OWASP Agentic Top 10 Policy Pack

The OWASP Agentic Security Initiatives (ASI) Top 10 Policy Pack provides pre-built, zero-config governance policies that map directly to the OWASP Agentic Top 10 risks. Deploy comprehensive AI agent governance in minutes — no policy authoring required.

This policy pack addresses all 10 OWASP ASI risks with deterministic governance controls. Each policy is production-ready with sensible defaults, and can be customized for your specific risk tolerance.

Why This Matters

Risk	Without Policy Pack	With OWASP Policy Pack
Coverage gaps	Manual policy authoring misses risks	All 10 ASI risks covered out of the box
Slow onboarding	Weeks to author comprehensive policies	Deploy in minutes with zero-config
Inconsistent controls	Different teams implement different controls	Standardized controls across all agents
Compliance evidence	Must manually map controls to frameworks	Pre-mapped to OWASP ASI, NIST AI RMF, ISO 42001
Maintenance burden	Policies drift as threats evolve	Pack updated with each TealTiger release

Compliance alignment: OWASP ASI Top 10 (complete coverage), NIST AI RMF (cross-mapped), ISO 42001 (cross-mapped), EU AI Act (relevant articles referenced).

Quick Start

import { TealEngine, OWASPPolicyPack } from 'tealtiger';

// Zero-config deployment — all 10 ASI risks covered
const engine = new TealEngine({
  policy: OWASPPolicyPack.default(),
  modules: OWASPPolicyPack.modules()
});

// That's it. All 10 OWASP ASI risks are now governed.

Customized Deployment

const engine = new TealEngine({
  policy: OWASPPolicyPack.configure({
    // Override specific risk settings
    'ASI-01': { mode: 'ENFORCE', sensitivity: 'high' },
    'ASI-06': { dailyLimit: 100.00, perRequestLimit: 5.00 },
    'ASI-07': { requireAttestation: true, jitEnabled: true },
    // Disable a specific risk (not recommended)
    'ASI-10': { enabled: false }
  }),
  modules: OWASPPolicyPack.modules()
});

ASI Mapping Table

ASI ID	Risk Name	TealTiger Control	Module	Automation Level
ASI-01	Prompt Injection	Content classification + pattern detection	TealClassifier	`auto_deny`
ASI-02	Agentic Behavior Manipulation	Behavioral drift detection + baselines	TealDrift	`approval_required`
ASI-03	Insecure Tool/Function Execution	Scope enforcement + FREEZE rules	TealEngine + NHI	`auto_deny`
ASI-04	Data Exfiltration via Agent	Content classification + destination controls	TealClassifier + TealState	`auto_deny`
ASI-05	Improper Output Handling	Output validation + sanitization	TealClassifier	`auto_sanitize`
ASI-06	Excessive Resource Consumption	Cost limits + reasoning budgets + anomaly detection	TealMonitor v2	`auto_deny`
ASI-07	Identity & Access Control	NHI lifecycle + JIT grants + attestation	NHI Governance	`auto_deny`
ASI-08	Excessive Agency	Scope enforcement + temporal controls + context governance	TealTemporal + TealState	`approval_required`
ASI-09	Governance & Compliance Bypass	FREEZE rules + anti-tamper + bundle integrity	Anti-Tamper	`auto_deny`
ASI-10	Inadequate Logging & Monitoring	TealProof + SOC pipeline + OTel spans	TealProof + SOC	`auto_allow`

Policy Details by ASI Risk

ASI-01: Prompt Injection

Risk: Malicious prompts manipulate agent behavior by injecting instructions into user input, tool outputs, or retrieved documents. Controls:

Local ML classification of all inputs for injection patterns
Regex pattern matching for known injection techniques
Ensemble mode (union) for maximum recall
Auto-deny on high-confidence injection detection

# ASI-01 policy configuration
asi_01_prompt_injection:
  classifier:
    mode: ensemble_union
    categories: [prompt_injection, jailbreak]
    confidence_threshold: 0.7
  action: auto_deny
  reason_code: ASI01_PROMPT_INJECTION_DETECTED
  scan_targets: [user_input, tool_output, retrieved_documents]

ASI-02: Agentic Behavior Manipulation

Risk: Agent behavior is subtly altered through indirect prompt injection, model updates, or configuration changes without triggering explicit policy violations. Controls:

Statistical baseline tracking per agent
Drift detection across action, tool, content, and temporal dimensions
MCP definition-drift monitoring
Escalation to human review on significant drift

