Unofficial checklist · OWASP Agentic 2026
Review one agentic application against practical controls for the OWASP Top 10 for Agentic Applications 2026. Record evidence, gaps, and next actions without sending assessment data anywhere.
This checklist adapts selected mitigation guidance from the OWASP Top 10 for Agentic Applications 2026, licensed under CC BY-SA 4.0. Decision Terrain changed the wording, selection, completion criteria, evidence examples, and interaction format; this adapted checklist content is also offered under CC BY-SA 4.0. OWASP did not create, review, sponsor, or endorse it. Self-reported answers do not establish OWASP conformance, certification, compliance, security, safety, or readiness to deploy. OWASP and the OWASP logo are trademarks of the OWASP Foundation, Inc.
A security review for one agentic application
Use In place only when you can point to implementation evidence. Record the gap and next action when the control is absent, incomplete, or untested. Explain every Not applicable answer.
Answers stay in this browser’s local storage and are not uploaded by this tool. Export a JSON backup before clearing browser data. Other scripts on this site can access this origin’s local storage. Keep entries unclassified and non-sensitive; do not enter CUI, secrets, or operational details.
Keep untrusted content from redirecting an agent's objectives, plans, or actions.
The agent begins with an explicit goal, constraints, permitted actions, and approval boundaries that are version-controlled, auditable, and protected from unreviewed changes during execution.
Evidence to look for: Goal or intent record, approved system instructions, configuration history, change approvals, scope enforcement tests.
Related OWASP Agentic risk: ASI01:2026
User text, documents, retrieved content, messages, tool results, webpages, email, calendar items, and peer-agent output are validated or isolated before they can alter planning, goals, or tool calls.
Evidence to look for: Input inventory, trust boundaries, content filtering, prompt-injection defenses, quarantine flow, negative tests.
Related OWASP Agentic risk: ASI01:2026
Runtime controls compare proposed actions with the active user intent and approved goal, pause unexpected deviations, require suitable approval for high-impact changes, and retain enough history to investigate and roll back.
Evidence to look for: Intent gate, stable goal identifier, deviation alerts, approval logs, goal-hijack tests, rollback exercise.
Related OWASP Agentic risk: ASI01:2026
Constrain how agents select, combine, and invoke legitimate tools.
Each tool exposes only the functions, data scope, rate, cost, and network destinations needed for the agent's assigned task, with dangerous or open-ended capabilities removed or separately governed.
Evidence to look for: Tool inventory, per-tool policy, API scopes, egress allowlist, rate and cost limits, removed-capability record.
Related OWASP Agentic risk: ASI02:2026
A trusted enforcement layer validates the calling identity, current intent, tool name and version, arguments, schema, and policy before execution, with a preview and explicit approval for destructive, financial, publishing, or other high-impact actions.
Evidence to look for: Policy decision point, tool-call schemas, dry-run output, approval rules, fail-closed tests, authorization logs.
Related OWASP Agentic risk: ASI02:2026
Tool execution uses isolated environments and short-lived credentials where appropriate, and monitoring can detect unusual call rates, risky tool combinations, unauthorized egress, budget overruns, and repeated or looping actions.
Evidence to look for: Sandbox configuration, ephemeral-token design, invocation logs, chain-detection rules, budget alarms, revocation test.
Related OWASP Agentic risk: ASI02:2026
Give every agent and delegated task a scoped, attributable identity.
Agents and delegated workers use attributable non-human identities with narrowly scoped, task-bound, time-limited credentials instead of shared accounts, cached user secrets, or inherited manager permissions.
Evidence to look for: Agent identity register, credential scopes, token lifetimes, delegation policy, shared-account scan, offboarding process.
Related OWASP Agentic risk: ASI03:2026
Privileged actions are checked against the current subject, resource, purpose, session, and authorization state at execution time; context switches, delegation, and elevation require revalidation and appropriate human approval.
Evidence to look for: Per-action authorization tests, intent-bound tokens, context-switch rules, approval records, time-of-check/time-of-use tests.
Related OWASP Agentic risk: ASI03:2026
Credentials, memory, and permissions are separated across users, tenants, tasks, and agents, while monitoring identifies unexpected scope requests, credential reuse, and privilege gained through multi-agent delegation chains.
Evidence to look for: Session isolation design, memory-clearing tests, delegation graph, transitive-permission alerts, anomalous elevation review.
Related OWASP Agentic risk: ASI03:2026
Verify the dynamic agents, tools, prompts, registries, and artifacts entering a workflow.
