39 · Normas: OWASP e o NIST AI RMF¶

Este capítulo é para as equipes de governança e de segurança. Ele diz, para cada produto, a quais entradas do OWASP Top 10 for LLM Applications 2026 e do OWASP Top 10 for Agentic Applications 2026 ele corresponde, a quais funções do NIST AI Risk Management Framework ele serve, de onde vem cada correspondência, como usá-las como evidência, e o que uma correspondência não é. Toda tabela aqui é gerada a partir do código que faz a correspondência; nenhuma é digitada na página.

As fontes¶

Cada correspondência é atribuída àquilo de onde ela realmente vem:

Fonte	Citação	Identificador
Vassilev 2026	A. Vassilev, "Robust AI Security and Alignment: A Sisyphean Endeavor?", IEEE Security & Privacy 24(3):52-58, May/June 2026, §1	doi:10.1109/MSEC.2026.3678214; arXiv:2512.10100
NIST AI 100-1	NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 26 January 2023	NIST AI 100-1; doi:10.6028/NIST.AI.100-1

O AI RMF é o NIST AI 100-1, o AI Risk Management Framework 1.0, com as suas quatro funções: GOVERN, MAP, MEASURE e MANAGE.
As categorias de guardrail, de A a F, vêm do artigo de A. Vassilev na revista IEEE Security & Privacy (2026), que liga cada categoria a uma cadeia de funções do AI RMF. O artigo é de um cientista do NIST; ele não é uma publicação do NIST, e as categorias não são do NIST. O próprio framework não liga nem regras nem categorias a funções.
O NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (24 de março de 2025), é a taxonomia de ataques do NIST, e é citado onde este guia usa os seus termos de ataque. Ela classifica ataques, não guardrails.

As categorias e as funções a que o artigo liga cada uma:

Categoria de guardrail	Funções do AI RMF, na ordem do artigo
A. Input Guardrails	MAP → MANAGE
B. Policy & Governance Guardrails	GOVERN → MAP → MANAGE
C. Model-Level Guardrails	MAP → MEASURE → MANAGE
D. Output Guardrails	MEASURE → MANAGE
E. Action & Execution Guardrails	GOVERN → MANAGE
F. Monitoring, Auditing & Logging Guardrails	MEASURE → MANAGE

As duas listas da OWASP, cada uma com a edição contra a qual a correspondência foi feita. Uma edição mais nova é uma mudança, revisada, nos dados da correspondência, e não nesta página:

Lista	Edição	A correspondência foi feita contra
OWASP Top 10 for LLM Applications	2026	OWASP Top 10 for LLM Applications 2026, Version 2026: the PDF the official page downloads (sha256 ef87993a4e50ae9d83b41ff7a3d3e6320a82dfa8d4ec6bf98d0ce264b2e6108e), its table of contents and each entry's Description
OWASP Top 10 for Agentic Applications	2026	OWASP Top 10 for Agentic Applications 2026, Version 2026, December 2025: the PDF the official page downloads (sha256 a2db94cd00b08e0b3a5e5b619afe024bdbcd74503111085705e4f3dd886fcb5c), each entry's heading and Description

O Caçador de Bugs em Guardrails, regra por regra¶

O AI RMF¶

A categoria de guardrail e as funções do AI RMF de cada regra, do catálogo de regras. Onde as funções de uma regra são a cadeia da sua categoria, elas são as do artigo; onde diferem, são um julgamento do próprio catálogo, e o seu motivo é dado (em inglês, como o catálogo o escreve):

