How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Approve chains at their riskiest step
Verify that approval gates for multi-step or multi-agent action chains enforce the highest-impact reversibility classification present anywhere in the chain, where the chain is established by a component outside the control of the agent being gated.
OWASP AISVS v1.01, requirement 9.2.10
In plain English
When several steps or agents chain together, approve the chain at the level of its riskiest step. The chain must be worked out by a component outside the agent being approved.
What good looks like
- The full chain is known before approval.
- The approval level matches the highest-risk step in it.
- The orchestrator works out the chain itself and does not take the agent's word for it.
How teams usually do it
- Planning steps that produce a full action list for the gateway to classify.
Evidence an auditor would accept
- Gateway logic and tests with mixed-risk chains.
Common mistakes
- Approving the first step only, after which later steps run freely.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.