ADLC compliance: Mapping agentic development to NIST SSDF, the OWASP LLM Top 10, and the EU AI Act

Agentic development lifecycle compliance extends traditional secure software development controls to both the code produced by AI coding agents and the actions those agents take, such as executing shell commands, accessing files, calling MCP tools, and installing packages. The text presents an unofficial Endor Labs interpretation linking NIST SSDF secure-development practices, OWASP’s LLM and Agentic Top 10 risk taxonomies, and the EU AI Act, while emphasizing that it is not legal advice. Existing measures including code review, SAST, SCA, secret detection, container scanning, and release signing remain applicable, but organizations also need inventories for agents and AI-related components, least-privilege and time-limited permissions, real-time action controls, provenance verification, and auditable logs. Models, MCP servers, plugins, skills, and packages should be managed as software supply-chain components, while OWASP risks such as prompt injection, excessive agency, tool misuse, sensitive-data exposure, and supply-chain compromise should be considered both for internal coding agents and AI features shipped to customers. Under the EU AI Act, internal use of coding agents generally primarily requires appropriate AI literacy for staff, whereas products containing AI may trigger provider or deployer duties depending on their intended purpose and risk classification; Annex III high-risk requirements are stated as applying from December 2, 2027. The text argues that system prompts and agent-reported results are not sufficient audit evidence, favoring deterministic policies and independently generated CI, scanner, and logging records.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.