How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Human approval before irreversible actions
Verify that the agent runtime blocks execution of privileged or irreversible actions until explicit human approval is received and verified.
OWASP AISVS v1.01, requirement 9.2.1
In plain English
Before an agent does anything privileged or irreversible, such as paying, deleting or sending externally, it must wait for a person to approve, and the system must check the approval is genuine.
What good looks like
- Privileged and irreversible actions are listed.
- The runtime holds these actions until approval arrives.
- Approvals are verified as coming from an authorised person.
How teams usually do it
- An approval step in the tool gateway, with approval through a separate trusted channel.
Evidence an auditor would accept
- The action list and gateway configuration.
- Logs of approved and blocked actions.
Common mistakes
- Asking the agent to request approval in its prompt, which it can skip.
- Accepting "approved" typed into the same chat the attacker controls.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.