LLM Catalog

An LLM catalog is an inventory of large language models that are approved for consumption by applications and AI agents. It gives teams a governed view of what is available, often with access tiers and policy controls attached. A catalog supports consistency, visibility, and safer model selection at scale.

Expanded Definition

An LLM catalog is a governed inventory of large language models that applications and AI agents are allowed to use. It does more than name approved models. It records model identity, version, provider, intended use, access tier, policy constraints, and sometimes routing rules so teams can select a model without bypassing governance.

In practice, the catalog sits between AI builders and the models themselves. That makes it a control point for consistency, risk review, and lifecycle management. It also helps organisations separate experimental models from production-approved ones, which matters when prompts, tools, data access, or output handling differ by use case. The concept aligns closely with the governance expectations in the NIST AI Risk Management Framework and the NIST AI 600-1 Generative AI Profile, especially where model inventory, oversight, and risk treatment must be explicit.

The most common misapplication is treating an LLM catalog as a static list of model names, which occurs when access, policy, and versioning are not tied to actual application runtime decisions.

Examples and Use Cases

Implementing an LLM catalog rigorously often introduces approval overhead and tighter change control, requiring organisations to weigh developer speed against model governance and auditability.

• A product team selects only from a production-approved catalog entry for customer support workflows, while research models remain isolated from regulated data.
• An AI agent retrieves model options from the catalog at runtime, but policy limits prevent it from using models that lack tool-use approval or data residency alignment.
• A security team uses the catalog to record which model version was used by each application release, making later incident review and rollback more reliable.
• An enterprise blocks direct API calls to model providers so that all usage flows through the catalog, where access tiers and logging controls are enforced.
• A platform team marks some models as suitable for low-risk summarisation only, preventing their use in decision-support tasks that require stronger assurance.

Where agentic systems are involved, the catalog also helps determine whether a model may be used for autonomous tool execution, a concern reflected in the OWASP Top 10 for Agentic Applications 2026.

Why It Matters for Security Teams

LLM catalogs matter because they turn model choice into a governed security decision instead of an ad hoc developer preference. Without that layer, organisations struggle to prove which models handled sensitive prompts, which versions were active, and whether the selected model was appropriate for the data or action involved. That gap becomes more serious when AI agents can call tools, move data, or trigger downstream workflows.

For security teams, the catalog is where policy and operational reality meet. It supports model allowlisting, segmentation by risk tier, and evidence collection for audits and incident response. It also reduces the chance that a new model enters production through shadow AI adoption, a pattern that often appears before teams can assess prompt leakage, unsafe output handling, or misaligned autonomy. The OWASP Agentic AI Top 10 and the CSA MAESTRO agentic AI threat modeling framework both reinforce the need to govern model choice alongside the agent behaviours that depend on it.

Organisations typically encounter uncontrolled model sprawl only after a policy breach, model incident, or audit finding, at which point the LLM catalog becomes operationally unavoidable to restore control.

Related resources from NHI Mgmt Group

• How should security teams use LLM-based identity risk scoring in production?
• Why do LLM jailbreaks create an IAM problem?
• What is the difference between prompt injection and LLM remote code execution?
• What is the difference between vault-generated secrets and LLM-generated secrets?