How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Show the full action in approval requests
Verify that approval requests display canonicalized and complete action parameters, such as diffs, commands, recipients, amounts, resources, and scopes, without truncation or unsafe transformation.
OWASP AISVS v1.01, requirement 9.2.2
In plain English
An approval request must show exactly what will happen: the full command, recipient, amount or diff, in a standard form, without shortening or reformatting that could hide something.
What good looks like
- Approval screens show complete parameters.
- Values are shown in a canonical form, so look-alike characters and hidden text are visible.
- Long values scroll, so nothing is cut off.
How teams usually do it
- Rendering approvals from the structured action, never from the agent's summary of it.
Evidence an auditor would accept
- Screenshots of approval requests for each action type.
Common mistakes
- Showing the agent's description of the action, which can differ from the action itself.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.