Standards mapping · published 2026-09-12
OWASP Agentic Top 10, mapped to controls we actually run.
The OWASP Top 10 for Agentic Applications (2026) names ten agentic risks, ASI01–ASI10. This page maps each one to the measurement controls this estate operates in production — the same controls applied to our own signed cards, roots and keys. To our knowledge this is the first public commercial mapping of the ASI list; if an earlier one exists, tell us and we will cite it in the corrections ledger.
What this page is not
- Not an OWASP product, and not endorsed by OWASP. Cite OWASP for the risks; cite us only for our own controls.
- ASI ids are not GSPC axes and are not on our board. Mapping a risk to a control does not mean the control fully covers the risk.
- This is an informative crosswalk — a measurement of our own practice, never a certification of anyone.
| ASI | Risk (OWASP title) | Our controls / halts | Related public surface |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | Least-privilege tools (only declared capabilities, no undeclared agency) · signed measurement cards only · a statistical tie is reported as a tie, never as an invented win that redirects scope | art5-safeguard, affect and jail axes on the public board (cite, not grade) |
| ASI02 | Tool Misuse & Exploitation | Least-privilege tools · halt on any unsigned leaf — an unsigned artifact is never promoted | conformance axis (tool-use bench) · the MCP door |
| ASI03 | Identity & Privilege Abuse | Signing keys never live on workstations or laptops · halt closed if the board signing key is absent · inter-agent messages must verify | did:web:csoai.org at /.well-known/did.json · the agent card |
| ASI04 | Agentic Supply Chain Vulnerabilities | Signed cards only · the public root is immutable — unsigned leaves do not rewrite history · halt on unsigned leaf | frozen question banks on Hugging Face · methodology DOI · per-page site attestation |
| ASI05 | Unexpected Code Execution | Jail containment is measured as a floor, not assumed · least-privilege tools | jail axis — measured, leader statistically tied (a tie is not a win) |
| ASI06 | Memory & Context Poisoning | Signed cards only · halt when the signed tree and the published tree diverge · when living facts move, re-measure — never freeze a stale claim | ingest gate on new evidence · live GET endpoints over frozen tables |
| ASI07 | Insecure Inter-Agent Communication | Signed inter-agent messages · least-privilege tools | the published agent card and discovery manifests |
| ASI08 | Cascading Failures | Halt on tree divergence · halt on unsigned leaf · no cascade of unearned wins — a tie stays a tie | swarm axis · orchestration results reported as measurements, not engines |
| ASI09 | Human-Agent Trust Exploitation | Never certify · empty slots stay empty and are published as empty · a tie is a tie | the scoreboard's honesty rules · verification is free for everyone, forever |
| ASI10 | Rogue Agents | Operational keys stay off workstations · halt closed on missing key · drift triggers re-measurement and re-attestation · signed cards only | the corrections ledger records every caught divergence, including ours |
Measurement, not certification. Doctrine & refusals · Honesty gate · The measurement board
