How owasp/trisuella-aidlca-framework works
TriSuElla combines a documentary trust, risk, security, and compliance framework with a CLI solution that automates a subset of its rules. The main workflow is an engineer invoking repository checks or a policy audit, with the CLI scanning artifacts and code and producing evidence; map reports which rules are automated. The repository also documents IDE scaffolding, agents, a UI, and an AI-BoM. The CLI excerpt shows scanner and BoM-validation behavior, but does not expose all command dispatch or integrations, so only documented relationships are drawn.
Main entry points: trisu_validator.py Policy audit · rules Rulebook · architecture Trust architecture · guides Guides and prompts
Components 14
Framework
- Rulebook
framework/rules - Trust architecture
framework/architecture - Guides and prompts
framework/guides
CLI assurance
- trisu CLI
solution/cli/trisu_validator.py - Artifact checks
solution/cli/trisu_validator.py - Policy audit
solution/cli/trisu_validator.py - Code scanners
solution/cli/trisu_validator.py - Rule enforcement map
solution/cli/trisu_validator.py
Adoption tools
- IDE and CI templates
solution/templates - AIDLCA agents
solution/agents - Sisu Nexus UI
solution/ui/index.html
Governance evidence
- AI-BoM
solution/ai-bom/ai-bom.json - SARIF evidence
Other components
- Engineer / auditor
Connections 14
- Engineer / auditor → trisu CLI: invokes
README.md - trisu CLI → Artifact checks: runs checks
README.md - trisu CLI → Policy audit: runs audit
README.md - trisu CLI → Rule enforcement map: runs map
README.md - Artifact checks → Code scanners: scans code
solution/cli/trisu_validator.py - Policy audit → Code scanners: scans code
solution/cli/trisu_validator.py - Policy audit → Rulebook: checks rules
README.md - Rule enforcement map → Rulebook: maps automation
README.md - Policy audit → SARIF evidence: produces evidence
README.md - Policy audit → AI-BoM: produces evidence
README.md - Engineer / auditor → IDE and CI templates: scaffolds with
README.md - Engineer / auditor → Rulebook: consults
README.md - Engineer / auditor → Trust architecture: consults
README.md - Engineer / auditor → Guides and prompts: consults
README.md