Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
AI review of risky plans, on top of policy
Verify that agentic systems include an AI-augmented review of planned high-risk actions before execution that adds to, and does not replace, the deterministic policy gate.
OWASP AISVS v1.01, requirement 9.2.6
In plain English
Before a high-risk action runs, have a second AI model review the plan. This is an extra check that sits on top of your fixed policy rules. The fixed rules must still run and must still be able to block alone.
What good looks like
- A separate model call reviews planned high-risk actions before execution.
- The deterministic policy gate runs regardless and can block without the reviewer.
- The reviewer can block or escalate. It cannot approve something the policy gate denies.
- Each review decision is logged with its reasoning.
How teams usually do it
- A reviewer model with its own system prompt that sees the planned action, the user's original request and the relevant policy, and answers in a fixed schema.
- The review placed after the policy gate, so both must pass.
- Escalation to a person when the reviewer objects or is unsure.
Suggested evidence
- A pipeline design showing both checks and their order.
- Review logs.
- A test where the reviewer approves an action the policy denies, and the action stays blocked.
Common mistakes
- Replacing fixed rules with the AI reviewer because it seemed smarter.
- Treating the reviewer's approval as equal to human approval for irreversible actions.
- Using the same model, prompt and context as the agent, so it repeats the same mistake.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.