Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent and Orchestrator Identity
Sign each step an agent takes
Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.
OWASP AISVS v1.01, requirement 9.4.2
In plain English
Sign each step an agent takes, and link each record to the one before. You can then prove later which agent did what and in which order, and nobody, the agent included, can rewrite the history.
What good looks like
- Each action record is signed with the acting agent's identity.
- Each record includes a hash of the previous one, forming a chain.
- Records are stored where the agent cannot alter or delete them.
- The chain can be verified end to end, and that verification is run.
How teams usually do it
- Signed, hash-chained log entries written to append-only or write-once storage.
- A transparency-log service (for example Sigstore Rekor or a cloud ledger database) for stronger guarantees.
- Signing at the tool gateway as well, so the record does not depend on the agent's own account of events.
Suggested evidence
- Sample signed action records.
- Output from a chain verification run.
- Storage permissions showing the agent cannot modify records.
Common mistakes
- Plain logs the agent can edit.
- Signing with a key shared by all agents, which proves nothing about which one acted.
- Building the chain and never verifying it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.