How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Classify how reversible each action is
Verify that each high-impact action has a trusted reversibility classification, such as read-only, reversible, externally reversible, or irreversible.
OWASP AISVS v1.01, requirement 9.2.3
In plain English
Label every high-impact action by how reversible it is: read-only, reversible, reversible only with outside help, or irreversible. The label must come from a source the agent cannot change.
What good looks like
- Every tool action has a reversibility class.
- Classes are set by the tool owner and stored outside the agent's control.
- Classes are reviewed when tools change.
How teams usually do it
- A reversibility field in each tool's manifest, managed in version control.
Evidence an auditor would accept
- The list of actions and their classes.
Common mistakes
- Letting the agent decide how risky its own action is.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.