Sanctuary Standards Compliance-Evidence Crosswalk

What this is (and is not)

This document maps capabilities Sanctuary already ships to the agent-security controls that enterprise buyers, cyber-insurers, and government procurement are now writing into their requirements. The mid-2026 landscape converged fast: OWASP’s Top 10 for Agentic Applications, ISO/IEC 42001, SOC 2, the proposed US GSAR federal-contractor clause, and the EU Cyber Resilience Act all now describe tamper-evident logging, per-action human oversight, and provable data control as things a deployer must be able to demonstrate.

Honesty contract. This is a capability-to-control map, not a compliance certification. Sanctuary is a control provider; running it does not by itself make a deployer compliant. Every row marked SHIPPED traces to a merged pull request or a coordinator-verified drill; every PARTIAL states its bound; every GAP is named, not hidden. Where a claim could read as a certification, it has been softened to a capability statement.

This crosswalk is a companion to the more granular EU AI Act Coverage Matrix, which maps Sanctuary primitives clause-by-clause to Regulation (EU) 2024/1689.

The standards in scope (what actually bites, and when)

The crosswalk (capability to control)

Legend: SHIPPED = merged and, where relevant, drilled. PARTIAL = shipped with a stated bound. GAP = not built, named honestly.

1. Tamper-evident / non-repudiation logging

(OWASP logging; ISO A.6.2.8; GSAR tamper-evident logging + forensic retention; AI Act Art 12; CRA evidence)

• PARTIAL: hash-chained, tamper-evident audit log. Every persisted state change produces a queryable audit entry; entries carry a per-entry prev_hash + entry_hash sequence and production call sites derive the checkpoint signer when the fortress holds an identity. Identity-less fortresses and the root daemon split audit store write honest unsigned checkpoints, and the standalone verifier reports those checkpoints as findings, so an export carrying unsigned checkpoints does not PASS. audit-chain verify --no-strict reports findings with exit code 10. Any reordering, truncation, or entry edit is detectable by strict verification. This is tamper-evidence; non-repudiation is at checkpoint granularity where signed checkpoints exist. Open defect: IC-05.
• SHIPPED: Enforcement Receipts, external anchoring (opt-in). Sigstore Rekor transparency-log anchoring + an auditor pack + fork detection + log-attested freshness (PR #468/#487/#489). This is the strongest single evidence artifact: a third-party-verifiable proof the audit trail was not altered. Anchoring is opt-in and salted-hash-only. Cross-host verify was drilled (a checkpoint emitted on host A verifies on host B; a tampered checkpoint fails on both).
• SHIPPED: anti-rollback anchoring. Custody-MAC-anchored monotonic anchors (config-downgrade gate #805; fleet ledger anti-rollback #871) prevent a silent rewind of the record.
• GAP (named): per-flow, rule-attributed audit trail. Today the audit is per-uid / per-operation, not per-flow with the specific policy rule that fired attributed to each action. Do not claim the per-flow audit trail is shipped.

2. Human oversight / approval gates

(OWASP human-agent-trust; ISO A.9; SOC 2 accountable-human; AI Act Art 14; CA AB 316)

• SHIPPED: Tier-1 approval gates on the highest-consequence operations. The default policy classifies as Tier-1 (human approval required before execution): state export, state import, raw identity signing, key rotation, governor reset, secure delete, and reputation import. This is the “privileged action attributable to an accountable human” that SOC 2 auditors ask for and that AB 316 makes legally consequential.
• GAP (named), 2026-08-07 correction: plain-English policy view + promote-approval-to-standing-rule (PR #839) was listed here as SHIPPED. Withdraw that. EnglishPolicyActivator is never constructed in any boot path and its required PolicyActivationStore has no construction site in server/src at all, so both production binding sites omit the field and every English-policy route returns 503. The plain-English panel never renders a policy and the “Always allow” control always fails. Do not cite this as an Art 14 “understand, interpret, override” control. Open defect: IC-13.
• PARTIAL: per-action attribution. Approvals are attributable to the operator credential; full per-action human-vs-agent attribution across a long autonomous run is bounded (ties to the per-flow gap above).

