ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs

What it is

Endor Labs' crosswalk of agentic development onto NIST SSDF (SP 800-218 v1.1), the OWASP LLM Top 10 2025, the OWASP Agentic Top 10 (December 2025, labeled 2026) and the EU AI Act. No official crosswalk exists, so the mapping is the vendor's interpretation. The page also promotes Endor Labs products (Coding Agent Governance, AURI, Artifact Signing, Endor Patches).

How it works

Controls are split across a code surface and an action surface. Existing SAST, SCA, secrets detection, container scanning and signing still cover the code surface. New work sits on the action surface: agent inventory, permission scoping, real-time action policy and activity logs.

Specific mappings the page gives:

• PO.1, PO.3, PO.5: a versioned policy on which commands agents may run and which MCP servers they may call.
• PS.1: agents are new principals, so sessions should not read signing keys or change CI config without an exception.
• PW.4: the main new risk, because agents install packages on their own. Models, MCP servers, skills and plugins need provenance and inventory records. This also satisfies OWASP LLM03 and ASI04.
• RV.2: reachability analysis serves as the record of why findings were prioritized.

A worked example is blocking unapproved MCP servers. It maps to PO.3, PO.5, PW.4, LLM03, ASI04 and ASI02, and has no direct AI Act mapping for internal use. The evidence is the allowlist, the policy definition, and log entries of blocked connections with agent, user and timestamp.

The evidence test: a control must hold regardless of what the model decides. A system prompt rule is a request, not a control. An agent's claim that tests passed is not evidence. Use CI results, scanner output, policy engine logs and signed artifacts.

flowchart TD
  A[Using coding agents internally only?] -->|Yes| B[Deployer: Article 4 AI literacy, keep training records]
  A -->|No, shipping AI features| C[Provider or deployer?]
  C --> D{High-risk under Article 6, Annex I or III?}
  D -->|Yes| E[Provider duties: Articles 9, 11, 12, 14, 15]
  D -->|No| F[Check Article 50 transparency]

Preconditions / Affected

• Teams with Cursor, Claude Code or similar agents in their repos who face an audit, customer review or legal question.
• SP 800-218A targets model training and fine-tuning. Teams that only use coding agents should treat it as a vendor-evaluation checklist.
• High-risk AI Act duties depend on intended purpose and role, not on using agents.

What to do

1. Inventory agents, models, MCP servers and skills, and add AI components to the SBOM process instead of a side spreadsheet.
2. Define three deterministic policies first: block destructive commands, block credential file access, allowlist MCP servers. Scope permissions per task (least agency).
3. Make each control-map row emit its artifact automatically, from builds and agent sessions.
4. Run the four-step AI Act scoping path and document the result, including "does not apply".

Dates to use: Article 4 literacy and prohibitions have applied since 2 February 2025. General-purpose AI obligations have applied since 2 August 2025. Most Article 50 duties have applied since 2 August 2026. Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moves Annex III high-risk obligations to 2 December 2027 (from 2 August 2026) and Annex I to 2 August 2028 (from 2 August 2027).

Caveats

• Not legal advice. Meeting the SSDF does not establish AI Act compliance.
• SSDF Rev. 1 (v1.2) was a draft as of December 2025. Check its status before citing practice IDs, and recheck IDs when NIST or OWASP revise.
• SSDF IDs are practice-level anchors, so verify them at task level.
• The page found no 2026 edition of the LLM Top 10. The "2026" label belongs to the Agentic Top 10.
• Check EUR-Lex for changes to the consolidated Act before committing to dates.