Article

How do agent controls map to the OWASP Agentic AI Top 10?

Kapil Bareja

Cyber & Strategic Risk Consulting Leader, Deloitte

For over 20 years, the OWASP Foundation has been publishing its Top Ten lists. The lists’ beauty is in their limited scope: these are strictly awareness documents that name what can go wrong, without offering any control. Using them, security teams can evaluate any proposed solution against a vendor-neutral, bias-free list.

The following is an attempt to reach the same level of abstraction on the control side. Against the ten risks, we’ll map eleven distinct controls. We’ll also use the AIUC-1 standard to try and create anchors for the controls we’re naming.

If you’re not familiar with AIUC-1, it’s a certification standard for AI agents from the Artificial Intelligence Underwriting Company (AIUC). It covers six areas: data and privacy, security, safety, reliability, accountability and societal impact. In March 2026, they claimed that their certification covers all of OWASP Agentic Top Ten items, which prompted OWASP to create a crosswalk in May 2026. That crosswalk named eight areas in which AIUC-1 needs expansion.

OWASP's own Agent Control Standard arrived on 1 September 2026. It defines an Observed Agent talking to a Guardian Agent, traces events through OpenTelemetry and OCSF, and exposes an agent bill of materials through CycloneDX, SPDX, and SWID.

The ten risks, as attacker outcomes

ID	Name	What the attacker gets	Incident named at launch
ASI01	Agent Goal Hijack	The objective is rewritten; the agent keeps its permissions	EchoLeak
ASI02	Tool Misuse and Exploitation	Legitimate tools driven to destructive ends	Amazon Q
ASI03	Identity and Privilege Abuse	The agent operates far outside its intended scope	in appendix only
ASI04	Agentic Supply Chain Vulnerabilities	A runtime component was poisoned before installation	GitHub MCP exploit
ASI05	Unexpected Code Execution (RCE)	Natural language becomes an execution path	AutoGPT RCE
ASI06	Memory & Context Poisoning	Behaviour changes long after the injection	Gemini Memory Attack
ASI07	Insecure Inter-Agent Communication	Spoofed messages misdirect a cluster	in appendix only
ASI08	Cascading Failures	One false signal propagates through automated pipelines	in appendix only
ASI09	Human-Agent Trust Exploitation	A confident explanation gets a harmful action approved	in appendix only
ASI10	Rogue Agents	Misalignment, concealment, self-directed action	Replit meltdown

The eleven controls

#	Control	Standards anchor
C1	Agent discovery and inventory, including shadow AI	ACS inspectable; AgBOM
C2	Agent identity and attribution, one identity per agent bound to a human owner	ACS traceable; AIUC-1 B
C3	Authorization and least privilege, scoped to the task	AIUC-1 A003, B “prevent unauthorized AI agent actions”
C4	Credential hygiene: short-lived, unshared, never static	AIUC-1 A “prevent leakage of credentials and secrets”
C5	Tool and MCP supply chain control: vetting, pinning, attestation	AIUC-1 E “conduct vendor due diligence”; AgBOM
C6	Context and memory integrity: provenance, trust-tiering, write authorization	AIUC-1 B “detect adversarial input”, “implement real-time input filtering”
C7	Runtime action gating: policy hooks, approval on irreversible steps, rate and budget limits	ACS instrumentable; AIUC-1 D “restrict unsafe tool calls”
C8	Blast-radius containment: sandboxing, segmentation, egress control	AIUC-1 B “protect AI system deployment environment”
C9	Observability and audit evidence	ACS observability (OpenTelemetry, OCSF); AIUC-1 E “log AI system activity”
C10	Detection and response: rogue-agent detection, revocation, kill switch	AIUC-1 E “AI failure plan for security breaches”
C11	Lifecycle and governance: onboarding, recertification, decommission	AIUC-1 E “assign accountability”, “review internal processes”

The matrix

P = a correctly implemented control stops the attack. C = the attack succeeds and the control bounds the damage or forces it into view. D = the control produces a signal and nothing else. Blank = no meaningful coverage.

Control	01	02	03	04	05	06	07	08	09	10
C1 Discovery and inventory		D	D	D			D	D		D
C2 Agent identity and attribution	D	D	P				P	D		D
C3 Authorization and least privilege	C	P	P	C	C	C	C	C	C	C
C4 Credential hygiene	C	C	P	C	C		C			C
C5 Tool and MCP supply chain	C	P		P	P	C	C
C6 Context and memory integrity	C	C			C	P	C	C
C7 Runtime action gating	C	P	C	C	P	C	C	P	C	C
C8 Blast-radius containment	C	C	C	C	P		C	P		C
C9 Observability and audit evidence	D	D	D	D	D	D	D	D	D	D
C10 Detection and response	D	D	D	D	D	D	D	C	D	C
C11 Lifecycle and governance		C	C	C						P

Sometimes, the controls hold

ASI03 is the clean case. An agent with its own identity, entitlements scoped to one task, and a short-term credential cannot operate outside its scope, because the scope is the credential. The three controls that prevent it are an entitlement report, a token TTL, and an owner's name.

ASI02 and ASI05 apply the same logic to tools, instead of data. An agent without a delete permission cannot be talked into a destructive call. An agent whose code runs in a sandbox with no egress cannot turn a prompt into an outbound connection. The Amazon Q and AutoGPT incidents both turned on capability the agent should not have had at the moment it was persuaded.

ASI10 is, first and foremost, a discovery problem. An agent is rogue until it’s named, and it stays rogue for as long as nobody decommissions it. Lifecycle governance prevents the orphan case, but does nothing about the misalignment case.

At other times, controls only contain

ASI04 and ASI07 get prevented upstream, by signing and attestation on the supply side, as well as mutual authentication between agents on the communication side. Scoped entitlements limit what a compromised MCP server reaches once it is inside. Take the GitHub MCP exploit: the vetting failed, and what determined the damage was how much the agent could touch afterward.

ASI08 is a systems-architecture property. Circuit breakers, idempotency, and rate limits are what stop a false signal from propagating. They belong to whoever designs the pipeline, with identity controls contributing a ceiling on how far each hop can reach.

Not everything has a control

ASI01 and ASI09 attract no prevention from any of the eleven controls.

Goal hijack is a problem endemic to models. No permission model can stop an agent from being persuaded, only from acting. In other words, things like action gates and permission right-sizing are containment rather than prevention.

ASI06 gets one narrow prevention mark. Write authorization on the memory store can stop an attacker writing to persistent memory, but poisoned content can still enter the context window during a session.

ASI09 has no control at all in this set. Human-Agent Trust Exploitation is approval fatigue: an operator approves because the explanation was fluent and the queue was long. That is a workflow and interface problem. The fix is to carry more information in fewer approval prompts.

Using the map

Run your own controls down the left column and mark the rows you can evidence today. The unmarked rows are the backlog, ordered by how many cells they would fill.

For a single agent, read across instead of down. Which risks apply depends on what that agent can reach, so pick the two or three controls that matter for it and skip the rest.

For an auditor or a board, the matrix answers "are we covered for the OWASP agentic risks" without overclaiming. Coverage of eight is a defensible position. Coverage of ten is not a claim the current control set supports.

‍