Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Keep approval keys away from the agent
Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime, and that the runtime can neither read them nor use them to issue approvals.
OWASP AISVS v1.01, requirement 9.2.9
In plain English
Keep the keys and credentials that issue approvals away from the agent. If the agent runtime can read the signing key, or call the signing service as itself, a compromised agent can approve its own actions.
What good looks like
- Approvals are signed by a separate service outside the agent runtime.
- The agent runtime has no read access to the signing keys and no permission to call the signing operation.
- Only the approval interface, acting for an authenticated human, can ask for a signature.
- Key access is logged and reviewed.
How teams usually do it
- A key held in a key management service or HSM, with a policy that allows signing by the approval service's identity alone.
- Separate accounts, networks and secrets stores for the approval service and the agent runtime.
- Giving the gateway only the public key, which is enough to verify.
Suggested evidence
- Access policies on the signing key.
- Network and identity design showing the separation.
- A test showing the agent's identity is refused by the signing service.
Common mistakes
- Keeping the approval key in the same secrets store the agent reads.
- Using a shared HMAC secret, so the gateway that verifies approvals could also create them.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.