NIST SP 800-53 Control Mapping - Pipelock#

How Pipelock's runtime security controls map to NIST SP 800-53 Rev. 5 security and privacy controls. This mapping targets the control families most relevant to AI agent runtime security.

Scope: Pipelock is an application-layer agent firewall with process containment. It covers network egress filtering, content inspection, audit logging, process isolation, and human oversight for AI agent deployments. It does not cover identity management, physical security, personnel security, or full-lifecycle system authorization. This mapping is for informational purposes and does not constitute compliance certification.

Last reviewed: August 2026 against v3.4.0. This mapping describes current
behavior; see CHANGELOG.md for release history.

Recent control additions reviewed:

AC-4 / SI-10: v3.4 reverse-proxy media request bodies are inspected before forwarding, and oversized bodies fail closed rather than forwarding an unverified prefix.
CM-3 / SI-4: v3.4 removes inert airlock trigger fields and makes scan instrumentation errors distinct from policy findings in CI.
CM-2 / CM-3: Enterprise Conductor distributes signed policy bundles to enrolled followers and performs follower drift preflight before activation.
IR-4: Enterprise Conductor remote kill and rollback authorization provide fleet-level emergency controls while followers continue to enforce locally.
AU-6 / AU-12: Enterprise signed fleet audit surfaces add organization, fleet, and instance namespacing for centralized review.
AC-3 / AC-6: The operator dashboard ships OIDC, mTLS, and token authentication with bounded dashboard permissions and raw-view separation.
AC-3: request_policy operation rails deny configured dangerous API operations before a request leaves the protected boundary.
AC-4(4): header-DLP parity, scan API tool-call scanning, and response scan-cap fail-closed behavior extend content checks across additional egress and evaluation surfaces.
SC-7: submit-profile reverse-proxy dialing uses the SSRF-safe dial path, and response scan-cap overruns fail closed instead of forwarding an uninspected prefix.
SC-7(5): WebSocket request_policy checks apply per text frame, so long-lived sockets keep enforcing deny-by-exception operation rules after the upgrade.
SI-4(4): WebSocket per-frame checks, Scan API tool-call scanning, and file_sentry skip visibility improve monitoring of outbound communications, tool arguments, and local write surfaces.
SI-10: request_policy GraphQL/discriminator handling, media canonical-end truncation, and redaction passthrough hardening improve input validation on structured operations and ambiguous payloads.
SI-12 / SC-28: redaction hash-class and SigV4 carve-outs reduce destructive false-positive rewrites while preserving secret-class handling, and file_sentry.max_file_bytes makes at-rest file scanning limits visible and operator-tunable.

Coverage Summary#

Control Family	Coverage	Key Controls
AC — Access Control	Moderate	AC-3, AC-4, AC-6, AC-17
AU — Audit and Accountability	Strong	AU-2, AU-3, AU-6, AU-12
CA — Assessment, Authorization	Partial	CA-7
CM — Configuration Management	Moderate	CM-2, CM-3, CM-7
IR — Incident Response	Moderate	IR-4, IR-5, IR-6
SC — System and Communications	Strong	SC-4, SC-7, SC-8, SC-13
SI — System and Information Integrity	Strong	SI-3, SI-4, SI-7, SI-10

AC — Access Control#

Control	Name	Pipelock Feature	Coverage
AC-3	Access Enforcement	Tool policy rules enforce per-tool allow/deny decisions. Per-agent profiles with independent budgets and rate limits. Sandbox restricts filesystem and network access.	Strong
AC-4	Information Flow Enforcement	Capability separation: agent (secrets, no direct network) communicates through Pipelock (policy-controlled egress, no agent secrets). DLP scanning applies on inspection-capable mediated surfaces; deployment isolation enforces the flow boundary.	Strong
AC-4(4)	Content Check	The ordered scanner pipeline applies destination, DLP, entropy, injection, and SSRF controls where each transport exposes the relevant content. Plain CONNECT without TLS interception remains hostname-only. Full-schema tool-poisoning detection applies to mediated MCP tool metadata.	Strong
AC-6	Least Privilege	Per-agent profiles constrain each agent to specific listeners, rate limits, and data budgets. Sandbox Landlock restricts filesystem to declared paths only. Seccomp restricts syscalls to an allowlist on linux/amd64; other architectures report the layer unavailable.	Strong
AC-6(9)	Log Use of Privileged Functions	Mediated tool calls, scanner decisions, and policy actions produce structured records with the identity and operation fields available to that transport.	Strong
AC-17	Remote Access	Kill switch API with bearer-token authentication and optional IP allowlist. Port isolation prevents agent self-deactivation.	Moderate

Gap: Agent identity is config-based (HTTP header or listener binding), not certificate-based. mTLS agent authentication is on the enterprise roadmap.

