Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Re-approve if the agent goes beyond the plan
Verify that agent execution which would exceed the approved action chain is blocked until a new approval is obtained, and that the new approval enforces the highest-impact reversibility classification present across the cumulative chain.
OWASP AISVS v1.01, requirement 9.2.11
In plain English
If an agent tries to go beyond the steps that were approved, stop it until there is a new approval. Judge the new approval on everything done so far plus the new steps, because the combined effect is what matters.
What good looks like
- Any action outside the approved chain is blocked.
- A new approval request shows the whole chain, past and proposed, and takes the highest-impact class across it.
- Blocked attempts are logged.
- The agent cannot extend an approval.
How teams usually do it
- The gateway keeps the approved action list for each run and compares every new action with it.
- On a mismatch, the run pauses and a fresh approval request is built from the full history.
- A cap on how many times one run can ask for re-approval.
Suggested evidence
- Tests where an agent adds steps after approval, showing a block and a re-approval at the right level.
- Gateway logs for a re-approved run.
Common mistakes
- Approving the new step in isolation.
- Matching on tool name only, so the same tool with different parameters counts as approved.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.