Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Approve chains at their riskiest step
Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain, where the chain is established by a component outside the control of the agent being gated.
OWASP AISVS v1.01, requirement 9.2.10
In plain English
When several steps or agents chain together, approve the chain at the level of its riskiest step. Three harmless-looking steps can add up to something irreversible. The chain has to be worked out by a component outside the agent being approved, or the agent can under-report what it plans.
What good looks like
- The full chain of planned actions is known before approval is sought.
- The approval level matches the highest-impact class anywhere in the chain.
- The orchestrator or gateway establishes the chain. It does not take the gated agent's word for it.
- Chains that cross agents are covered.
How teams usually do it
- A planning step that outputs a structured action list, which the gateway classifies and approves as a whole.
- A run or trace ID carried through every agent and tool call, so the gateway can see what belongs to one chain.
- Treating a chain as irreversible if any step is unclassified.
Suggested evidence
- Gateway logic for chain classification.
- Tests with mixed-risk chains, including a risky step delegated to a sub-agent.
Common mistakes
- Approving the first step, after which later steps run freely.
- Splitting a risky operation across agents so no single gate sees all of it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.