OWASP Coverage

​

OWASP Top 10 for Agentic AI

​

OWASP Top 10 for Agentic Applications (ASI01–ASI10)

​

Coverage Details

​

1. Excessive Agency (OWASP #1)

• Deny-wins evaluation — Any deny from any policy overrides all allows
• YAML allowlists — Define exactly what agents can do with glob patterns
• Per-tool policies — Different rules for exec, read, write, fetch

policies:
  - name: restrict-network
    match:
      tool: ["fetch"]
    rules:
      - action: deny
        when:
          domain_matches:
            - "*.internal.company.com"
        message: "Internal network access blocked"

​

2. Unauthorized Tool Use (OWASP #2)

• Pre-execution evaluation — Every tool call checked before running
• Approval workflows — Human-in-the-loop for sensitive operations
• MCP proxy — Applies policies to Model Context Protocol servers

policies:
  - name: require-deployment-approval
    match:
      tool: ["exec"]
    rules:
      - action: ask
        when:
          command_matches:
            - "kubectl apply **"
            - "terraform apply **"
        message: "Deployment requires approval"

​

3. Insecure Tool Implementation (OWASP #3)

• Response scanning — Detects credentials in tool output
• Pattern matching — Identifies AWS keys, private keys, API tokens, JWTs
• PostToolUse hooks — Scans responses before they reach the agent

policies:
  - name: block-credential-leaks
    match:
      tool: ["exec", "read"]
    rules:
      - action: deny
        when:
          response_matches:
            - "AKIA[0-9A-Z]{16}"  # AWS keys
            - "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"
            - "ghp_[a-zA-Z0-9]{36}"  # GitHub tokens
            - "sk-[a-zA-Z0-9]{48}"  # OpenAI keys
        message: "Sensitive credential detected in response"

​

4. Prompt Injection → Tool Abuse (OWASP #4)

• Pattern matching — Catches dangerous commands regardless of how they were generated
• Optional LLM verification — rampart-verify classifies intent
• Response monitoring — Detects injection attempts in tool responses

policies:
  - name: watch-prompt-injection
    match:
      tool: ["fetch", "read"]
    rules:
      - action: ask
        when:
          response_matches:
            - "(?i)ignore (all |your |previous )instructions"
            - "(?i)your new instructions (is|are)"
            - "(?i)<\\|im_start\\|>system"
        message: "Possible prompt injection detected — approval required"

​

5. Insufficient Audit Trail (OWASP #5)

• Hash-chained audit — Each entry includes SHA-256 of previous entry
• Tamper detection — rampart audit verify checks chain integrity
• SIEM export — RFC 5424 syslog or Common Event Format (CEF)

# Verify audit integrity
rampart audit verify

# Export to SIEM
rampart serve --syslog localhost:514 --cef

# Search audit trail
rampart audit search --decision deny --tool exec

​

6. Inadequate Sandboxing (OWASP #6)

• Policy enforcement at the tool call boundary
• Prevents dangerous operations from executing
• Complements OS-level sandboxing

• Container isolation (Docker, Podman)
• Virtual machines for untrusted workloads
• Network segmentation
• Mandatory access control (SELinux, AppArmor, seccomp)

​

7. Insecure Agent Communication (OWASP #7)

• Inter-agent evaluation — Sub-agent tool calls go through the same policy engine
• Depth limiting — agent_depth conditions prevent deep nesting
• Session tracking — Each agent interaction tagged with session ID

policies:
  - name: limit-sub-agents
    rules:
      - action: deny
        when:
          agent_depth:
            gte: 3
        message: "Sub-agent nesting depth exceeded"

​

8. Data Exfiltration (OWASP #8)

• Domain blocking — Denies access to known exfiltration services
• Credential protection — Blocks reads of SSH keys, cloud credentials, tokens
• Network restrictions — /dev/tcp and /dev/udp redirects blocked

policies:
  - name: block-exfil-domains
    match:
      tool: ["fetch"]
    rules:
      - action: deny
        when:
          domain_matches:
            - "*.ngrok.io"
            - "*.requestbin.com"
            - "webhook.site"
        message: "Potential data exfiltration domain blocked"

​

9. Uncontrolled Autonomy (OWASP #9)

• Approval actions — action: ask requires human decision
• HMAC-signed URLs — Secure approve/deny links in webhook notifications
• Multiple approval channels — Native prompts, dashboard, CLI, webhooks

policies:
  - name: require-privileged-approval
    match:
      tool: ["exec"]
    rules:
      - action: ask
        when:
          command_matches:
            - "sudo **"
        message: "sudo requires approval"

​

10. Overreliance on AI Decisions (OWASP #10)

• Full context logging — Every decision includes agent, session, command, policy matched
• Live dashboard — rampart watch shows real-time activity
• Webhook notifications — Immediate alerts on denials
• Audit search — Query by tool, decision, time range

# Live monitoring
rampart watch

# Decision breakdown
rampart audit stats

# Search for denied exec calls
rampart audit search --decision deny --tool exec --since 2026-03-01

​

Integration-Specific Coverage

​

Platform-Specific Coverage

​

macOS

• Keychain access protection — Blocks security dump-keychain, credential extraction
• Gatekeeper bypass prevention — Blocks spctl --master-disable
• SIP protection — Blocks csrutil disable
• LaunchAgent persistence — Blocks launchctl load for auto-start
• User management — Blocks dscl user/password manipulation
• AppleScript shell execution — Blocks osascript with do shell script

​

Windows

• Registry persistence — Blocks Run key modifications
• Credential dumping — Blocks SAM/SYSTEM/SECURITY registry access, vssadmin
• Download cradles — Blocks IEX (IWR ...), certutil -urlcache
• Reverse shells — Blocks PowerShell socket patterns, encoded commands
• Boot config — Blocks bcdedit, bootrec
• Execution policy — Requires approval for -ExecutionPolicy Bypass

​

Next Steps