Compliance Matrix

Grantex provides technical controls that can be mapped to widely used AI agent security and risk-management frameworks. This page documents current mapping posture and the corresponding Grantex feature areas without claiming formal third-party attestation unless separately stated.

OWASP Agentic Security Top 10

Published December 2025 — the first industry-standard threat taxonomy for autonomous AI agents.

Risk	Description	Grantex Control	Implementation
ASI-01	Agent goal hijacking	Scoped permissions	JWT `scp` claim limits actions regardless of agent intent. A hijacked agent cannot exceed its granted scopes.
ASI-03	Identity & privilege abuse	Per-agent cryptographic identity	Each agent gets a unique DID. The `agt` claim binds tokens to specific agents. Tokens are non-transferable.
ASI-05	Privilege escalation	Delegation invariants	Child scopes must be a strict subset of parent scopes. `delegationDepth` claim enforced at protocol level.
ASI-10	Rogue agents (no revocation)	Instant cascading revocation	`POST /v1/tokens/revoke` blocklists the JTI. All child delegations invalidated in the same operation.

EU AI Act

The Act applies in phases. Under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, Art. 50 transparency obligations apply from 2 August 2026, Annex III high-risk obligations from 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2028. The controls below are technical mappings, not a determination that a deployment satisfies the regulation; see EU AI Act for provider and deployer duties and the limits of each mapping.

Article	Requirement	Grantex Control	Implementation
Art. 9	Risk management per AI system	Budget controls + anomaly detection	`POST /v1/budget/allocate` sets spending limits. Anomaly detection flags unusual patterns. Policy-as-code (OPA, Cedar) for fine-grained rules.
Art. 13	Transparency for autonomous actions	Consent flow + Verifiable Credentials	Human sees plain-English consent screen. VC-JWTs provide portable proof of authorization. SD-JWT enables selective disclosure.
Art. 12	Record-keeping (logs kept at least six months, Arts. 19(1) and 26(6))	Hash-chained audit log	Authorisation, delegation and revocation events; the `eu-ai-act-evidence` export reports chain integrity. Not the AI system’s own logs.
Art. 14	Human oversight — logged & auditable	Principal dashboard + event streaming + revocation	`GET /v1/events/stream` (SSE) surfaces actions in real time. Principal Sessions dashboard. One-click cascade revocation.

NIST AI Risk Management Framework

Active now as voluntary risk-management guidance; useful for US government and federal-contractor alignment where applicable.

Control	Requirement	Grantex Control	Implementation
Govern 1.1	AI roles & accountability	Grant-to-human traceability	Every JWT carries `sub` (human principal), `dev` (developer), and `agt` (agent). The accountability chain is unbroken.
Map 5.1	Agent action attribution	Audit trail linked to grants	`POST /v1/audit/log` records actions. Each entry references the `grantId` and `agentId`. Entries are hash-chained.
Measure 2.5	Audit trails for autonomous operations	Hash-chained, append-only audit	Audit entries are append-only, hash-chained (tamper-evident), filterable by agent/grant/principal/time, and exportable via compliance evidence packs.

Full Compliance Matrix

Requirement	Framework	Grantex Feature	Verification Method
Scoped permissions	OWASP ASI-01	JWT `scp` claim	Service verifies scope before executing action
Per-agent identity	OWASP ASI-03	DID per agent, `agt` claim	Signature verification against agent’s public key
Delegation depth limits	OWASP ASI-05	`delegationDepth` claim	Protocol rejects invariant-violating delegations
Instant revocation	OWASP ASI-10	Redis blocklist + StatusList2021	`POST /v1/tokens/verify` returns `valid: false`
Risk management	EU Art. 9	Budgets, anomaly detection, policies	API endpoints + dashboard monitoring
Transparency	EU Art. 13	Consent flow, VCs, SD-JWT	Consent URL, credential verification
Human oversight	EU Art. 14	Events, principal sessions, revocation	SSE stream, dashboard, API
Accountability	NIST Govern 1.1	`sub` + `dev` + `agt` claims	JWT decode traces action to human
Action attribution	NIST Map 5.1	Hash-chained audit entries	`GET /v1/audit/entries` with filters
Audit trails	NIST Measure 2.5	Append-only, exportable audit	Evidence pack export via API

Compliance Evidence Pack

Grantex can generate a compliance evidence pack that bundles all relevant data for auditors:

# Generate a compliance evidence pack via CLI
grantex compliance evidence-pack \
  --since 2026-01-01 \
  --until 2026-03-28 \
  --framework all \
  --output evidence.json

# Or via API
curl "https://api.grantex.dev/v1/compliance/evidence-pack?since=2026-01-01&until=2026-03-28&framework=all" \
  -H "Authorization: Bearer $API_KEY"

The evidence pack includes:

Grant records issued in the selected period
Audit entries in the selected period, including hash-chain integrity results
Current policy records
Summary counts for agents, grants, audit outcomes, policies, and plan

Evidence And Standards Mappings

SOC 2 — readiness control mapping published; formal third-party attestation is not published. View mapping
IETF Internet-Draft — preparation track only; no IETF submission, working-group adoption, RFC approval, or standards status is claimed. Internal Commerce V1 C6T materials define the draft outline and review gates.
NIST AI RMF — mapping and whitepaper preparation track only; no NIST submission, public comment submission, NCCoE acceptance, or NIST approval is claimed. Internal Commerce V1 C6T materials define the candidate reference architecture and control-map outline.
OpenID AuthZEN — conformance mapping complete. View mapping

Ownership

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: sanjeev@orchestrum.in or mishra.sanjeev@gmail.com.

Last modified on September 30, 2026

Getting Started

Core Concepts

Trust & Identity

Offline Authorization

x402 Payment Protocol

MCP Authorization

OACP Authority

Agentic Commerce V1 (Historical)

Compliance

Guides

Case Studies

Examples

Compliance Matrix

OWASP Agentic Security Top 10

EU AI Act

NIST AI Risk Management Framework

Full Compliance Matrix

Compliance Evidence Pack

Evidence And Standards Mappings

Ownership

​OWASP Agentic Security Top 10

​EU AI Act

​NIST AI Risk Management Framework

​Full Compliance Matrix

​Compliance Evidence Pack

​Evidence And Standards Mappings

​Ownership

OWASP Agentic Security Top 10

EU AI Act

NIST AI Risk Management Framework

Full Compliance Matrix

Compliance Evidence Pack

Evidence And Standards Mappings

Ownership