OWASP
Agentic and LLM risk lists, at the layer where actions happen
The agentic list describes failures of systems that act. Most of them are authority failures dressed as model failures, which is why they are addressed at the execution layer rather than the prompt.
Agentic risk classes and the control applied
| Risk class | Control | Residual risk |
|---|---|---|
| Goal or instruction hijack | The tool call is authorized against policy independently of the content that prompted it. | A hijack that requests a permitted action still executes. |
| Tool misuse | One tool call reaches one governed action; arguments are integrity-checked and replay is refused. | Misuse within the permitted envelope is not detected. |
| Identity and privilege abuse | Identity comes from the authenticated connection; an identity supplied as an argument is ignored. | Compromise of the credential itself is out of scope. |
| Excessive agency | The agent never holds the execution capability; limits are reserved before dispatch. | Limits set too broadly by the operator remain broad. |
| Rogue or compromised agent | Revocation is evaluated at dispatch, including for approved-but-undispatched work. | Detection that an agent has gone rogue is not provided. |
| Untraceable action | Signed, hash-linked records with separated checkpoint keys. | Verifier and system share an author; see the evidence page. |
Mapped means we assert the control addresses the requirement. Evidence-backed means the control emits an artifact a reader can verify. Conformity readiness means the evidence an assessor would request is assembled. Certification means an accredited third party assessed the system and issued a certificate — ApexClaw holds none, and displays none.
LLM Top 10 — where a model-layer risk becomes an action
These are model-layer risks. They matter here only at the point where they reach something that can act.
Prompt injection
Injected text can change what the agent asks for. It cannot change what the agent is permitted to do, because permission is not read from the request.
Insecure output handling
Model output is treated as a request, never as an instruction to the governance layer. Output that names an identity or a policy is ignored on both counts.
Excessive agency
Addressed directly: bounded authority, reserved limits, and an execution capability the agent does not hold.
Supply chain and plugin risk
Tool provenance is signed into the evidence envelope, so a substituted or unexpected tool is visible in the record.
Verdicts for the controls named above
MCP governance and bypass resistance
ProvenOne MCP tool call reaches one governed action and nothing else. Altered arguments, replayed calls, forged identity arguments, revoked authority and attempts to reach the execution service directly all fail correctly, and the tool's provenance travels inside the signed envelope rather than in a log beside it.
Limitation · Demonstrated for the unix-socket transport and the service accounts the harness creates on one host. It states nothing about another deployment's accounts.
Budget and action limits
ProvenSpend and action limits are reserved atomically inside the authorization transaction. A limit lowered below what is already spent stops further spend without rewriting history, and the change is recorded as a signed configuration record naming the principal who made it.
Revocation of agent authority
ProvenAn authorized operator can revoke an agent. Its next request cannot execute, and an action it had already had approved but not yet dispatched cannot execute either — revocation reaches work already in flight, not only new requests.
Agent identity from authenticated context
ProvenAn agent's identity and its accountable owner come from the authenticated credential and the agent directory. They are never read from the request body. A request whose body disagrees with its credential is refused, and the refusal itself is recorded as signed evidence.