Every control, against the requirement it answers
Twelve controls this platform operates, mapped to the ISO/IEC 42001 areas, NIST AI RMF functions and SP 800-53 families each one speaks to. Every row states how to verify it from inside a deployment.
A security review asks its questions in the vocabulary of the frameworks it is accountable to. The architecture already answers them; this page is the translation. Each control below is documented in an architecture teardown, and each states a check you can run yourself rather than a claim you have to accept.
What this is not. It is not a certification claim. ISO/IEC 42001 is a paywalled standard, so its Annex A areas are mapped by name and sub-clause identifiers are deliberately not asserted — false precision would defeat the purpose of the page. NIST AI RMF is mapped to its four Core functions and SP 800-53 to control families. An organization pursuing certification can use this to see which of its obligations the system supports and which remain its own.
| Control | NIST AI RMF | ISO/IEC 42001 | NIST SP 800-53 |
|---|---|---|---|
| Control and execution plane separation | GOVERN, MAP | A.6 AI system life cycle A.10 Third-party and customer relationships |
SC — System and Communications Protection |
| Hypervisor-level execution isolation | MANAGE | A.6 AI system life cycle | SC — System and Communications Protection SI — System and Information Integrity |
| Egress denied by default | MANAGE | A.6 AI system life cycle A.7 Data for AI systems |
SC — System and Communications Protection AC — Access Control |
| Context-aware tokenization of sensitive data | MAP, MANAGE | A.7 Data for AI systems | SC — System and Communications Protection SI — System and Information Integrity |
| Enterprise identity, acting as the user | GOVERN | A.3 Internal organization A.9 Use of AI systems |
IA — Identification and Authentication AC — Access Control |
| Per-turn tool roster compilation | GOVERN, MANAGE | A.6 AI system life cycle A.9 Use of AI systems |
AC — Access Control CM — Configuration Management |
| Pre-execution policy validation | MANAGE, MEASURE | A.6 AI system life cycle | AC — Access Control SI — System and Information Integrity |
| Human approval on every write, with blast radius shown | GOVERN, MANAGE | A.9 Use of AI systems A.5 Assessing impacts of AI systems |
AC — Access Control AU — Audit and Accountability |
| Approvals pinned against replay | MANAGE | A.6 AI system life cycle A.9 Use of AI systems |
AU — Audit and Accountability SI — System and Information Integrity |
| Deterministic citation provenance | MEASURE, MANAGE | A.6 AI system life cycle A.8 Information for interested parties |
AU — Audit and Accountability |
| Grounding critic ahead of human review | MEASURE | A.6 AI system life cycle | SI — System and Information Integrity |
| End-to-end distributed trace across both planes | MEASURE, GOVERN | A.6 AI system life cycle A.8 Information for interested parties |
AU — Audit and Accountability |
The controls
Control and execution plane separation
The control plane orchestrates sessions, compiles agents, evaluates policy and collects traces, and holds no customer data at rest. The execution plane runs inside the customer VPC and is the only component that touches customer systems.
Frameworks
GOVERN, MAP · A.6 AI system life cycle; A.10 Third-party and customer relationships
How to verify it
Network diagram plus a data-flow review. The claim is falsifiable: name the store where customer records would sit in the control plane.
Documented in Architecture teardown
Hypervisor-level execution isolation
Agent-generated code executes in a MicroVM with its own kernel. The isolation boundary is the hypervisor rather than a namespace, so a kernel escape lands in an empty virtual machine.
Frameworks
MANAGE · A.6 AI system life cycle
How to verify it
Inspect the sandbox from inside: it has its own kernel version, independent of the host.
OWASP LLM Top 10: LLM02 Insecure Output Handling
Documented in Architecture teardown
Egress denied by default
Each execution sandbox carries an eBPF network filter and a DNS sinkhole restricting outbound traffic to a customer-defined allowlist. The filter blocks the connection; the sinkhole blocks the resolution that would have produced the address.
Frameworks
MANAGE · A.6 AI system life cycle; A.7 Data for AI systems
How to verify it
Packet capture from inside the sandbox while attempting an unlisted destination.
OWASP LLM Top 10: LLM06 Sensitive Information Disclosure
Documented in Architecture teardown
Context-aware tokenization of sensitive data
Sensitive spans are replaced before transmission and the real values re-injected after the response returns, so the model only ever sees placeholders. Policy is declarative and per-tenant: a category allowlist, custom identifier patterns, and a known-safe denylist to prevent over-tokenization degrading the answer.
Frameworks
MAP, MANAGE · A.7 Data for AI systems
How to verify it
Inspect the payload leaving the perimeter and confirm the sensitive spans are placeholders.
OWASP LLM Top 10: LLM06 Sensitive Information Disclosure
Documented in Architecture teardown
Enterprise identity, acting as the user
Ingress is SAML 2.0 or OIDC against Azure AD, Okta, Google, ADFS, or a custom provider. The agent acts under the identity of the person driving it rather than a service account, which is what makes the authorization question answerable.
