How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Rules for handing work between agents
Verify that inter-agent task delegation is restricted by an explicit authorization policy.
OWASP AISVS v1.01, requirement 9.5.5
In plain English
Control which agents can hand tasks to which other agents with an explicit policy.
What good looks like
- Allowed delegation paths are written down.
- The runtime blocks other delegations.
- Delegations are logged.
How teams usually do it
- Delegation rules in the orchestrator or policy engine.
Evidence an auditor would accept
- Delegation policy and logs.
Common mistakes
- Any agent able to call any other agent.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.