Standards Alignment
Belay is built to slot into the security frameworks teams already track. Every rule in the catalog is tagged against three published taxonomies, and the static scanner emits its findings as SARIF 2.1.0 so they flow straight into CI code-scanning tooling.
When this matters
When a verdict fires or the scanner flags a package, you should be able to answer "which control does this map to?" without a translation exercise. The tags make that automatic, and SARIF output means findings land in the same dashboards as the rest of your code-scanning results.
The frameworks
OWASP Agentic Security Initiative (ASI) Top 10
The OWASP ASI Top 10 catalogues the top risks specific to agentic AI systems
— tool misuse, excessive agency, privilege compromise, and related failure
modes. Belay tags rules with ASI identifiers (for example ASI02, ASI03,
ASI04, ASI05).
OWASP LLM Top 10
The OWASP Top 10 for LLM applications covers risks such as prompt injection
and sensitive-information disclosure. Belay uses these tags (for example
LLM01 for prompt injection, LLM02 for sensitive-data exposure) where a rule
speaks to an LLM-application risk.
MITRE ATLAS
MITRE ATLAS is the adversarial-threat knowledge base for AI systems, modelled
after ATT&CK. Belay tags rules with ATLAS technique identifiers under the
AML.* namespace (for example AML.Exfiltration, AML.CodeExecution,
AML.Persistence).
SARIF 2.1.0
The scanner (belay scan --format sarif) emits SARIF 2.1.0, the OASIS
standard interchange format for static-analysis results. Any CI system or
code-scanning platform that ingests SARIF can consume Belay findings
directly.
Example mapping
A representative slice of how catalog rules line up with the frameworks:
| Behaviour | OWASP ASI / LLM | MITRE ATLAS |
|---|---|---|
curl … | sh (download-and-run) | ASI05 | AML.CodeExecution |
Upload .env / secret over the network | LLM02 | AML.Exfiltration |
| Reverse shell | ASI02 | AML.ReverseShell |
| Package install (supply-chain) | ASI04 | AML.SupplyChain |
sudo / privilege escalation | ASI03 | AML.PrivEsc |
Write SSH authorized_keys | ASI03 | AML.Persistence |
| Ingest untrusted web content | LLM01 | AML.LLMPromptInjection |
| Read another agent's config/memory | ASI03 | AML.DiscoverAgentConfig |
| Modify agent configuration | ASI04 | AML.ModifyAgentConfig |
The tags are attached to the rules themselves, so they travel with every finding into the audit log and into SARIF output — no separate mapping table has to be maintained by hand.
Local-first, no phone-home
Alignment does not mean Belay sends your findings anywhere. It is local-first and does not phone home by default; standards tagging and SARIF export happen entirely on your host.