OWASP Agentic Security Controls — Pre-Execution Implementation

The OWASP Top 10 for Agentic AI is the most widely cited risk taxonomy for autonomous AI systems. It is authoritative, carefully constructed, and genuinely useful for organizations trying to understand where agentic deployments can go wrong. It is also, by design, a risk-identification framework — not a pre-execution enforcement specification. OWASP names what can happen. It stops short of prescribing the architectural mechanism that prevents consequential actions from executing when those risks materialize.

RF-100 — the open Governance Standard published by Remnant Fieldworks Inc. at github.com/derekhone/rf-100 — fills that gap. This article maps the top OWASP agentic risk items to their RF-100 requirement counterparts and describes how ExecutionProof implements those requirements. RF-100 is not endorsed by or affiliated with OWASP; this mapping is provided to help organizations translate risk identification into enforcement action.

Framework relationship: OWASP identifies what can go wrong. RF-100 specifies what must be verified before a consequential action executes. ExecutionProof enforces those specifications at the authorization boundary. None of these replaces enterprise AI-risk governance; each operates at a different layer.

OWASP AA1 — Unsafe Agent Actions

OWASP AA1 — Unsafe agent actions occur when an autonomous agent executes actions with real-world consequences that were not explicitly authorized for the specific context, parameters, or moment of execution.

RF-100 response: The E1 requirement class defines the authorization boundary as the precise point at which an agent's proposed action becomes an external consequence. Every action that crosses this boundary must be evaluated before it executes. An action that does not satisfy these checks receives a DENY verdict and does not execute.

ExecutionProof implementation: The enforcement interface is positioned at the E1 boundary. Every action in scope triggers an evaluation. Actions that fail the scope check are blocked; the denial is written to the VDR as a ProofRecord.

OWASP AA2 — Broken Authorization / Privilege Escalation

OWASP AA2 — Broken authorization in agentic systems most commonly manifests as self-approval: an agent authorizing its own high-value actions, or operating under credentials not intended for its current task.

RF-100 response: The E3 requirement class mandates that the component rendering the ALLOW/HOLD/DENY verdict be structurally independent of the requesting agent. The agent cannot share a runtime, session, or credential with the verification component.

ExecutionProof implementation: The ExecutionProof enforcement interface operates out-of-band. It is not callable by the agent; it intercepts the agent's action at the boundary. The agent's session token is not sufficient to authorize the action.

OWASP AA3 — Tool and Plugin Misuse

OWASP AA3 — Tool misuse occurs when an agent invokes an external tool in a manner that was not authorized for the specific invocation context. As covered in Article 4, MCP tools are the primary contemporary surface for this risk.

RF-100 response: The E2 requirement class requires that the invoking agent's identity be cryptographically bound and that the proposed invocation — including its specific parameters — be evaluated against a declared authority scope at the tool boundary.

ExecutionProof implementation: The enforcement interface wraps tool invocations, evaluates parameters against configured authority scopes, and applies HOLD verdicts for amounts or operations above defined thresholds.

OWASP AA5 — Memory and Context Poisoning

OWASP AA5 — Memory poisoning occurs when an agent's working memory or retrieved context is contaminated with adversarial content. The agent then acts on poisoned context as if it were legitimate.

RF-100 response: RF-100 does not attempt to prevent memory poisoning at the model level. What it does is limit the blast radius. Even if an agent's context has been poisoned, no consequential action can proceed without a ProofRecord and an independent ALLOW verdict. A poisoned agent that attempts an unauthorized payment hits the enforcement boundary; the DENY verdict stops the action regardless of what the agent's context contained.

ExecutionProof implementation: The enforcement interface evaluates proposed actions against policy, not against the agent's context. An agent operating on poisoned context that proposes an action outside its authority scope receives a DENY verdict.

OWASP / RF-100 Coverage Summary

OWASP Agentic Risk	RF-100 Requirement	ExecutionProof Mechanism
AA1 — Unsafe Agent Actions	E1 — Boundary identification & scope enforcement	Every boundary-crossing action evaluated; out-of-scope actions receive DENY
AA2 — Broken Authorization	E3 — Independent verification authority	Out-of-band enforcement interface; agent cannot self-approve
AA3 — Tool / Plugin Misuse	E2 — Identity binding & parameter-level authority	Parameter-level HOLD thresholds; human approval for out-of-scope invocations
AA5 — Memory Poisoning	E1 + E3 — Boundary enforcement regardless of agent context	Policy evaluated independently; poisoned context cannot override DENY

The RF-100 / OWASP Crosswalk

For organizations that want the full mapping of all OWASP agentic risk items to RF-100 requirements and ExecutionProof enforcement mechanisms, Remnant Fieldworks maintains a detailed crosswalk document covering the remaining OWASP items — including Insecure Multi-Agent Communication (AA4), Cascading Failures (AA6), and Rogue Agent Behavior (AA7).

The crosswalk is available at executionproof.io/diligence.

What OWASP + RF-100 Together Achieve

The combination of OWASP's risk taxonomy and RF-100's enforcement specification gives an organization two things it cannot get from either alone. OWASP provides the threat model: a structured, peer-reviewed inventory of what can go wrong. RF-100 provides the enforcement contract: a verifiable specification of what must be true before any action in the threat model's scope is permitted to execute. ExecutionProof is the pilot-ready deployment of that contract.

This is not a claim that implementing ExecutionProof eliminates agentic AI risk. Memory poisoning can still occur. Prompt injection is still a model-level concern. What pre-execution control eliminates is the pathway from those risks to real-world consequences: even an agent operating under adversarial conditions cannot move money, mutate data, or escalate access without an independent ALLOW verdict from the enforcement interface.

That is the gap RF-100 was written to close.

---