How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent and Orchestrator Identity
Sign each step an agent takes
Verify that agent-initiated actions are cryptographically bound to each step of the execution chain for non-repudiation.
OWASP AISVS v1.01, requirement 9.4.2
In plain English
Sign each step of an agent's actions, so you can prove later which agent did what and in which order.
What good looks like
- Each action record is signed by the acting agent's identity.
- Records link to the previous step.
- Records are kept somewhere the agent cannot change.
How teams usually do it
- Signed, chained log entries written to append-only storage.
Evidence an auditor would accept
- Sample signed action records.
Common mistakes
- Plain logs that the agent itself can edit.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.