A narrow note on which AAES action-layer controls relate to selected risks from the OWASP Top 10 for LLM Applications. This is not a mapping of the whole list.
These pages describe the product. They are not a certification or a legal opinion.
Reading this note
This note describes selected AAES controls against a small number of list entries. The official source is authoritative for the list's content. The organization's own security testing defines its posture.
Instrument identity
- Title
- OWASP Top 10 for Large Language Model Applications, 2025 edition
- Publication
- November 2024, by the OWASP GenAI Security Project. This note addresses the 2025 edition only; later editions may change titles, numbering, and coverage.
- Issuing body
- OWASP Foundation (community project)
- Instrument type
- Community awareness document (not a standard, not a regulation)
- Official sources
- OWASP Top 10 for LLM Applications 2025, full edition (edition-pinned), OWASP project page: Top 10 for LLM Applications, OWASP GenAI Security Project: LLM Top 10 and LLM06:2025 Excessive Agency.
The 2025 list runs from LLM01 Prompt Injection to LLM10 Unbounded Consumption. Entry numbering is edition-specific; this note cites the 2025 edition's numbers.
Question
For risks about what an agent is allowed to DO (rather than what a model says) which AAES controls can a security reviewer inspect?
AAES's scope is the action layer: tool calls and actions routed through it. Risks about model output content (for example Misinformation) are outside that scope. The most relevant entries are Excessive Agency and Unbounded Consumption, with a partial relationship to Prompt Injection where injected instructions attempt to become actions.
Selected contribution
The following controls may be usable as mitigation evidence within the client's own handling of the named risks. Their scope is the action layer, not the list as a whole.
| List entry (2025 edition) | What a reviewer can examine in AAES | Boundary |
|---|---|---|
| LLM06 Excessive Agency | Agents only see permitted capabilities; grants are task-scoped, time-limited and non-transferable; actions classified as irreversible require approval by an authorized person; an agent cannot approve itself; recorded decisions are sealed in a hash-chained record. | Enforcement depends on control of the agent's credential path. Work that bypasses AAES is invisible. If the decision journal cannot be written, AAES denies the action and there is no journal row for that denial. |
| LLM10 Unbounded Consumption | Budgets can be committed at decision time for spending routed through AAES; over the ceiling, the call never leaves and the refusal is recorded. | This does not cap vendor spending outside AAES, and committed amounts are authorization charged against configured ceilings, not a guarantee of final vendor charges. |
| LLM01 Prompt Injection (partial) | An injected instruction that tries to become an action still has to pass the same decision: permitted capability, scope, approval rules and budget apply to the routed call regardless of where the instruction came from. | AAES does not detect or prevent prompt injection in model input. It constrains what a routed action can do, whether the instruction was legitimate or injected, and an injected action that satisfies the configured policy may still be authorized. |
Preconditions and gaps
- The list extends web application testing; it does not replace it. The underlying API, authentication and infrastructure still need standard security testing. No AAES penetration test or SOC 2 report exists today; see security disclosures.
- Credential-path control is required. Work that bypasses AAES is invisible. Observation is not enforcement.
- Adapter testing is not live-tenant verification. Native adapters are tested against local servers speaking vendor API formats. Live tenant validation happens during a design partnership.
- No production adoption is claimed. AAES is client-operated only. There is no AAES-hosted cell today.
A control that constrains a routed action does not remediate the underlying model risk. The client remains responsible for its own testing and risk acceptance against the full list.
For implementation and testing details beyond this note, use Security and implementation posture and the evaluation page. Results from a client's test tenant are produced during a scoped evaluation.
Client responsibility
The organization runs its own security program against the OWASP list. It determines where action-layer controls reduce risk and where model-layer, application-layer and infrastructure controls remain necessary.
AAES is not a penetration test, a red-team engagement, or a substitute for either. The client remains the regulated entity.
Identify the credential path, actions, and evidence questions to examine in a client test tenant.
Related pages:
This note: https://aaes.ai/library/frameworks/owasp-llm-top10.html
Trust model: https://aaes.ai/library/trust-model.html
ISO/IEC 42001: https://aaes.ai/library/frameworks/iso-iec-42001.html
Evaluation: https://aaes.ai/library/evaluation.html
Security: https://aaes.ai/legal/security.html
Scoped appendix: https://aaes.ai/contact.html?ref=library-appendix
Scope an evaluation: https://aaes.ai/contact.html?ref=library-evaluation