How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Shutdown and Graceful Degradation
Block actions whose approval times out
Verify that when a human-approval gate is not satisfied within the defined approval time, the system blocks the pending action.
OWASP AISVS v1.01, requirement 9.6.2
In plain English
If nobody approves a pending action within the set time, block it. Silence must never count as approval.
What good looks like
- Each approval has a time limit.
- Expired approvals block the action.
- The agent is told and the event is logged.
How teams usually do it
- Expiry times on approval requests in the gateway.
Evidence an auditor would accept
- Configuration and a test of an expired approval.
Common mistakes
- Defaulting to proceed after a timeout.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.