Compliance & Governance

A Practitioner's Guide to OWASP LLM-Top-10 and Continuous SOC 2 Compliance for Autonomous Enterprise Workflows

By Compliance Engineering Group • October 24, 2026 • 11 min read

Enterprise security and compliance teams face a dual mandate: accelerate developer productivity through generative AI tools (such as Cursor, Windsurf, and Claude Code) while adhering to strict regulatory frameworks, including SOC 2 Type II, ISO/IEC 27001, and the OWASP Top 10 for Large Language Model Applications.

This playbook provides a practical implementation architecture demonstrating how in-process AST validation, cryptographically signed audit logs, and capability-scoped passkeys map directly to SOC 2 Trust Services Criteria (Security, Availability, Confidentiality) and address the most critical OWASP LLM risks.

1. Mapping OWASP LLM Vulnerabilities to Runtime Controls

The OWASP LLM Top 10 highlights vulnerabilities unique to generative models. Here is how deterministic runtime invariants solve the top vectors:

LLM01: Prompt Injection

Risk: An external user or malicious file injects instructions that cause an agent to ignore its primary directives and exfiltrate secrets or execute destructive shell commands.
BTP Mitigation: Rather than relying on semantic LLM self-censorship, BTP enforces an external AST boundary. Even if a prompt jailbreak convinces the LLM to call rm -rf /, the IDE clearance engine identifies the destructive AST binary node and vetoes the execution before the OS kernel receives the syscall.

LLM02: Insecure Output Handling

Risk: Model output is passed directly to system shells, database query interfaces, or backend APIs without validation.
BTP Mitigation: Parameterized execution gates. All generated shell commands are parsed into formal AST nodes and evaluated against an allowlist of deterministic binaries and argument flags.

LLM08: Excessive Agency

Risk: Granting an autonomous agent broad, unscoped permissions across entire cloud environments or workstations.
BTP Mitigation: Cryptographic Capability Passkeys. Agents operate under least-privilege tokens signed via Ed25519 with explicit spend caps and directory confinement.

2. Continuous SOC 2 Evidence Collection

Traditional compliance audits require engineering teams to spend weeks taking manual screenshots of access permissions and terminal logs. Under the Bartholomew Trust Protocol, every tool-call decision generates an immutable cryptographic evidence entry:

{
  "timestamp": "2026-11-02T16:20:14.892Z",
  "event_type": "TOOL_EXECUTION_EVALUATION",
  "agent_id": "agent_windsurf_01",
  "verdict": "ALLOWED",
  "ast_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "command": "npm test",
  "passkey_id": "pk_live_0948b",
  "signature": "3045022100e4..."
}

These telemetry records are appended to an immutable append-only ledger that exports directly into standardized SOC2_COMPLIANCE_EVIDENCE_PACK.json reports for auditors.

3. The Enterprise Architecture Blueprint

A complete enterprise deployment combines three tiers:

Client Tier (Developer IDEs): Bartholomew Guard & Keystone extensions installed across developer workstations in VS Code, Windsurf, or Cursor. Evaluates all local commands in <18 microseconds.
Gateway Tier: Bartholomew Cloud Gateway Workers validating Ed25519 signatures and enforcing organization-wide budget quotas before requests route to LLM model providers.
Audit & Evidence Tier: Continuous SIEM streaming to Splunk, Datadog, or S3 with real-time anomaly detection and compliance reporting.

4. Conclusion

AI security cannot be an afterthought retrofitted through vague policy documents. By implementing provable, machine-verifiable runtime guardrails and automated compliance evidence generation, engineering organizations can unlock the full power of agentic development with complete confidence.