Regra	Título	Categoria de guardrail	Funções do AI RMF	De quem é a atribuição
QG001	Missing check	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG002	Escapable guard	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG003	Multi-turn escape	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG004	Permissive by default	B. Policy & Governance Guardrails	GOVERN, MAP, MANAGE	a cadeia do artigo para a categoria
QG005	Unshippable policy	B. Policy & Governance Guardrails	GOVERN, MAP, MANAGE	a cadeia do artigo para a categoria
QG006	Unverified region	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	a cadeia do artigo para a categoria
QG007	Read before written	B. Policy & Governance Guardrails	MAP, MEASURE	a do próprio catálogo: a branch reading a variable nothing has set is found by mapping the policy's data flow and measuring the branch it takes; no governance decision is missing
QG008	Call without execute	E. Action & Execution Guardrails	MAP, MANAGE	a do próprio catálogo: the call never happens, so there is nothing to govern: the finding maps a functional gap and the fix manages it
QG009	Undefined bot message	B. Policy & Governance Guardrails	MAP, MANAGE	a do próprio catálogo: which replies the author fixed and which the model writes is a map of the policy, and the fix manages the gap; no governance rule is in question
QG010	Dead action	B. Policy & Governance Guardrails	MEASURE, MANAGE	a do próprio catálogo: whether the action can run at all is measured by a reachability question and managed by the fix; no governance rule is in question
QG011	Confused deputy	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG012	Cascading injection	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG013	Irreversible before undoable	E. Action & Execution Guardrails	MAP, MANAGE	a do próprio catálogo: the defect is in the order of effects on a path, which is mapped and then managed by reordering or confirming; no governance rule is missing
QG014	Order rule escapable	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG015	Undeclared route	B. Policy & Governance Guardrails	MAP	a do próprio catálogo: an undeclared edge is a gap in the map of where the graph can go, and declaring it is mapping; nothing is governed or managed until it is declared
QG016	Unmodelled path	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG017	Model writes code that runs	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	a do próprio catálogo: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG018	Model writes a query or a destination	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	a do próprio catálogo: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG019	Confidential data leaves	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	a do próprio catálogo: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG020	Retrieval not bound to the user	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	a do próprio catálogo: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG021	Untrusted content persisted	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	a do próprio catálogo: the flow is mapped from the team's declarations, measured by a reachability question and managed by the fix; no governance rule is in question
QG022	Rail with a published advisory	B. Policy & Governance Guardrails	GOVERN, MAP	a do próprio catálogo: which rails a configuration runs, at which versions, is a governance decision and a map of what runs; the finding measures nothing a person has not already reproduced
QG023	Unbounded loop	E. Action & Execution Guardrails	MAP, MEASURE, MANAGE	a do próprio catálogo: the cycle is mapped from the graph or the flow, measured by unrolling it to its budget and managed by the fix; no governance rule is in question
QG101	Unchecked action	B. Policy & Governance Guardrails	MAP	a do próprio catálogo: a hotspot asks a person to map whether the action needs a control; nothing is governed or managed until they decide
QG102	Write reached by a slip	E. Action & Execution Guardrails	MAP	a do próprio catálogo: a hotspot asks a person to map whether a write reached by a slip is intended; nothing is governed or managed until they decide
QG103	Irreversible before compensable	E. Action & Execution Guardrails	MAP	a do próprio catálogo: a hotspot asks a person to map the order of the plan's effects; nothing is governed or managed until they decide
QG104	Check missing against its peers	B. Policy & Governance Guardrails	MAP	a do próprio catálogo: a hotspot asks a person to map whether the call needs its siblings' control; nothing is governed or managed until they decide
QG105	Unrecoverable write	E. Action & Execution Guardrails	MAP, MANAGE	a do próprio catálogo: the write's recoverability is mapped and then managed by declaring a compensation or marking it irreversible; no governance rule is missing
QG106	Unpinned tool source	B. Policy & Governance Guardrails	GOVERN, MAP	a do próprio catálogo: a hotspot asks a person to decide what the agent may run and to map where it comes from; nothing is managed until they decide
QG107	Unauthenticated agent channel	B. Policy & Governance Guardrails	GOVERN, MAP	a do próprio catálogo: a hotspot asks a person to decide how agents trust each other and to map the channel; nothing is managed until they decide
QG201	Undecided	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	a cadeia do artigo para a categoria
QG202	Undeclared catalogue	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	a cadeia do artigo para a categoria
QG301	Router bypass	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG302	Unsupported argument	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG303	Platform invariant escaped	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG304	Clarification unbounded	B. Policy & Governance Guardrails	MAP, MANAGE	a do próprio catálogo: an unbounded loop is a property of the router's structure, mapped and then managed by a bound; no governance rule is missing
QG305	Write read as a read	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG306	Wrong write	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG307	Egress through a read	E. Action & Execution Guardrails	GOVERN, MANAGE	a cadeia do artigo para a categoria
QG308	Live collision	B. Policy & Governance Guardrails	MAP, MANAGE	a do próprio catálogo: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG309	Unroutable tool	B. Policy & Governance Guardrails	MAP, MANAGE	a do próprio catálogo: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG310	Router out of step	B. Policy & Governance Guardrails	MAP, MANAGE	a do próprio catálogo: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG311	Unshippable synthesis	B. Policy & Governance Guardrails	MAP, MANAGE	a do próprio catálogo: a defect in how the router was built, mapped and then managed by rebuilding it; no governance rule is in question
QG312	Engine disagreement	F. Monitoring, Auditing & Logging Guardrails	MEASURE, MANAGE	a cadeia do artigo para a categoria
QG320	Negated write runs	E. Action & Execution Guardrails	MEASURE, MANAGE	a do próprio catálogo: found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured
QG321	Read words call a write	E. Action & Execution Guardrails	MEASURE, MANAGE	a do próprio catálogo: found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured
QG322	Hidden egress runs	E. Action & Execution Guardrails	MEASURE, MANAGE	a do próprio catálogo: found by measuring the router against adversarial wording and managed by the fix; the check the category governs exists, and it is what was measured
QG323	Write outside its own words	B. Policy & Governance Guardrails	MAP, MEASURE	a do próprio catálogo: the measurement maps which words reach a write; whether they should is the team's decision, so the finding itself governs and manages nothing
QG324	Unlabelled route to a write	B. Policy & Governance Guardrails	MAP, MEASURE	a do próprio catálogo: the measurement maps which words reach a write; whether they should is the team's decision, so the finding itself governs and manages nothing

