Compliance

SOC 2 Type 2

Independent SOC 2 Type 2 examination covering the operating effectiveness of controls for security, availability, confidentiality, processing integrity, and privacy trust service criteria.

ISO 27001:2022

Current ISMS standard demonstrating systematic management of sensitive information through risk management processes and modern cloud and threat intelligence controls.

ARIA provides controls for 8 of the 10 OWASP LLM risks, including Prompt Injection (LLM01), Excessive Agency (LLM08), and Supply Chain (LLM05). The two unmapped risks — Training Data Poisoning (LLM03) and Model Theft (LLM10) — are model provider responsibilities outside ARIA's scope.

Adversarial ML threat defenses mapped across resource hijacking, ML model access, evasion, exfiltration via AI, and impact/abuse — each with specific ARIA enforcement layers identified.

ARIA supports enterprise traceability, oversight, and evidence collection aligned with EU AI Act requirements including transparency (Article 53), human oversight (Article 14), risk management (Article 9), and record keeping (Annex IV). Specific applicability depends on the organization's role and AI system risk classification.

Policy evaluation API — single PDP surface for LLMs and tools

Delegation token exchange for agent-on-behalf-of-user flows

Fine-grained capability expression beyond OAuth scopes

Sender-constrained tokens, proof-of-possession binding

Tool discovery, invocation, and schema governance

Workflow state versioning via ETag/If-Match