How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Compromise Containment & Automated Remediation
Revoke agent identities quickly
Verify that AI agent identities (keys, tokens, OIDC trust grants) can be rapidly revoked and quarantined, with a target time-to-revoke that is written down and tested at least once a year.
OWASP AISVS v1.01, requirement AC.14.3
In plain English
Be able to revoke and quarantine AI agent identities quickly, with a written target time that you test at least once a year.
What good looks like
- Revocation steps are documented.
- A target time-to-revoke is set.
- It is tested at least yearly.
How teams usually do it
- Central identity management for agents with a revocation runbook.
Evidence an auditor would accept
- The runbook and test results.
Common mistakes
- Agent credentials spread across systems with no single revocation point.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.