3. Provable data control / eyes-off / custody

(GSAR data ownership + eyes-off + segregation; the sovereignty wedge)

• SHIPPED: operator-held custody, vendor not in the data path. Encrypted state lives in the operator’s own storage path; private keys exist only encrypted at rest and transiently in memory for signing, and are never exposed in any response, log, or error (a hard architectural constraint). There is no vendor-held decryption key. Maps to GSAR “eyes-off” and “government owns the data.”
• SHIPPED: encrypted-at-rest with a strong KDF. Argon2id master-key derivation + AES-256-GCM, fail-closed (no plaintext fallback if encryption fails).
• SHIPPED: zero unrequested outbound by default (PR #869/#870). The update-check probe is opt-in (off unless explicitly enabled); no state content leaves the local path except through an explicit, approval-gated export. Maps to GSAR “no external data movement without intent.”

4. Secure deletion

(GSAR secure-deletion-with-written-certification; AI Act data-lifecycle)

• SHIPPED: Tier-1-gated secure delete. A 3-pass random-byte overwrite before unlink, gated behind human approval. Honest bound baked into the tool’s own copy: on copy-on-write / journaled / SSD (flash-FTL) media the original blocks may persist, so at-rest confidentiality rests on encryption rather than on the overwrite alone.
• PARTIAL / phase-2 candidate: a signed deletion certificate. Sanctuary performs the deletion; a signed, exportable certificate of deletion (the artifact GSAR literally names) is a small, high-value add that rides the existing Enforcement-Receipts channel. Not yet built.

5. Data portability / no lock-in

(GSAR open-standards/no-lock-in; EU sovereignty procurement)

• PARTIAL: Exit MVP. CLI user-state export, a completeness manifest, atomic activation, offline verify-exit-bundle, and reputation import/export parity exist, but the whole exit guarantee is partial: dashboard export deliberately omits the state re-key key because that path persists its result, import hides skipped-entry counters, and imported bundles from a fortress that rotated identity keys can silently lose pre-rotation state. Open defect: IC-07, IC-08, IC-09.
• GAP (named): provable clean-erasure exit. Full crypto-shred exit is blocked by deterministic HKDF; today’s exit is honestly “narrow / user-state.” Do not claim provable-clean-erasure.

6. Enforcement (the wall)

(OWASP tool-misuse / rogue-agent containment)

• SHIPPED (bounded): Castle Wall enforces a signed operator policy with a clean per-uid allow/deny demo plus attended reboot-survival, drilled and coordinator-verified on macOS. On Ubuntu 24.04 (x86-64), a fresh install of the shipped package (the separate Castle Wall Linux 0.1.0-1 package, not the npm package) enforces a signed operator policy per user account: blocked destinations stay blocked and allowed ones connect, through five reboots, on three fresh servers, with the evidence checked by two independent reviewers. A signed policy-distribution rail (PR #789) was drilled loopback and cross-machine. Standing honest caveat: this is enforcement of a signed operator policy with a per-uid allow/deny demo, not a per-flow rule-attributed audit trail.
• GAP (named): Linux fault-injection witnesses, a real-agent harness, DNS/DoH/DoT and hostname paths, sustained-operation and overhead, removal or upgrade, any distribution or architecture beyond Ubuntu 24.04 (x86-64), and any package build other than the published checksum-verified pre-release Castle Wall Linux 0.1.0-1 remain unproven. ASSURANCE_MATRIX.md carries the exact Linux bound and next-proof list.
• PARTIAL: fine-grained per-action egress. The coarse network-destination wall is proven; the fine-grained “exclusive-egress” build (Unified Protect) is drilled on both macOS families (Tahoe 26.5.1 arm64 and Sonoma 14.6.1 x86_64, N=3 each) but is not yet a one-command GA install, and the full external “unbypassable” claim still owes LaunchDaemon self-confinement plus a kernel wall on a second OS family. Those two drill legs are two macOS releases, one operating system; see docs/audit/unified-protect-enforcement-status.md. State this bound wherever the wall is described.

7. Identity / privilege

(OWASP identity-abuse; NIST Agent Standards identity/auth)

• SHIPPED: policy-read invariant. The agent cannot read or infer the Principal Policy at runtime; denials return generic messages that do not reveal which tier or rule fired. Ed25519 operator identity, with an available PQC-hybrid signature suite (ed25519 + ML-DSA) selectable for identity operations.
• SHIPPED: honest attestation state. Global and per-agent attestation are surfaced with an evidence-based rule: green only when enforcement is actually real, never on daemon self-report alone.

