OWASP Top 10 for Agentic Applications

Prompt injection, jailbreak, LLM-as-judge semantic pass, PromptGuard ML classifier, and web-content injection checks screen every prompt and every fetched page before it reaches the model.

Action governance validates every tool call against an allowlist, checks parameters, and risk-scores the action before it runs. Detecting poisoned or shadowed tool descriptors themselves is not yet covered.

Per-tenant API key isolation, tool allowlisting, risk-based approval, and quota enforcement limit blast radius. A full agent-identity and permission graph is not yet built.

Code Scan (SAST via semgrep, secrets via gitleaks) catches malicious code and leaked credentials before they're written. Scanning MCP server or tool manifests directly is not yet covered.

Shell-command risk scoring against a safe-binary allowlist and deny patterns, with critical-risk commands denied outright and Code Scan reviewing written code before it runs.

Web-content injection checks screen fetched and retrieved content before it enters the model's context, and every decision is recorded to an audit trail. AgentGuards does not manage a persistent agent memory store itself.

Not yet covered — AgentGuards screens a single agent's request/response path today, not agent-to-agent (A2A) protocol traffic.

Output validation — hallucination detection, schema validity, confidence thresholds, and policy compliance — rejects or repairs bad output before it propagates downstream.

Confidence and hallucination checks flag overconfident, ungrounded output, and action governance forces a human approval step on risky actions instead of silent execution.

Risk scoring, critical-risk auto-deny, and a full audit trail let you detect and block anomalous action patterns after the fact. A dedicated behavioral-drift or alignment monitor is not yet built.