How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Protect the AI reviewer from injection
Verify that the AI-augmented review mechanism is protected against manipulation by adversarial inputs, and cannot be overridden or bypassed through prompt injection.
OWASP AISVS v1.01, requirement 9.2.7
In plain English
The AI reviewer can be attacked too. Protect it from prompt injection so an attacker cannot talk it into approving something.
What good looks like
- The reviewer sees structured action data, with untrusted content clearly marked.
- It cannot be turned off from within the agent's context.
- It is tested with injection attempts.
How teams usually do it
- Passing the reviewer a structured summary instead of the raw conversation.
- Running the reviewer with its own system prompt and no tools.
Evidence an auditor would accept
- Reviewer design and injection test results.
Common mistakes
- Feeding the reviewer the same poisoned content that fooled the agent.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.