AU — Audit and Accountability#

Control	Name	Pipelock Feature	Coverage
AU-2	Event Logging	Mediated enforcement and scanner events generate structured audit records with category, severity, agent identity, and scan reasoning where available. Blocks emit signed action receipts; allow receipts are opt-in with `require_receipts`, and clean stream frames are summarized.	Strong
AU-3	Content of Audit Records	Events include: timestamp, agent name, source IP, destination URL/domain, scan result, scanner reason, matched pattern, action taken, duration. Receipts additionally include `policy_hash`, `action_id` (UUIDv7), transport, and taint-aware fields (`session_taint_level`, `authority_kind`, `session_task_id`).	Strong
AU-3(1)	Additional Audit Information	Session profiling adds risk scores, domain burst detection, and behavioral anomaly indicators per session. Mediation envelope (`Pipelock-Mediation` header) carries the same action ID + policy hash on the wire for downstream correlation.	Strong
AU-6	Audit Record Review, Analysis, Reporting	Prometheus metrics with counters and histograms. Grafana dashboard template. SARIF output for CI integration. Report generation with risk rating and evidence appendix. `pipelock session inspect/explain` surfaces recent events and trigger/evidence for active airlock escalations.	Strong
AU-8	Time Stamps	All events use RFC 3339 timestamps from the system clock.	Strong
AU-10	Non-Repudiation	Action receipts are Ed25519-signed with a hash-chained sequence (`chain_prev_hash`, `chain_seq`). Transcript root commits seal sections of the chain. `pipelock verify-receipt` and the cross-implementation conformance suite (`sdk/conformance/`) let third parties verify receipts without trusting pipelock.	Strong
AU-12	Audit Record Generation	Three queued emission targets: webhook, syslog (UDP or TCP, JSON or CEF), and OTLP (HTTP/protobuf). Prometheus `/metrics` endpoint. The flight recorder writes signed JSONL receipts when configured.	Strong

Partial: Core per-instance emission is best-effort. The Enterprise durable SIEM forwarder adds at-least-once delivery with an on-disk spool and replay across restarts, and the Enterprise Conductor provides a signed-evidence fleet audit sink namespaced per org, fleet, and instance.

CA — Assessment, Authorization, and Monitoring#

Control	Name	Pipelock Feature	Coverage
CA-7	Continuous Monitoring	Hot-reload config (fsnotify + SIGHUP) for live policy updates. Prometheus real-time metrics with alerting integration. Adaptive enforcement escalates risk scores per session.	Moderate
CA-7(4)	Risk Monitoring	Adaptive enforcement tracks per-session risk with automatic escalation from warn to block based on accumulated threat signals. Domain burst detection flags unusual access patterns.	Moderate

Gap: Pipelock monitors agent-to-internet traffic continuously but does not perform system-level vulnerability assessment or configuration compliance scanning.

CM — Configuration Management#

Control	Name	Pipelock Feature	Coverage
CM-2	Baseline Configuration	YAML config with version field and preset modes (strict, balanced, audit). Community rule bundles with Ed25519 signing and version tracking.	Moderate
CM-3	Configuration Change Control	Hot-reload with atomic config swap. Config changes logged. Kill switch state preserved across reloads. Community rules verified against trusted keyring on load.	Moderate
CM-7	Least Functionality	Strict mode restricts to allowlisted API domains only. On linux/amd64 the seccomp syscall allowlist blocks unnecessary kernel operations; other architectures report the layer unavailable. Sandbox restricts filesystem to declared paths.	Strong
CM-7(5)	Authorized Software	Tool policy rules constrain which MCP tools can execute. Session binding pins tool inventory at session start — unauthorized tool additions are detected.	Moderate

Partial: Core/OSS has no fleet plane. Fleet-wide policy-bundle distribution, remote kill, rollback, and drift preflight ship in the Enterprise Conductor over mTLS/SPIFFE. Fine-grained canary rollout remains a roadmap item.