# ASI-02 policy configuration
asi_02_behavior_manipulation:
  drift:
    enabled: true
    min_samples: 100
    sensitivity: medium
    baselineWindow: 7d
    mcpMonitoring: true
  thresholds:
    monitor: 0.3
    escalate: 0.6
    deny: 0.8
  action_on_escalate: approval_required

ASI-03: Insecure Tool/Function Execution

Risk: Agents invoke tools or functions without proper authorization, input validation, or scope checks. Controls:

NHI scope enforcement on every tool call
FREEZE rules for critical tool categories
Input validation for tool parameters
Environment binding (staging tools can’t run in production)

# ASI-03 policy configuration
asi_03_insecure_tool_execution:
  scope_enforcement: true
  freeze_rules:
    - condition: { tool_category: destructive, environment: production }
      reason: FREEZE_DESTRUCTIVE_TOOL_PRODUCTION
    - condition: { tool: shell_execute }
      reason: FREEZE_SHELL_EXECUTION
  input_validation:
    sql_injection: true
    path_traversal: true
    command_injection: true

ASI-04: Data Exfiltration via Agent

Risk: Agents leak sensitive data (PII, secrets, intellectual property) to unauthorized destinations through tool calls, API responses, or memory. Controls:

Content classification of all outbound data
Destination allowlisting
Secret detection with auto-redaction
Context provenance tracking

# ASI-04 policy configuration
asi_04_data_exfiltration:
  classifier:
    categories: [pii, secrets, intellectual_property, phi]
    mode: ensemble_union
  outbound_controls:
    require_destination_allowlist: true
    block_external_on_sensitive: true
  secret_detection:
    enabled: true
    action: auto_sanitize
    method: redact

ASI-05: Improper Output Handling

Risk: Agent outputs contain sensitive data, hallucinated information, or harmful content that reaches end users without validation. Controls:

Output content classification
PII auto-redaction in responses
Confidence scoring for generated content
Sanitization before delivery

# ASI-05 policy configuration
asi_05_improper_output:
  output_classification:
    enabled: true
    categories: [pii, harmful, confidential]
  sanitization:
    pii: { method: redact, replacement: '[REDACTED]' }
    harmful: { action: auto_deny }
    confidential: { action: auto_deny }

ASI-06: Excessive Resource Consumption

Risk: Agents consume unbounded compute, token, or API resources through runaway loops, prompt injection, or misconfiguration. Controls:

Per-request cost limits
Daily per-agent budgets
Reasoning-token budgets (o1/o3)
Cost anomaly detection
Velocity-based rate limiting

# ASI-06 policy configuration
asi_06_resource_consumption:
  cost_limits:
    per_request_usd: 2.00
    daily_per_agent_usd: 50.00
    monthly_global_usd: 10000.00
  reasoning_budget:
    max_per_request: 10000
    daily_limit: 100000
  anomaly_detection:
    enabled: true
    sensitivity: medium
    action: approval_required

ASI-07: Identity & Access Control

Risk: Agents operate without proper identity verification, accumulate excessive privileges, or persist beyond their intended lifecycle. Controls:

NHI registration and lifecycle management
Cryptographic attestation
Zero Standing Privilege with JIT grants
Session TTL enforcement
Scope enforcement

# ASI-07 policy configuration
asi_07_identity_access:
  nhi:
    require_registration: true
    require_attestation: true
    enforce_scopes: true
    enforce_environment: true
  jit:
    enabled: true
    max_grant_duration: 1h
    require_approval: true
  session:
    default_ttl: 8h
    max_ttl: 24h

ASI-08: Excessive Agency

Risk: Agents perform actions beyond their intended scope, make irreversible decisions without human oversight, or operate without temporal boundaries. Controls:

Temporal constraints (session TTL, cooldowns, time-of-day)
Context size governance
Approval gates for high-risk actions
Action frequency limits

# ASI-08 policy configuration
asi_08_excessive_agency:
  temporal:
    session_ttl: 8h
    cooldowns:
      - action: "*.delete"
        cooldown: 30s
      - action: "payment.*"
        cooldown: 5m
    time_restrictions:
      - actions: ["deployment.*"]
        allowed: { days: [mon,tue,wed,thu,fri], hours: "09:00-17:00" }
  context:
    max_tokens: 8192
    require_provenance: true
  approval_gates:
    - condition: { action: "*.delete", environment: production }
      automation: approval_required

ASI-09: Governance & Compliance Bypass

Risk: Governance controls are circumvented through configuration tampering, policy hot-swap attacks, or separation-of-duties violations. Controls:

