How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · High-Impact Action Approval and Irreversibility Controls
Keep approval keys away from the agent
Verify that cryptographic key material or credentials used to issue approvals are isolated from the agent runtime, and that the runtime can neither read them nor use them to issue approvals.
OWASP AISVS v1.01, requirement 9.2.9
In plain English
Keep the keys used to issue approvals away from the agent, so it can neither read them nor sign its own approvals.
What good looks like
- Approval signing happens in a separate service.
- The agent runtime has no access to signing keys or credentials.
- Access to the signing service is limited to the approval interface.
How teams usually do it
- A key management service used only by the approval service.
Evidence an auditor would accept
- Access policies on the signing keys.
Common mistakes
- Keeping the approval key in the same secrets store the agent reads from.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.