The OWASP Top 10 names common security risks in applications that use large language models. This page explains selected risks involving an agent's tool actions and the AAES Govern controls a reviewer can inspect. It does not cover the whole list.
These pages describe the product. They are not a certification or a legal opinion.
Reading this note
This note describes selected AAES Govern controls against a small number of list entries. The official source is authoritative for the list's content. The organization's own security testing defines its posture.
Instrument identity
- Title
- OWASP Top 10 for Large Language Model Applications, 2025 edition
- Publication
- November 2024, by the OWASP GenAI Security Project. This note addresses the 2025 edition only; later editions may change titles, numbering, and coverage.
- Issuing body
- OWASP Foundation (community project)
- Instrument type
- Community awareness document (not a standard, not a regulation)
- Official sources
- OWASP Top 10 for LLM Applications 2025, full edition (edition-pinned), OWASP project page: Top 10 for LLM Applications, OWASP GenAI Security Project: LLM Top 10 and LLM06:2025 Excessive Agency.
The 2025 list runs from LLM01 Prompt Injection to LLM10 Unbounded Consumption. Entry numbering is edition-specific; this note cites the 2025 edition's numbers.
Question
Which AAES Govern controls can a security reviewer inspect when evaluating what an agent is allowed to do?
AAES Govern's scope is the action layer: tool calls and actions routed through it. Risks about model output content (for example Misinformation) are outside that scope. The most relevant entries are Excessive Agency and Unbounded Consumption, with a partial relationship to Prompt Injection where injected instructions attempt to become actions.
Selected contribution
The following controls may be usable as mitigation evidence within the client's own handling of the named risks. Their scope is the action layer, not the list as a whole.
| List entry (2025 edition) | What a reviewer can examine in AAES Govern | Boundary |
|---|---|---|
| LLM06 Excessive Agency | Agents can discover callable tools only within their current permissions; the capability catalog may show other tools they can request permission to use; grants are task-scoped, time-limited and non-transferable; actions classified as irreversible require approval by an authorized person; an agent cannot approve itself; recorded decisions are sealed in a hash-chained record. | Enforcement depends on control of the agent's credential path. Activity outside AAES Govern is visible only where telemetry is supplied. If the decision journal cannot be written, AAES Govern denies the action and there is no journal row for that denial. |
| LLM10 Unbounded Consumption | AAES Govern can commit budget when authorizing a routed action. Requests that exceed the configured ceiling are blocked before dispatch; refusals are recorded when the journal is available. | This does not cap vendor spending outside AAES, and committed amounts are authorization charged against configured ceilings, not a guarantee of final vendor charges. |
| LLM01 Prompt Injection (partial) | An injected instruction that tries to become an action still has to pass the same decision: permitted capability, scope, approval rules and budget apply to the routed call regardless of where the instruction came from. | AAES Govern does not detect or prevent prompt injection in model input. It constrains what a routed action can do, whether the instruction was legitimate or injected, and an injected action that satisfies the configured policy may still be authorized. |
Preconditions and gaps
- The list extends web application testing; it does not replace it. The underlying API, authentication and infrastructure still need standard security testing. No AAES penetration test or SOC 2 report exists today; see security disclosures.
- Credential-path control is required. Activity outside AAES Govern is visible only where telemetry is supplied. Observation is not enforcement.
- Adapter testing is not live-tenant verification. Native adapters are tested against local servers speaking vendor API formats. Live tenant validation happens during a design partnership.
- No production adoption as of this review. Clients operate their own deployments; AAES does not offer a hosted deployment.
A control that constrains a routed action does not remediate the underlying model risk. The client remains responsible for its own testing and risk acceptance against the full list.
For implementation and testing details beyond this note, use Security and implementation posture and the evaluation page. Results from a client's test tenant are produced during a scoped evaluation.
Client responsibility
The organization runs its own security program against the OWASP list. It determines where action-layer controls reduce risk and where model-layer, application-layer and infrastructure controls remain necessary.
AAES is not a penetration test, a red-team engagement, or a substitute for either. The client remains the regulated entity.
Choose the tool actions to test, identify who holds their credentials, and list the questions the decision records should answer.