IR — Incident Response#

Control	Name	Pipelock Feature	Coverage
IR-4	Incident Handling	Kill switch provides emergency deny-all from six independent sources: config, API, Conductor remote kill, Conductor stale-bundle detection, SIGUSR1, and sentinel file. Any active source denies normal traffic, subject to configured endpoint and IP exemptions. Deactivating one source does not affect the others.	Strong
IR-4(1)	Automated Incident Handling	Adaptive enforcement automatically escalates from warn to block when per-session risk threshold is exceeded.	Moderate
IR-5	Incident Monitoring	Prometheus metrics track blocked requests by category. Session profiling identifies high-risk sessions. Event emission forwards alerts to SIEM in real time.	Strong
IR-6	Incident Reporting	Structured audit events include MITRE ATT&CK mappings for applicable threat classes. Report generation can produce Ed25519-signed evidence packages when signing is configured.	Strong

SC — System and Communications Protection#

Control	Name	Pipelock Feature	Coverage
SC-4	Information in Shared Resources	Per-agent profiles isolate budgets, rate limits, and session state. Sandbox provides process-level isolation via Landlock and network namespaces, plus seccomp on linux/amd64.	Strong
SC-7	Boundary Protection	Capability separation enforces a deployment boundary between the agent (privileged, no direct network) and policy-controlled egress through Pipelock. The ordered URL pipeline inspects mediated destination data; content inspection depends on transport visibility, with plain CONNECT remaining hostname-only.	Strong
SC-7(5)	Deny by Default / Allow by Exception	Strict mode denies all traffic except explicitly allowlisted API domains. Fail-closed on timeout, parse error, and context cancellation.	Strong
SC-8	Transmission Confidentiality and Integrity	TLS interception for CONNECT tunnels with per-host certificate generation. Ed25519 signing for reports, rules, and integrity manifests.	Moderate
SC-13	Cryptographic Protection	Ed25519 for signing (keys, reports, community rules, integrity manifests). SHA-256 for tool baseline hashing and file integrity. TLS for proxy traffic.	Moderate
SC-28	Protection of Information at Rest	Audit logs written with structured JSON. File permissions enforced at 0o600. Community rule bundles verified with Ed25519 signatures.	Partial

Gap: SC-28 covers information at rest broadly. Pipelock protects its own config and log files but does not encrypt audit logs at rest. Audit encryption is a consideration for regulated deployments.

SI — System and Information Integrity#

Control	Name	Pipelock Feature	Coverage
SI-3	Malicious Code Protection	Tool poisoning detection scans all schema fields for injected instructions. Response scanning detects prompt injection in tool results. DLP prevents secret exfiltration.	Strong
SI-4	System Monitoring	Continuous scanning of mediated HTTP, WebSocket, and MCP traffic. Prometheus metrics, structured logging, session profiling, and adaptive enforcement provide layered monitoring.	Strong
SI-4(4)	Inbound and Outbound Communications Traffic	Bidirectional MCP scanning checks mediated outbound tool input for DLP and inbound results for injection. The URL scanner covers mediated HTTP destinations, while payload visibility depends on transport mode. The WebSocket proxy scans frames in both directions.	Strong
SI-7	Software, Firmware, and Information Integrity	Binary integrity monitoring (`pipelock integrity`). Community rule bundle signature verification. Tool baseline drift detection (SHA-256 per session). SLSA provenance on releases.	Strong
SI-10	Information Input Validation	MCP input scanning validates tool call arguments for DLP and injection patterns. Shell obfuscation detection (octal, hex, brace expansion, variable substitution, command substitution) normalizes input before matching.	Strong

Architectural Note#

Pipelock operates at the application and network layer, providing controls that map most directly to AC-4 (information flow), AU (audit), SC-7 (boundary protection), and SI-3/SI-4 (malicious code and monitoring). Controls requiring organizational process (risk assessment, personnel, physical security) are outside the current scope. Enterprise Conductor ships fleet policy-bundle distribution, remote kill, rollback, and drift preflight; dashboard OIDC/RBAC ships separately. Fine-grained Conductor canary rollout and Conductor admin RBAC/SSO remain roadmap items.

For FedRAMP and government procurement, pair Pipelock's runtime enforcement with complementary controls: identity management (AC-2, IA family), vulnerability management (RA-5), and organization-specific governance for Enterprise Conductor rollout.