Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Proactive Security Behavior Monitoring
Assess risk before autonomous actions
Verify that autonomous action triggers include proactive behavior-pattern analysis, security evaluation, and threat-landscape assessment.
OWASP AISVS v1.01, requirement 12.4.1
In plain English
Some agents act without being asked: on a schedule, on a trigger, or because they decided to. Before such an action runs, check it against the agent's recent behaviour, your security rules and current threats.
What good looks like
- Self-initiated actions pass a security evaluation before they run.
- The evaluation considers the agent's recent behaviour pattern as well as the single action.
- Current threat information, such as an active incident or a known malicious source, can tighten the check.
- Results are logged.
How teams usually do it
- A pre-action check in the orchestrator that combines policy rules with behaviour analysis, for example whether this action is normal for this agent at this time.
- A risk level the security team can raise, which makes autonomous actions need approval during an incident.
- Stricter treatment for triggers that come from outside content, such as an incoming email.
Suggested evidence
- The check's configuration.
- Logs of evaluations, including ones that were stopped.
Common mistakes
- Checking user-requested actions and exempting scheduled or self-initiated ones.
- Evaluating each action alone, so a slow sequence of small odd steps passes.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.