Identity and Privilege Abuse — An agent acts with more authority than intended, or with authority that cannot be traced to a person.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
The most common form is mundane: several agents sharing one credential, so attribution is impossible by construction. The sharper form is delegation done as impersonation — the agent holds the user's token, and every log line says the human did it.
Controls that address it
- An Agent Passport per agent: cryptographic identity, named human owner, mission, permissions, lifecycle.
- Least privilege enforced continuously, not granted once at onboarding.
- Delegation that carries both identities and an expiry — on-behalf-of, never impersonation.
- Access review and entitlement recertification for non-human identities on the same cadence as human ones.
- Revocation that reaches downstream services rather than only stopping new sessions.
The evidence that proves the control fired
An agent_passport plus actor_identity on every receipt, naming both the agent and the accountable human.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
If identity was shared historically, past actions cannot be re-attributed. Fixing this forward is possible; fixing it backward is not. Do not let anyone claim otherwise.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI02 Tool Misuse and Exploitation ASI04 Agentic Supply Chain Vulnerabilities →
Common questions
What is ASI03 identity and privilege abuse?
ASI03 identity and privilege abuse — The agent acts with more authority than the task required, or its identity is reused across contexts.
How do you defend against it?
One identity per agent, short-lived credentials, action-scoped permissions, and time-bounded elevation that expires rather than persists.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.