A current inventory covers agents, models, datasets, prompts, memory schemas, tools, packages, MCP or A2A endpoints, registries, and update channels, with provenance, ownership, versions, signatures, or equivalent integrity evidence.
Evidence to look for: SBOM or AIBOM, agent and tool registry, signed manifests, checksums, provenance attestations, dependency owners.
Related OWASP Agentic risk: ASI04:2026
Only approved and pinned sources may introduce or update agents, prompts, tools, and dependencies; registrations and agent cards are authenticated, changes are scanned and tested, and unverified or ambiguous components fail closed.
Evidence to look for: Curated registry, allowlist, version pins, signed agent cards, change gates, typosquat scans, staged rollout results.
Related OWASP Agentic risk: ASI04:2026
Runtime checks detect integrity or behavioral drift in loaded components, and operators can rapidly disable a compromised tool, prompt, agent connection, dependency, or update across affected deployments and restore a trusted version.
Evidence to look for: Runtime signature checks, behavior baselines, drift alerts, kill switch, revocation runbook, rollback exercise.
Related OWASP Agentic risk: ASI04:2026
Keep generated or retrieved content from becoming uncontrolled executable behavior.
Generated, retrieved, or model-selected code is treated as untrusted, passes structural and security validation, and cannot reach eval, deserialization, template, shell, or package-install sinks without an explicit controlled execution path.
Evidence to look for: Generation-to-execution dataflow, prohibited-sink rules, validators, safe interpreter, package policy, negative tests.
Related OWASP Agentic risk: ASI05:2026
Agent-directed code runs as a non-root identity in a per-session sandbox with strict filesystem, process, resource, and network boundaries, and has no direct path to production systems or sensitive host resources.
Evidence to look for: Sandbox profile, filesystem and egress rules, resource quotas, production isolation, escape tests, environment teardown record.
Related OWASP Agentic risk: ASI05:2026
Static checks, dependency checks, adversarial tests, runtime monitoring, and approval gates cover agent-generated code and multi-tool execution chains, with complete records of commands, artifacts, file changes, and outcomes.
Evidence to look for: Scan pipeline, adversarial unit tests, approval policy, execution logs, critical-path diffs, runtime alerts, investigation records.
Related OWASP Agentic risk: ASI05:2026
Protect persistent context from contamination, leakage, and unsafe reuse.
Only authenticated and permitted sources can create or update persistent context, and candidate writes are checked for malicious instructions, sensitive data, provenance, tenant, trust level, and task relevance before commit.
Evidence to look for: Memory-write gateway, source allowlist, content scans, provenance fields, trust scores, rejected-write tests.
Related OWASP Agentic risk: ASI06:2026
Memory is encrypted and isolated by user, tenant, task, and sensitivity; credentials and unnecessary data are excluded; retention and expiry reflect risk; and an agent's own output is not automatically promoted into trusted memory.
Evidence to look for: Namespace design, access tests, encryption settings, retention schedule, secret scans, self-ingestion controls.
Related OWASP Agentic risk: ASI06:2026
Memory stores support version history, anomaly detection, quarantine, expiration of unverified entries, snapshots, and rollback, and adversarial tests cover gradual drift, shared-memory poisoning, cross-tenant retrieval, and trigger persistence.
Evidence to look for: Memory audit trail, anomaly rules, quarantine workflow, snapshots, rollback test, poisoning test suite, retrieval isolation results.
Related OWASP Agentic risk: ASI06:2026
Authenticate, validate, and trace messages exchanged between agents.
Every agent-to-agent connection uses a verified per-agent identity, mutual authentication, and encrypted transport, while registries, discovery services, and agent cards require controlled registration and cryptographic attestation.
Evidence to look for: Agent certificates, mutual-auth configuration, signed agent cards, registry access rules, identity and channel tests.
Related OWASP Agentic risk: ASI07:2026
Messages use signed, versioned, typed contracts with explicit sender, audience, task, and context binding; nonces or equivalent controls block replay; and trusted code validates both structure and consequential intent.
Evidence to look for: Message schema, payload and context signatures, nonce handling, intent validation, replay tests, malformed-message tests.
Related OWASP Agentic risk: ASI07:2026
Gateways allow only approved protocol versions, capabilities, routes, and peers, reject downgrade or descriptor mismatch, and monitor communication for spoofing, unusual routing, context crossover, and unapproved coordination.
Evidence to look for: Protocol allowlist, capability policy, downgrade tests, routing logs, peer verification, communication anomaly alerts.
Related OWASP Agentic risk: ASI07:2026
Contain faults before they spread across agents, tools, tenants, or workflows.