Frameworks
GOVERN · A.3 Internal organization; A.9 Use of AI systems
How to verify it
Revoke a user in the identity provider and confirm their agent sessions lose the corresponding access.
OWASP LLM Top 10: LLM08 Excessive Agency
Documented in Architecture teardown
Per-turn tool roster compilation
Available tools are computed as the intersection of platform capability, tenant entitlement and the acting user's role, then compiled into a signed session manifest for that turn. A capability outside the intersection is absent rather than denied.
Frameworks
GOVERN, MANAGE · A.6 AI system life cycle; A.9 Use of AI systems
How to verify it
Compare the compiled manifest for two users in different roles on the same tenant.
OWASP LLM Top 10: LLM08 Excessive Agency, LLM07 Insecure Plugin Design
Documented in Architecture teardown
Pre-execution policy validation
Every proposed tool call is validated against a policy the model cannot see, read back, or influence. Placing the check outside the model's channel is what turns a successful injection into a failed call rather than an unauthorized action.
Frameworks
MANAGE, MEASURE · A.6 AI system life cycle
How to verify it
Seed a document with an instruction to call a denied tool and confirm the call is refused, not resolved.
OWASP LLM Top 10: LLM01 Prompt Injection, LLM08 Excessive Agency
Documented in Architecture teardown
Human approval on every write, with blast radius shown
Every WRITE action stops at a human gate that renders a diff of exactly what would change and how many records it reaches. The approver sees the field-level change and the count, not a description of the action.
Frameworks
GOVERN, MANAGE · A.9 Use of AI systems; A.5 Assessing impacts of AI systems
How to verify it
Request a bulk update and confirm the record count is displayed before approval is possible.
OWASP LLM Top 10: LLM08 Excessive Agency, LLM09 Overreliance
Documented in Architecture teardown
Approvals pinned against replay
Every approval is pinned to an optimistic-concurrency version token and to the schema it was granted against. If the plan, record or tool definition changes after approval, the write is refused rather than retried against the new state.
Frameworks
MANAGE · A.6 AI system life cycle; A.9 Use of AI systems
How to verify it
Approve a write, modify the underlying record from another session, then release the approval.
OWASP LLM Top 10: LLM08 Excessive Agency
Documented in Architecture teardown
Deterministic citation provenance
Citations are generated by the backend from the tool-call record, never by the model. Markers the model invents are stripped before rendering, so every marker in delivered text resolves to a real call and its result set.
Frameworks
MEASURE, MANAGE · A.6 AI system life cycle; A.8 Information for interested parties
How to verify it
Open any citation in a delivered answer and confirm it resolves to a logged call with arguments.
OWASP LLM Top 10: LLM09 Overreliance, LLM02 Insecure Output Handling
Documented in Architecture teardown
Grounding critic ahead of human review
Output referencing an entity absent from the index is rejected before a reviewer sees it. Filtering ahead of the queue protects reviewer attention, which degrades measurably once a queue starts carrying plausible-but-ungrounded items.
Frameworks
MEASURE · A.6 AI system life cycle
How to verify it
Ask for output about an entity you know is not indexed and confirm rejection rather than invention.
OWASP LLM Top 10: LLM09 Overreliance
Documented in Architecture teardown
End-to-end distributed trace across both planes
W3C trace context propagates across the plane boundary, so an auditor can reconstruct which turn triggered which call with which arguments, what it returned, which citation points at it, and who approved the resulting write against which version.
Frameworks
MEASURE, GOVERN · A.6 AI system life cycle; A.8 Information for interested parties
How to verify it
Pick a write from six months ago and reconstruct the full chain from it.
Documented in Architecture teardown
What reviewers ask
Is Axionalytics certified to ISO/IEC 42001?
No, and this page does not claim otherwise. It maps the controls the platform operates to the requirement areas each one speaks to, so that an organization pursuing certification can see which of its obligations the system already supports and which remain its own. Certification is granted to an organization by an accredited body; a mapping is evidence toward it, not a substitute.
Does a vendor SOC 2 report cover any of this?
No. A SOC 2 report describes the vendor's own control environment. It does not state where your data is processed, what an agent may write in your systems, or what your auditors can reconstruct afterward. Those are properties of the deployed architecture, which is what this page documents.
How can these control claims be verified rather than taken on trust?
Each control below states how to check it. Most are verifiable from inside a deployment in minutes: capture packets from a sandbox, compare compiled tool manifests across two roles, revoke a user and watch access drop, or open a citation and follow it to the logged call that produced it.
Which NIST AI RMF functions do these controls map to?
All four. GOVERN is served by identity federation, per-turn tool compilation and the human write gate; MAP by plane separation and tokenization policy; MEASURE by the grounding critic, citation provenance and distributed tracing; MANAGE by execution isolation, egress denial, policy validation and replay protection.