Orchestration & Agentic Security · Component Isolation and Tool Authorization
Allow-list what the agent installs or calls
Verify that external resources named in model output are verified against an approved allow-list or registry before the agent installs or invokes them.
OWASP AISVS v1.01, requirement 9.3.7
In plain English
When model output names something to install or call, such as a package, a URL, a plugin or another tool, check it against an approved list before the agent acts. Models invent plausible package names, and attackers register those names with malware inside. This is known as slopsquatting.
What good looks like
- Packages, container images, URLs, plugins and MCP servers named by the model are checked against an allow-list or internal registry.
- Anything not on the list is blocked or sent for approval.
- The check sits in the runtime or network, where the agent cannot skip it.
- Blocks are logged.
How teams usually do it
- An internal package proxy (for example Artifactory or Nexus) that serves approved packages only, with the public registries blocked from the agent's sandbox.
- A URL and domain allow-list on the egress proxy and in fetch tools.
- An internal registry of approved tools and MCP servers, pinned by version.
Suggested evidence
- The allow-lists or registry.
- Proxy and gateway configuration.
- A test where the agent tries to install an unlisted package and fails.
Common mistakes
- Letting an agent install whatever the model suggests.
- Allow-listing by name without pinning versions.
- Running curl | sh style install commands that the model found in a README.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.