FREEZE rules (immutable, non-overridable)
Anti-tamper detection with alerting
Bundle integrity validation
Forbidden config key rejection
Workload identity binding

# ASI-09 policy configuration
asi_09_governance_bypass:
  freeze_rules:
    - id: FREEZE-META-001
      condition: { action: governance.*.modify }
      reason: FREEZE_GOVERNANCE_MODIFICATION
    - id: FREEZE-META-002
      condition: { action: freeze.disable }
      reason: FREEZE_META_TAMPER
  anti_tamper:
    bundle_integrity: required
    forbidden_keys: [freeze.disable, audit.disable, nhi.bypass]
    workload_binding: true

ASI-10: Inadequate Logging & Monitoring

Risk: Governance decisions are not logged, evidence is not preserved, and security teams have no visibility into AI agent operations. Controls:

TealProof cryptographic receipts for every decision
Governance Passport for continuous coverage proof
SIEM export (JSON/CEF/LEEF)
OpenTelemetry spans
Response hooks for automated alerting

# ASI-10 policy configuration
asi_10_logging_monitoring:
  proof:
    receipts: true
    passport: true
    tsa: "https://freetsa.org/tsr"
  siem:
    format: json
    min_severity: low  # Log everything
  otel:
    enabled: true
  response_hooks:
    - trigger: { severity: high }
      actions: [pagerduty, slack]

Compliance Cross-Reference

ASI Risk	NIST AI RMF	ISO 42001	EU AI Act
ASI-01	MAP 2.3, MEASURE 2.6	A.8.2	Art. 15
ASI-02	MEASURE 2.7	A.9.4	Art. 9
ASI-03	GOVERN 1.2	A.6.2.4	Art. 14
ASI-04	MAP 2.3	A.8.2	Art. 10, GDPR
ASI-05	MEASURE 2.5	A.8.3	Art. 15
ASI-06	GOVERN 2.3	A.6.2.6	Art. 9
ASI-07	MAP 1.5	A.6.2.4	Art. 14
ASI-08	GOVERN 3	A.9.3	Art. 14
ASI-09	GOVERN 1.2	A.8.4	Art. 15
ASI-10	DE.CM	A.12.4	Art. 12

TealEngine v1.3 API — Engine that executes these policies
FREEZE Rules — Immutable controls (ASI-09)
NHI Governance — Identity controls (ASI-07)
TealDrift — Drift detection (ASI-02)
SOC/IR Pipeline — Monitoring pipeline (ASI-10)
Anti-Tamper Controls — Tamper prevention (ASI-09)

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

OWASP Agentic Top 10 Policy Pack

Why This Matters

Quick Start

Customized Deployment

ASI Mapping Table

Policy Details by ASI Risk

ASI-01: Prompt Injection

ASI-02: Agentic Behavior Manipulation

ASI-03: Insecure Tool/Function Execution

ASI-04: Data Exfiltration via Agent

ASI-05: Improper Output Handling

ASI-06: Excessive Resource Consumption

ASI-07: Identity & Access Control

ASI-08: Excessive Agency

ASI-09: Governance & Compliance Bypass

ASI-10: Inadequate Logging & Monitoring

Compliance Cross-Reference

​Why This Matters

​Quick Start

​Customized Deployment

​ASI Mapping Table

​Policy Details by ASI Risk

​ASI-01: Prompt Injection

​ASI-02: Agentic Behavior Manipulation

​ASI-03: Insecure Tool/Function Execution

​ASI-04: Data Exfiltration via Agent

​ASI-05: Improper Output Handling

​ASI-06: Excessive Resource Consumption

​ASI-07: Identity & Access Control

​ASI-08: Excessive Agency

​ASI-09: Governance & Compliance Bypass

​ASI-10: Inadequate Logging & Monitoring

​Compliance Cross-Reference

​Related Documentation

Why This Matters

Quick Start

Customized Deployment

ASI Mapping Table

Policy Details by ASI Risk

ASI-01: Prompt Injection

ASI-02: Agentic Behavior Manipulation

ASI-03: Insecure Tool/Function Execution

ASI-04: Data Exfiltration via Agent

ASI-05: Improper Output Handling

ASI-06: Excessive Resource Consumption

ASI-07: Identity & Access Control

ASI-08: Excessive Agency

ASI-09: Governance & Compliance Bypass

ASI-10: Inadequate Logging & Monitoring

Compliance Cross-Reference

Related Documentation