The architecture maps how faults can propagate across planners, executors, agents, tools, memory, tenants, and external systems, then limits fan-out with segmentation, sandboxes, scoped APIs, least privilege, and bounded delegation.
Evidence to look for: Failure-propagation model, trust-boundary diagram, dependency graph, fan-out caps, segmentation and isolation tests.
Related OWASP Agentic risk: ASI08:2026
Independent policy checks validate high-impact invocations and agent outputs before execution or propagation, using short-lived task credentials, validation checkpoints, and human review where the consequence or uncertainty requires it.
Evidence to look for: Planner-executor gate, propagation policy, output validation, task credentials, approval thresholds, bypass tests.
Related OWASP Agentic risk: ASI08:2026
Monitoring identifies rapid fan-out, repeated intent, feedback loops, cross-domain spread, and governance drift, while quotas, rate limits, progress caps, circuit breakers, pause controls, and traceable rollback are exercised against realistic cascade scenarios.
Evidence to look for: Cascade alerts, quotas, circuit-breaker tests, tamper-evident lineage logs, replay environment, rollback and incident exercises.
Related OWASP Agentic risk: ASI08:2026
Help people verify consequential recommendations instead of approving them on confidence alone.
Before a sensitive or irreversible action, the interface shows the proposed effect, destination, source provenance, uncertainty, and material side effects, keeps preview separate from execution, and requires risk-appropriate independent confirmation.
Evidence to look for: Approval UX, provenance display, read-only preview controls, side-effect summary, multi-step confirmation tests.
Related OWASP Agentic risk: ASI09:2026
The experience distinguishes verified facts from agent claims, surfaces low certainty and untrusted sources, avoids manipulative or anthropomorphic cues in high-risk flows, and trains reviewers to challenge confident recommendations and fabricated rationales.
Evidence to look for: Interface guidelines, uncertainty cues, source verification, reviewer training, usability study, manipulation scenarios.
Related OWASP Agentic risk: ASI09:2026
Tamper-evident records link recommendations, evidence, approvals, and actions; monitoring identifies plan divergence or unusual persuasion around sensitive data and actions; and users can report suspicious interactions to trigger review or temporary restriction.
Evidence to look for: Recommendation lineage, behavior alerts, plan-diff rules, report control, lockdown workflow, investigation records.
Related OWASP Agentic risk: ASI09:2026
Detect, contain, and recover agents whose behavior diverges from their authorized purpose.
Each agent has a cryptographically attributable identity and an approved behavioral manifest describing its goals, tools, capabilities, communication paths, and limits, which orchestration controls validate throughout the agent lifecycle.
Evidence to look for: Agent identity, signed behavioral manifest, capability baseline, orchestration validation logs, attestation and key-management design.
Related OWASP Agentic risk: ASI10:2026
Independent monitoring can detect goal drift, stealthy exfiltration, unapproved delegation, collusion, self-replication, reward hacking, abnormal action volume, and coordinated false signals across agents and sessions.
Evidence to look for: Behavior baseline, watchdog or independent monitor, cross-agent telemetry, anomaly rules, challenge tasks, red-team results.
Related OWASP Agentic risk: ASI10:2026
Operators can immediately revoke credentials, stop and isolate suspect agents, preserve evidence, prevent propagation, and require remediation, dependency verification, fresh attestation, and human approval before any return to service.
Evidence to look for: Kill switch, credential revocation, quarantine environment, forensic runbook, recovery baseline, reintegration exercise.
Related OWASP Agentic risk: ASI10:2026
Source, license, and method
The source is the December 2025, Version 2026 OWASP Top 10 for Agentic Applications. Decision Terrain selected mitigation themes and rewrote them as three completion-oriented checks per risk. We added project-authored evidence examples, statuses, system fields, JSON format, and print layout. The ASI risk IDs show where to read the complete descriptions, scenarios, mitigations, mappings, and references; a completed check is not a claim that every recommendation in that OWASP entry has been implemented.
This checklist covers systems that plan, use tools, retain memory, communicate with other agents, or take consequential actions. Use the OWASP LLM Top 10 checklist for the underlying LLM application risks, our secure AI development checklist for model-development practices, and our general AI RMF checklist and Generative AI Profile checklist for broader governance and risk-management questions. Also keep ordinary application, API, identity, cloud, and supply-chain security controls in scope.
Original OWASP material and this adapted checklist content are available under Creative Commons Attribution-ShareAlike 4.0. Checklist version 0.1.0-draft; source reviewed September 23, 2026.