💡 OWASP Agentic Applications (ASI01-ASI10) Compliance Matrix for CI Agent Standards

[github-actions[bot]]

Summary

Map the newly published OWASP Top 10 for Agentic Applications (2026) — the first peer-reviewed, globally recognized security taxonomy for autonomous AI agents — to the org's existing agent standards and workflows. Create a compliance matrix identifying which of the ten risks (ASI01–ASI10) are covered, partially covered, or represent gaps, and use it to prioritize the backlog of agent security ideas.

Market Signal

OWASP published the Top 10 for Agentic Applications in 2026 (OWASP Gen AI Security Project), establishing the industry-standard taxonomy for agentic AI risks:

Code	Risk	CI/CD Relevance
ASI01	Agent Behavior Hijacking	Compromised agent alters deployment configs or injects malicious code
ASI02	Prompt Injection & Manipulation	Malicious PR descriptions or commit messages trick agents
ASI03	Tool Misuse & Exploitation	Agent accesses production secrets or triggers wrong deployments
ASI04	Identity & Privilege Abuse	Stolen agent credentials authenticate to artifact repos
ASI05	Inadequate Guardrails & Sandboxing	Unsandboxed agent escapes container or modifies system configs
ASI06	Sensitive Information Disclosure	Build logs or agent responses expose API keys
ASI07	Data Poisoning & Manipulation	Poisoned dependency repos introduce vulnerabilities
ASI08	Denial of Service & Resource Exhaustion	Malicious inputs trigger infinite loops or exhaust quotas
ASI09	Insecure Supply Chain & Integration	Compromised build tools inject malicious logic
ASI10	Over-reliance & Misplaced Trust	Teams auto-approve agent recommendations without review

SailPoint reports 80% of organizations have experienced agents acting beyond intended scope. Palo Alto Networks, Microsoft, and Auth0 have published implementation guides for this framework.

User Signal

The org has 6+ fragmented agent security ideas — #339 (Defense-in-Depth), #485 (Prompt Injection), #535 (Runaway Protection), #367 (Input Sanitization), #294 (Credential Isolation), #269 (Agent Shield v2) — but no organizing framework. Real agent safety failures have been observed: bug #402 (111 issues stuck from dev-lead concurrency group cancellation, maps to ASI08) and bug #443 (dispatch race, maps to ASI05).

Technical Opportunity

The org's agent-standards.md and AGENTS.md already codify agent behavior rules. A compliance matrix can reference existing standards (push-protection.md, agent-shield workflow, PR-limits, pr-limit-gate.sh) as evidence of coverage while systematically identifying gaps. The matrix format fits naturally into the standards/ directory as a single markdown document.

Assessment

Dimension	Score	Rationale
Feasibility	high	Documentation and analysis exercise — no code changes required
Impact	high	Provides the organizing framework for 6+ fragmented security ideas, backed by industry-standard taxonomy
Urgency	high	OWASP standard is published, agents are in production with observed safety failures, and the org already has multiple security ideas that need prioritization

Adversarial Review

Strongest objection: Another compliance checklist risks becoming shelfware. The org already has homegrown security ideas that address many of these risks individually.

Rebuttal: The OWASP framework isn't "another checklist" — it's the industry-recognized organizing principle that turns 6+ fragmented ideas into a coherent program. It provides external credibility for audits and security reviews. The compliance matrix format is lightweight (a single markdown table) and reveals coverage gaps that isolated ideas miss. This is the meta-standard that prioritizes existing work, not a replacement for it.

Suggested Next Step

Create a compliance matrix document at standards/agentic-security-compliance.md mapping ASI01–ASI10 to existing org standards, identifying coverage level (covered / partial / gap) with specific references to standards, workflows, and open ideas.

[github-actions[bot]]

Weekly Update

What Changed

Microsoft published the Agent Governance Toolkit with an OWASP Agentic Top 10 Reference Architecture that maps each ASI01-ASI10 risk to concrete architectural controls. This provides a ready-made template for the compliance matrix this idea proposes.

Key developments:

1. Reference architecture available — Microsoft's mapping covers planning, tool use, identity, supply chain, code execution, memory, inter-agent communication, cascading failures, human-agent trust, and rogue agents with specific control patterns for each.
2. OWASP framework matured — Built by 100+ security experts with real incident data. Now adopted by multiple enterprise compliance frameworks.
3. SkillSecurer validation — The SkillSecurer framework (Sep 2026) found 17%+ of AI agent skills contain latent prompt injection vulnerabilities, directly validating ASI04 (Tool & Skill Supply Chain) risk.
4. Snyk ToxicSkills study — Found 1,467 malicious payloads across agent skill marketplaces, confirming the ASI04 supply chain threat is industrialized.

Sources: Microsoft Agent Governance Toolkit, SkillSecurer (arxiv:2609.14079), Snyk ToxicSkills

Updated Assessment

Dimension	Previous	Current	Delta
Feasibility	med	high	↑ (Microsoft reference architecture provides a ready-made template to adapt)
Impact	high	high	→
Urgency	med	med	→

Recommendation

Advance. The Microsoft Agent Governance Toolkit reference architecture eliminates the need to build the compliance matrix from scratch. Fork/adapt their mapping, overlay the org's existing controls (Agent-Shield, agent-rate-limits, trust boundaries), and identify gaps. Priority ASI risks for this org: ASI01 (Prompt Injection — existing agent-shield), ASI04 (Supply Chain — existing action pinning), ASI09 (Human-Agent Trust — new idea #1182 addresses this).