Prompt and context boundary
Prompt-risk checks, approved purpose, prohibited actions, source boundaries, and evidence notes.
OWASP AI Security Awareness
Govern what happens after an AI model is wrong, manipulated, or uncertain.
Treat the model as an untrusted component. Put consequential authority in the governed system around it: scoped tools, bounded memory, Human Review, short-lived Runtime Permits, Action Broker mediation, and evidence-backed lifecycle controls.
OWASP references are useful security-awareness inputs. Scaled Agents does not claim OWASP endorsement, certification, approval, or complete security coverage.
Context
Use this page for AI security awareness and review preparation.
This page is for teams that need to connect AI worker design to practical security-review questions before tool access, system writes, external communication, or sensitive-data use.
It focuses on public-safe security preparation: prompt/context boundaries, data minimization, least privilege, allowlists, denylist controls, runtime permits, connector boundaries, monitoring, incident evidence, and pause/disable paths.
Current reference status: OWASP publishes separate community guidance for LLM applications and agentic applications. The current public references are the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026. They are security-awareness inputs, not assurance or complete coverage claims.
- OWASP-aware review input, not OWASP endorsement
- Security readiness support, not a security certification
- Security approval and risk acceptance remain separate accountable decisions
Consequence Containment
Model safeguards matter. The harness must still expect them to fail.
Prompt injection and excessive agency become consequential when generated or retrieved instructions can cross into tools, memory, data movement, external communication, or state change. Model output, retrieved content, tool output, recalled memory, and peer-agent messages can inform a proposal; they do not authorize action.
| Layer | Containment responsibility | Failure response |
|---|---|---|
| Passport and tool permissions | Bind owner, purpose, scope, data classes, permitted tools, prohibited actions, and lifecycle. | Reject requests outside the approved boundary. |
| Toll Gates and Human Review | Revalidate action, arguments, destination, consequence, evidence, and accountable approval. | Block, pause, require evidence, or route to an authorized reviewer. |
| Runtime Permit and Action Broker | Bind short-lived authority to the exact action and mediate the effect. | Reject substitutions, expired authority, or unavailable control-plane decisions. |
| Evidence and lifecycle | Preserve the decision trail and support pause, suspension, revocation, restart, and remediation. | Contain the worker and preserve customer-safe evidence for accountable review. |
Security boundary
These controls support consequence containment and review preparation. They do not guarantee that a model cannot be fooled, establish complete security coverage, or replace customer security testing and risk acceptance.
Readiness Fit
Scaled Agents turns AI security concerns into reviewable records.
AI security risk increases when agents combine prompts, tools, retrieval, memory, data movement, and external action. Governed records make those boundaries visible.
Tool and connector governance
Connector Hub, tool allowlists, denylist posture, owner review, and Runtime Permit requirements.
Least privilege and runtime limits
Scoped permissions, Toll Gates, permit expiration, revocation, and Action Broker decision records.
Monitoring and incident evidence
Workflow Events, Stamps, activity trail, escalation path, remediation, and suspension or revocation state.
Claim boundary
Scaled Agents is not endorsed, certified, approved, or validated by OWASP. OWASP-aware content is used as security-awareness and review-preparation context only; it does not provide security assurance, eliminate risk, or replace security review.
Control Mapping
Map Scaled Agents records to readiness concepts.
This public matrix is an awareness map. It does not copy OWASP risk text or claim complete coverage.
| Requirement / concept | Current Scaled Agents capability | Fit | Recommended improvement |
|---|---|---|---|
| Prompt and input risk | Prompt-risk scoring, source boundaries, prohibited-use flags, and Human Review routing. | Strong | Add public-safe prompt security review packet. |
| Tool misuse and excessive agency | Toll Gates, Runtime Permits, Action Broker, scoped permissions, and denylist controls. | Strong | Add agentic security scenario templates. |
| Sensitive data and leakage risk | Data class, retention boundary, redaction status, evidence summary, and connector limits. | Partial | Add data-exposure evidence checklist. |
| Monitoring and response | Workflow Events, Stamps, lifecycle analytics, escalation, pause, suspension, and revocation states. | Strong | Add security incident evidence export view. |
Product Fit
Product records that support OWASP-aware review.
Records purpose, scope, data boundaries, permitted tools, prohibited actions, and lifecycle state.
Registers planned tools and connectors with owner, environment, allowlist, denylist, and review expectations.
Limits specific action requests by scope, duration, evidence, and review posture.
Routes mock or future controlled action attempts through policy and evidence checks.
Framework Readiness Family
Related public readiness pages.
Use these pages as orientation aids before customer-specific review, implementation, legal analysis, security assessment, audit work, or management approval.