OWASP, no nível da política¶

Toda entrada das duas listas, com as regras que a encontram, ou o motivo de nenhuma encontrar. As regras do caçador decidem a parte de cada risco que uma política e o seu catálogo controlam: no nível da política, e não além.

O OWASP Top 10 for LLM Applications 2026:

Entrada	Título	As regras do caçador, no nível da política
`LLM01:2026`	Prompt Injection	QG011, QG012, QG017, QG018, QG021, QG101, QG322
`LLM02:2026`	Sensitive Information Disclosure	QG019, QG020, QG307, QG322
`LLM03:2026`	Excessive Agency	QG001, QG002, QG003, QG004, QG010, QG011, QG013, QG014, QG101, QG103, QG104, QG105, QG301, QG305, QG320, QG321
`LLM04:2026`	Supply Chain	QG022, QG106
`LLM05:2026`	Data and Model Poisoning	Não coberta: a property of training data and model weights, which no guardrail policy decides
`LLM06:2026`	Unbounded Consumption	QG023, QG304
`LLM07:2026`	Misinformation	QG009
`LLM08:2026`	Hidden Context Exposure	QG019
`LLM09:2026`	Vector and Embedding Weaknesses	QG020
`LLM10:2026`	Improper Output Handling	QG017, QG018

O OWASP Top 10 for Agentic Applications 2026:

Entrada	Título	As regras do caçador, no nível da política
`ASI01:2026`	Agent Goal Hijack	QG011, QG015, QG101
`ASI02:2026`	Tool Misuse and Exploitation	QG001, QG002, QG004, QG007, QG011, QG014, QG101, QG102, QG104, QG301, QG302, QG305, QG306, QG308, QG320, QG321, QG323, QG324
`ASI03:2026`	Identity and Privilege Abuse	QG003, QG303
`ASI04:2026`	Agentic Supply Chain Vulnerabilities	QG022, QG106
`ASI05:2026`	Unexpected Code Execution (RCE)	QG017
`ASI06:2026`	Memory & Context Poisoning	QG021
`ASI07:2026`	Insecure Inter-Agent Communication	QG012, QG107
`ASI08:2026`	Cascading Failures	QG012, QG013, QG023, QG103, QG105
`ASI09:2026`	Human-Agent Trust Exploitation	QG009, QG102
`ASI10:2026`	Rogue Agents	QG016

Cada achado traz as mesmas entradas, e cada página de regra também (capítulo 28).

Os outros produtos¶

Para os outros produtos, a pergunta é para quais subcategorias do AI RMF os seus resultados servem de evidência: um certificado em MEASURE, por exemplo, ou uma verificação de ferramenta em MANAGE. Isso é uma afirmação que a empresa faz, então ela fica num único arquivo de dados revisado, linha por linha, cada uma com a data em que foi revisada. Um produto sem linha revisada não afirma nenhuma correspondência.