026-10-29)
Threads
- Thread `intents-pr5`: prompt (2026-11-05)
- Thread `intents-pr5`: plan (2026-11-05)
- Thread: owasp-agentic — prompt (verbatim)
- Thread `phase4-simple`: prompts (2026-11-03)
- Thread `posture-score`: prompt (2026-11-04)
- Thread `posture-score`: plan (2026-11-04)
- Tours — prompt (2026-10-29)
- Tours — the set, and how we build and test it (proposed 2026-10-29)
What changed
The five changes that matter most, in plain words. Open any one to see it.
- 1
Framework detail is composed for the first time: each item, its coverage, the policies governing it and its open findings, with one Track verb that asks before it stops.
A page for reading one framework · came from Mark Parson
- 2
Start here, Common AI risks, Observe then enforce, AI spend and OWASP Agentic each walk one person through one job, on real qdash pages where they exist.
Five product tours · came from Mark Parson
- 3
All 57 pages of the OWASP Top 10 for Agentic Applications, with every numbered mitigation tagged by whether Qpoint enforces it, observes it, keeps evidence of it, or leaves it to you.
OWASP's agentic paper, read closely · came from Mark Parson
- 4
One prep page lays out the ten frameworks, what our evidence covers, and the questions for Mark Peterson.
Ready for the frameworks session · came from Mark Peterson and Mark Parson
- 5
A line-by-line read of Mark Peterson's two framework intents against the Oct 19 model, with four coverage states: Enforced, Observed, Evidenced, Outside.
A gap-check for the framework intents · came from Mark Peterson
- OWASP's agentic list joined the v1 set, and it and NIST AI RMF 1.0 went into the lab's data with their versions. In words
- A checked dossier on ten frameworks plus the OWASP agentic list, every claim tagged with how sure we are. In words
How we got here
Each change, traced back to the conversation it came from. A solid mark means the record names the source; a dashed one was matched by the draft and waits for review.
From the record: no recorded conversation behind this one.
No ruling needed: the work itself is the change.
Framework detail is composed for the first time: each item, its coverage, the policies governing it and its open findings, with one Track verb that asks before it stops.
From the record: no recorded conversation behind this one.
c123-R1 Build the OWASP tour around what Qpoint can most address, framed by the customer's concern, not as a walk through all ten risks. — Mark Parson
Start here, Common AI risks, Observe then enforce, AI spend and OWASP Agentic each walk one person through one job, on real qdash pages where they exist.
From the record: no recorded conversation behind this one.
No ruling needed: the work itself is the change.
All 57 pages of the OWASP Top 10 for Agentic Applications, with every numbered mitigation tagged by whether Qpoint enforces it, observes it, keeps evidence of it, or leaves it to you.
“OWASP top 10. I wanna design for that. I wanna be compliant with that. I wanna be compliant with SOC 2. So I I say yes, and yes, and then a whole bunch of policies all of a sudden are in scope”
market-analyst /calls/154b2679… (local)No ruling needed: the work itself is the change.
One prep page lays out the ten frameworks, what our evidence covers, and the questions for Mark Peterson.
“OWASP top 10. I wanna design for that. I wanna be compliant with that. I wanna be compliant with SOC 2. So I I say yes, and yes, and then a whole bunch of policies all of a sudden are in scope”
market-analyst /calls/154b2679… (local)No ruling needed: the work itself is the change.
A line-by-line read of Mark Peterson's two framework intents against the Oct 19 model, with four coverage states: Enforced, Observed, Evidenced, Outside.
Thanks to
People outside Qpoint first. Every thank-you points at something they said or made.
Leading the frameworks work
Set the order of support (OWASP LLM Top 10, NIST AI RMF and SOC 2 first) and the rule that support means mapping policies and evidence, not claiming compliance. On Oct 19 he described the flow: pick frameworks, let their policies come in, then except what you're not ready for.
“OWASP top 10. I wanna design for that. I wanna be compliant with that. I wanna be compliant with SOC 2. So I I say yes, and yes, and then a whole bunch of policies all of a sudden are in scope” first-hand
Framed the week
Asked for the prep: where frameworks sit among earlier cycles, what questions to bring, and stories for the pixel-pawn designer.
All images
Every picture from this cycle. Click any one to step through them all.
The pairs
Everything captured · 5
The full record 9 decisions · 11 key-change entries · 4,518 words · 4 captures
The record stays as written, for agents and for audit: Key Changes, every decision, the artifacts and the visual record.
Open the record for c123 →