One-page auditor-facing summary

Sanctuary provides operator-controlled, cryptographically verifiable controls that map to the agent-security controls your framework requires:

• Tamper-evident audit trail (hash-chained, with checkpoint signatures when the fortress holds an identity) with optional external transparency-log anchoring that is third-party verifiable. Identity-less fortresses and the root daemon split audit store write honest unsigned checkpoints, which the standalone verifier reports as findings. Open defect: IC-05. Maps to OWASP logging, ISO 42001 A.6.2.8, GSAR tamper-evident logging + forensic retention, EU CRA evidence, AI Act Art 12 (preparedness).
• Human-approval gates on the operations the policy classifies Tier-1 (export, import, key rotation, secure delete, reputation import), attributable to the operator credential. Maps to SOC 2 accountable-human, ISO A.9, AI Act Art 14, CA AB 316.
• Operator-held custody, vendor not in the data path, encrypted at rest, zero unrequested outbound. Maps to GSAR data ownership + eyes-off, EU sovereignty procurement.
• Tier-1-gated secure delete (phase 2: signed deletion certificate). Maps to GSAR secure-deletion-with-certification.
• Data-portability / exit bundle with offline verification, partial: the dashboard export omits the state re-key key (that path persists its result), import hides skipped-entry counters, and rotated-key imports can lose pre-rotation state. Open defect: IC-07, IC-08, IC-09. Maps to GSAR open-standards/no-lock-in.
• Signed-operator-policy enforcement (per-uid allow/deny, reboot-surviving on macOS and on Ubuntu 24.04 x86-64 within the Assurance Matrix bounds). Maps to OWASP tool-misuse / rogue-agent containment. Linux fault-injection witnesses, a real-agent harness, and every other distribution or architecture remain unproven.

Honest boundaries (we never overclaim): identity-less fortresses and the root daemon split audit store write honest unsigned checkpoints; full exit remains partial across dashboard export, skipped import counters, and rotated-key imports; per-flow rule-attributed audit and provable-clean-erasure exit remain roadmap work; secure delete is best-effort overwrite with at-rest confidentiality resting on encryption; the fine-grained exclusive-egress wall is drilled and still owes a one-command GA install plus a second-OS-family kernel wall before any bare “unbypassable” claim.

Next steps (ranked)

1. Build the signed deletion certificate (phase-2, small, high-value; rides the existing Enforcement-Receipts channel; closes the single most literal GSAR gap).
2. Re-verify the EU AI Act Coverage Matrix against the current tree in the same review pass. Its next_review_due (2026-06-01) is overdue, and its audit-log review notes must match PR #274’s hash chain plus conditional checkpoint-signature bounds. The two documents must agree before either is used externally.
3. Verify GSAR final-rule status and pull the exact OWASP Agentic Top-10 control text before any of this is used in a customer deck.
4. Map to the NIST Agent Interoperability Profile when it lands, to keep the crosswalk current with the US government’s reference standard.

Sources

Evidence anchors: OWASP Top 10 for Agentic Applications 2026; ISO/IEC 42001; GSAR 552.239-7001 (PROPOSED status); EU CRA reporting (Sep 2026) plus the Digital Omnibus high-risk deferral to Dec 2027; NIST AI Agent Standards Initiative; CA AB 316. Sanctuary capability rows trace to merged pull requests: #274 (tamper-evident audit chain plus conditional checkpoint signatures), #468/#487/#489 (Enforcement Receipts / Rekor anchoring), #789 (signed policy-distribution rail), #805/#871 (anti-rollback anchoring), #839 (plain-English policy + promote-to-standing-rule), #869/#870 (zero unrequested outbound).

NOT LEGAL ADVICE. This crosswalk is a technical mapping from Sanctuary primitives to third-party standards; it is not a legal interpretation of any standard or regulation and does not constitute a legal opinion or a claim of certification. Consult qualified counsel before relying on any compliance artifact derived from this document.

Sanctuary Framework · Author: Erik Newton · License: Apache-2.0