Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Enforce the reversibility rules
Verify that the agent runtime enforces reversibility classifications by blocking, requiring approval, or restricting actions based on their impact and ability to be reversed.
OWASP AISVS v1.01, requirement 9.2.4
In plain English
Put the reversibility labels to work. The runtime should let read-only actions through, add limits or approval for reversible ones, and block or require approval for irreversible ones.
What good looks like
- The runtime reads each action's class and applies a defined rule for it.
- Irreversible actions always need human approval or are blocked.
- The rules are stored and enforced outside the agent, which cannot change them.
- Each class has been tested end to end.
How teams usually do it
- Policy rules in the tool gateway keyed on the reversibility class, for example in Open Policy Agent or Cedar.
- Safer variants of risky actions where possible: move to a recycle bin, create a draft for a person to send, apply a change with a snapshot taken first.
- Tighter rate and value limits as reversibility falls.
Suggested evidence
- Policy configuration.
- Test results for each class.
- Gateway logs showing the rule applied.
Common mistakes
- Classifying actions and never enforcing the classes.
- A policy the agent's deployment credentials can edit.
- An "auto-approve" mode switched on for convenience and left on.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.