Control crosswalk · Verified August 12, 2026
Map OWASP agentic AI risks to platform controls, deployment-specific safeguards, customer responsibilities, test cases, and retained evidence.
Constrain agents with workflow definitions, assigned MCP capabilities, action policy, approval gates, budgets, and denial tests. Prompt filtering alone is not the boundary.
Evidence: Platform control: tool/action scope and policy result · Customer-owned: approved workflow and risk tier
Carry authenticated actor, tenant, workspace, agent, credential, and resource context into authorization. Avoid token passthrough and implicit authority from prompt content.
Evidence: Platform control: scoped execution context · Deployment-specific: IdP, MFA, token lifetime, and key ownership
Inventory servers, tools, versions, packages, artifacts, and runtime permissions. Restrict execution environments and require review for new or changed capabilities.
Evidence: Shared responsibility: platform assignment and logs; customer approval, scanning, network, and runtime policy
Correlate plans, policy decisions, model routes, tool calls, approvals, retries, failures, costs, and outcomes so responders can contain and reconstruct an incident.
Evidence: Platform control where enabled: session evidence · Customer-owned: retention, response plan, and accountable owners
Name the agent behavior, affected asset, impact, owner, and acceptable boundary.
Mark each safeguard as platform, deployment-specific, customer-owned, or documentary assurance.
Run normal, denied, manipulated, failure, approval, and recovery cases.
Record results, gaps, compensating controls, owner, deadline, and retest date.