How do our policies stand against the frameworks we track, and what is the evidence? · For Security leadership and auditors
Mapped policy enforcement posture and supporting evidence. Not a compliance score or a certification assessment.
OWASP Top 10 for LLM Applications is at 40% (10 of 25 mappings at ideal). This covers what Qpoint can know and govern. It isn't a compliance score or a certification assessment.
- OWASP LLM Applications
- 40%
Enforcement Posture
as of Oct 29stagedWhat is our posture against tracked frameworks?
Identify mapped policy areas to review.
- OWASP Top 10 for LLM Applications2025 · mapping 2026.240%2 Enforce · 8 can only observe · 11 Observe · 4 Off, of 25 policy-to-control mappings10 at ideal, 10 policies to change, with 2 controls mostly beyond Qpoint left out.
Posture covers the controls Qpoint maps, not every requirement in the framework. A mapping shows a policy is relevant to a control. Each policy-to-control pair counts once, at ideal when the policy has reached the strongest mode it can. It doesn't establish compliance, certification or deployment to every endpoint.
c123 enforcementPosture · published Policy Config
How it changed
over the windowstagedHow has that posture changed, in this window and over the whole record?
Tell enforcement progress from changes to the mapping.
40% on Sep 30, 2026, 40% on Oct 29, 2026.
Enforcement Posture went from 0% on Jan 12, 2026 to 40% today (up), using the modes, exceptions and mapping in force on each date.
- Jun 1, 2026, mapping 2026.2: 22 → 25 mappings. Added provenance and telemetry where the fit became clear. This moved the denominator, not any policy.
- Jan 12, 2026 to Apr 5, 2026 is reconstructed from retained history, for a time this framework wasn't tracked.
- Nothing is available before Jan 12, 2026. That's unknown, not 0%.
c123 postureHistory · Policy Config history · lab history is seeded
Trainings taken on their own
as of Oct 29stagedAre people learning before a finding asks them to?
Read a high count as a strength of the posture. It answers no finding, so it isn't in Corrections (c133 D39, D42).
- Taken on their own
- 0
- trainings with no finding
- In this window
- 0
- completed in the period
- People
- 0
- a count, not a list
No one in scope has taken a training on their own yet. The library lists every training a person can take before a finding asks them to.
A high count is a strength of the posture: people learning before a finding asks them to. It answers no finding, so it isn't counted in Corrections. Who took what stays in the audit log, not here.
training.completed.self (c133 D40, proposed) · the lab counts this visit's self-taken records
Blocked and observed
in windowWhat violations were blocked or only observed?
Read recorded evidence beside configured posture.
Findings first detected in the window, across the organization's policies. A Finding can appear in more than one framework's view, so these aren't added up by framework. Zero Findings doesn't prove compliance, and an Off policy raises none.
finding outcome at detection
Observed, not blocked
in windowWhich violations remain observed rather than blocked?
Prioritize policies with high-volume or high-severity observed violations.
| Policy | Observed | Most severe | Critical or high |
|---|---|---|---|
| Unsanctioned MCP server in use | 2 | high | 3 |
| Personal account is in use | 1 | high | 1 |
| Credentials must not be sent to a model | 1 | critical | 1 |
| Prompts are inspected for injection and leakage | 1 | medium | 0 |
| Consequential tool calls require approval | 1 | medium | 0 |
/api/security?period · by policy
Exceptions
as of Oct 29stagedWhat do exceptions change?
Review deliberate differences and upcoming decisions.
- OWASP Top 10 for LLM Applications: 7 active: 3 tighten, 2 loosen, 2 match the default.
- Approved model providers only · User: Jordan · until Nov 15, 2026
Each record counts once per framework, however many controls map its policy. Exceptions never move Enforcement Posture.
c123 exceptionsRead · published Policy Config
Enforce-pilot candidates
in windowstagedWhere could we start enforcing?
Pick a manageable pilot. Nothing here changes a policy.
- Agents may not run as root
Consider enforcing this for Engineering. Over these 30 days, Qpoint monitored 1,608 sessions with no observed violations. Start with a pilot.
Engineering · 100% of its endpoints covered · 1,608 monitored sessions · 0 observed · 0 exceptions - Tools must be on the allow list
Consider enforcing this for Engineering. Over these 30 days, Qpoint monitored 1,403 sessions with no observed violations. Start with a pilot.
Engineering · 100% of its endpoints covered · 1,403 monitored sessions · 0 observed · 0 exceptions - Agents run in a sandbox
Consider enforcing this for Engineering. Over these 30 days, Qpoint monitored 1,403 sessions with no observed violations. Start with a pilot.
Engineering · 100% of its endpoints covered · 1,403 monitored sessions · 0 observed · 0 exceptions
Few findings alone don't show a rollout will be painless, so start small. A recommendation never turns a policy on.
rule over mode, findings, sessions and coverage · monitored sessions are seeded
Mapping appendix
- LLM01:2025 Prompt Injection: Consequential tool calls require approval, Tools must be on the allow list, Prompts are inspected for injection and leakage
- LLM02:2025 Sensitive Information Disclosure: Sensitive information detected before transmission to an LLM, Sensitive information sanitized before transmission, Prohibited data classes must not leave an approved boundary, Credentials must not be sent to a model
- LLM03:2025 Supply Chain: MCP servers and skills are pinned to reviewed versions, Unsanctioned MCP server in use
- LLM04:2025 Data and Model Poisoning: MCP servers and skills are pinned to reviewed versions (limited relevance, not counted)
- LLM05:2025 Improper Output Handling: Model output is validated before tool execution, Tools must be on the allow list, Approved model providers only
- LLM06:2025 Excessive Agency: Consequential tool calls require approval, Tools must be on the allow list, Agents run in a sandbox, Agents may not run as root, Restricted file access
- LLM07:2025 System Prompt Leakage: Prompts are inspected for injection and leakage, Credentials must not be sent to a model, Model output is validated before tool execution
- LLM08:2025 Vector and Embedding Weaknesses: Credentials must not be sent to a model, Approved model providers only (limited relevance, not counted)
- LLM09:2025 Misinformation: Model output is validated before tool execution, Agent sessions are recorded
- LLM10:2025 Unbounded Consumption: Spend stays under the ceiling, Agent sessions are recorded, Approved model providers only