Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Classify how reversible each action is
Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.
OWASP AISVS v1.01, requirement 9.2.3
In plain English
Label every high-impact action by how reversible it is: read-only, reversible, reversible only with outside help, or irreversible. The label must come from a source the agent cannot change, because the rest of the approval system relies on it.
What good looks like
- Every high-impact tool action has a reversibility class.
- The class is set by the tool's owner and stored where the agent cannot write.
- Where reversibility depends on parameters, the class takes that into account. Deleting a draft and deleting a database are different.
- Classes are reviewed when a tool changes.
How teams usually do it
- A reversibility field in each tool's manifest or registry entry, kept in version control and changed by review.
- Default any unclassified action to "irreversible".
- For third-party tools, classify at your gateway and ignore the tool's description of itself.
Suggested evidence
- The list of actions with their classes.
- The review record for a recent tool change.
Common mistakes
- Letting the agent judge how risky its own action is.
- Trusting annotations supplied by a tool server you do not control.
- Calling "send email" reversible because the message can be recalled.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.