How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Limit how the agent can change itself
Verify that any self-modification capability (e.g., prompt rewriting, tool-list changes, parameter updates) is restricted by boundaries that are enforced by the runtime and cannot be changed or bypassed by the agent.
OWASP AISVS v1.01, requirement 9.2.5
In plain English
If an agent can change its own prompts, tools or settings, put hard limits on that from outside the agent, so it cannot give itself new powers.
What good looks like
- Self-modification is either disabled or limited to listed changes.
- The limits are enforced by the runtime.
- Every self-change is logged and can be reviewed.
How teams usually do it
- Read-only system prompts and tool lists, loaded from configuration the agent cannot write to.
Evidence an auditor would accept
- Configuration permissions and logs of attempted changes.
Common mistakes
- Storing the agent's instructions in a memory store it can write to.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.