How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Bind approvals to the exact action
Verify that approvals are cryptographically bound to action parameters, requester identity, execution context, and a unique single-use nonce, and are rejected if any bound value changes or the nonce is reused.
OWASP AISVS v1.01, requirement 9.2.8
In plain English
Tie each approval cryptographically to the exact action, the requester, the context and a one-time code, so it cannot be reused or applied to a changed action.
What good looks like
- Approvals are signed over the action parameters, requester, context and a nonce.
- Any change to those values invalidates the approval.
- Nonces cannot be reused.
How teams usually do it
- Signed approval tokens checked by the tool gateway, with a nonce store.
Evidence an auditor would accept
- The approval token format and tests showing changed or reused approvals fail.
Common mistakes
- An approval that says "yes" without saying to what.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.