# owasp/trisuella-aidlca-framework architecture

> Architecture diagram of the GitHub repository owasp/trisuella-aidlca-framework, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/owasp/trisuella-aidlca-framework
- Repository: https://github.com/owasp/trisuella-aidlca-framework

## Overview

TriSuElla combines a documentary trust, risk, security, and compliance framework with a CLI solution that automates a subset of its rules. The main workflow is an engineer invoking repository checks or a policy audit, with the CLI scanning artifacts and code and producing evidence; `map` reports which rules are automated. The repository also documents IDE scaffolding, agents, a UI, and an AI-BoM. The CLI excerpt shows scanner and BoM-validation behavior, but does not expose all command dispatch or integrations, so only documented relationships are drawn.

Main entry points: [`solution/cli/trisu_validator.py`](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py) (Policy audit), [`framework/rules`](https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/rules) (Rulebook), [`framework/architecture`](https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/architecture) (Trust architecture), [`framework/guides`](https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/guides) (Guides and prompts)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_framework["Framework"]
  node_framework_rules["Rulebook"]
  node_architecture["Trust architecture"]
  node_guides["Guides and prompts"]
end

subgraph group_cli["CLI assurance"]
  node_cli_entry["trisu CLI<br/>[trisu_validator.py]"]
  node_repo_check["Artifact checks<br/>[trisu_validator.py]"]
  node_policy_audit["Policy audit<br/>[trisu_validator.py]"]
  node_code_scan["Code scanners<br/>[trisu_validator.py]"]
  node_rule_map["Rule enforcement map<br/>[trisu_validator.py]"]
end

subgraph group_adoption["Adoption tools"]
  node_templates["IDE and CI templates"]
  node_agent_assets["AIDLCA agents"]
  node_nexus_ui["Sisu Nexus UI<br/>[index.html]"]
end

subgraph group_evidence["Governance evidence"]
  node_ai_bom["AI-BoM<br/>[ai-bom.json]"]
  node_sarif["SARIF evidence"]
end

node_engineer(("Engineer / auditor"))

node_engineer -->|"invokes"| node_cli_entry
node_cli_entry -->|"runs checks"| node_repo_check
node_cli_entry -->|"runs audit"| node_policy_audit
node_cli_entry -->|"runs map"| node_rule_map
node_repo_check -->|"scans code"| node_code_scan
node_policy_audit -->|"scans code"| node_code_scan
node_policy_audit -->|"checks rules"| node_framework_rules
node_rule_map -->|"maps automation"| node_framework_rules
node_policy_audit -->|"produces evidence"| node_sarif
node_policy_audit -->|"produces evidence"| node_ai_bom
node_engineer -->|"scaffolds with"| node_templates
node_engineer -->|"consults"| node_framework_rules
node_engineer -->|"consults"| node_architecture
node_engineer -->|"consults"| node_guides

click node_cli_entry "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py"
click node_repo_check "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py"
click node_policy_audit "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py"
click node_code_scan "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py"
click node_rule_map "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py"
click node_framework_rules "https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/rules"
click node_architecture "https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/architecture"
click node_guides "https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/guides"
click node_templates "https://github.com/owasp/trisuella-aidlca-framework/tree/main/solution/templates"
click node_agent_assets "https://github.com/owasp/trisuella-aidlca-framework/tree/main/solution/agents"
click node_nexus_ui "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/ui/index.html"
click node_ai_bom "https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/ai-bom/ai-bom.json"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_framework_rules,node_architecture,node_guides toneBlue
class node_cli_entry,node_repo_check,node_policy_audit,node_code_scan,node_rule_map toneAmber
class node_templates,node_agent_assets,node_nexus_ui toneMint
class node_ai_bom,node_sarif toneRose
class node_engineer toneIndigo
```

## Components

### Framework

- [Rulebook](https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/rules): `framework/rules`
- [Trust architecture](https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/architecture): `framework/architecture`
- [Guides and prompts](https://github.com/owasp/trisuella-aidlca-framework/tree/main/framework/guides): `framework/guides`

### CLI assurance

- [trisu CLI](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py): `solution/cli/trisu_validator.py`
- [Artifact checks](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py): `solution/cli/trisu_validator.py`
- [Policy audit](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py): `solution/cli/trisu_validator.py`
- [Code scanners](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py): `solution/cli/trisu_validator.py`
- [Rule enforcement map](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/cli/trisu_validator.py): `solution/cli/trisu_validator.py`

### Adoption tools

- [IDE and CI templates](https://github.com/owasp/trisuella-aidlca-framework/tree/main/solution/templates): `solution/templates`
- [AIDLCA agents](https://github.com/owasp/trisuella-aidlca-framework/tree/main/solution/agents): `solution/agents`
- [Sisu Nexus UI](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/ui/index.html): `solution/ui/index.html`

### Governance evidence

- [AI-BoM](https://github.com/owasp/trisuella-aidlca-framework/blob/main/solution/ai-bom/ai-bom.json): `solution/ai-bom/ai-bom.json`
- **SARIF evidence**

### Other components

- **Engineer / auditor**

## Connections

- Engineer / auditor → trisu CLI: invokes (evidence: `README.md`)
- trisu CLI → Artifact checks: runs checks (evidence: `README.md`)
- trisu CLI → Policy audit: runs audit (evidence: `README.md`)
- trisu CLI → Rule enforcement map: runs map (evidence: `README.md`)
- Artifact checks → Code scanners: scans code (evidence: `solution/cli/trisu_validator.py`)
- Policy audit → Code scanners: scans code (evidence: `solution/cli/trisu_validator.py`)
- Policy audit → Rulebook: checks rules (evidence: `README.md`)
- Rule enforcement map → Rulebook: maps automation (evidence: `README.md`)
- Policy audit → SARIF evidence: produces evidence (evidence: `README.md`)
- Policy audit → AI-BoM: produces evidence (evidence: `README.md`)
- Engineer / auditor → IDE and CI templates: scaffolds with (evidence: `README.md`)
- Engineer / auditor → Rulebook: consults (evidence: `README.md`)
- Engineer / auditor → Trust architecture: consults (evidence: `README.md`)
- Engineer / auditor → Guides and prompts: consults (evidence: `README.md`)