top of page

A08

Agent Identity & Authorisation

Authorisation is enforced at the point of tool invocation, not only at the network perimeter.

WHAT IT ADDRESSES

Perimeter controls do not see what an agent decides to do once inside.

VERIFICATION METHOD

Attempt an out-of-scope tool call and confirm denial.

OWASP T&M

bottom of page