Multi‑Agent Systems

/security/controls/

Controls & Certification

From threats to controls

AIUC-1 — a security, safety, and reliability standard for AI agents — turns the threat catalogue inside out: not what can go wrong, but which controls must be implemented, and how each one fights the threat.

Everything in the threat catalogue names what can go wrong and points at the pattern that guards each boundary. A production programme also needs the inverse: a control-centric catalogue of what must be implemented, and an auditable way to show it was. This page renders the OWASP Agentic Security Initiative's bidirectional crosswalk between AIUC-1 (six principles, ~50 numbered controls, published CC BY-SA 4.0) and the Top 10 for Agentic Applications — the bridge from “which threats exist” to “which controls answer them.” It adds no new threats.

The six AIUC-1 principles

AIUC-1 organises its ~50 numbered controls (A001…F002) across six principles.

  • AData & Privacy
  • BSecurity
  • CSafety
  • DReliability
  • EAccountability
  • FSociety

Threat → primary controls

The OWASP Top 10 for Agentic Applications (ASI01–ASI10) is a prioritised ranking of the same agentic threats catalogued as T1–T17 — not a new taxonomy. Each row shows the T-threat(s) an ASI category consolidates and the primary AIUC-1 controls that answer it, each tagged with how it fights the threat.

The eight control-rationale functions

Every mapping carries a rationale code naming how the control fights the threat. Select one to filter the crosswalk to the threats that posture covers.

Two controls recur almost everywhere: B006 — prevent unauthorized agent actions, the most broadly mapped requirement — and E015 — log model activity, mapped to all ten ASI threats. They are the control-catalogue equivalents of the Least Privilege Agent and Audit Trail patterns.
  1. ASI01

    Agent Goal Hijack

    ConsolidatesT6Intent Breaking & Goal ManipulationLLM01Prompt Injection
    Primary AIUC-1 controls
    B001VALIDB002DETECTB005PREVB006PREVC009GATED003SCOPE
  2. ASI02

    Tool Misuse & Exploitation

    ConsolidatesT2Tool Misuse
    Primary AIUC-1 controls
    A003SCOPEB006SCOPEPREVB007SCOPED003SCOPEPREVD004VALIDE009DETECT
  3. ASI03

    Identity & Privilege Abuse

    ConsolidatesT3Privilege CompromiseT9Identity Spoofing & Impersonation
    Primary AIUC-1 controls
    B006SCOPEB007SCOPEB008ISOLATED003SCOPEE009DETECT
  4. ASI04

    Agentic Supply Chain

    ConsolidatesT17Supply Chain Compromise
    Primary AIUC-1 controls
    B008ISOLATEE006VALIDE009DETECT
  5. ASI05

    Unexpected Code Execution

    ConsolidatesT11Unexpected RCE and Code Attacks
    Primary AIUC-1 controls
    B006SCOPEB008ISOLATEC006PREVD003SCOPED004VALID
  6. ASI06

    Memory & Context Poisoning

    ConsolidatesT1Memory Poisoning
    Primary AIUC-1 controls
    A003SCOPEA005ISOLATEB001VALIDB002PREVB005PREVE015DETECT
  7. ASI07

    Insecure Inter-Agent Communication

    ConsolidatesT16Insecure Inter-Agent Protocol AbuseT12Agent Communication Poisoning
    Primary AIUC-1 controls
    B006SCOPEB008ISOLATEE009DETECTE015DETECT
  8. ASI08

    Cascading Failures

    ConsolidatesT5Cascading Hallucination Attacks
    Primary AIUC-1 controls
    D001PREVD002VALIDD003SCOPEE001–E003GOVERNE015DETECT
  9. ASI09

    Human-Agent Trust Exploitation

    ConsolidatesT15Human ManipulationT7Misaligned & Deceptive Behaviors
    Primary AIUC-1 controls
    C003PREVC007GATEC009GATEC010VALIDD001PREVD002VALIDE016DISCLOSE
  10. ASI10

    Rogue Agents

    ConsolidatesT13Rogue Agents in Multi-Agent Systems
    Primary AIUC-1 controls
    B006SCOPEB008ISOLATED003SCOPED004VALIDE001GOVERNE015DETECT

Where the control catalogue is still thin

The crosswalk's own gap analysis flags eight areas where AIUC-1 lacks a dedicated control or only partially covers the threat — and every one lands on a boundary this reference already treats as first-class. A controls checklist alone is not a security programme: the standard says what to attest, the pattern catalogue says how to build the defense, and MAESTRO says where each lands.

  1. 01

    Inter-agent communication security

    No requirement for agent-to-agent channel security: mutual auth, message integrity, replay protection, signed agent cards, attested registries (Agent Name Service).

    Surfaces atASI07ASI08ASI10Defensive surface →
  2. 02

    Agent identity attestation & containment

    No per-agent cryptographic identity, signed behavioural manifests, kill switches, credential revocation, or trust zones.

    Surfaces atASI03ASI10
  3. 03

    Agentic supply-chain attestation

    Due diligence and change approval are covered, but not signed manifests (SBOM/AIBOM), prompt provenance, content-hash pinning, or code signing.

    Surfaces atASI02ASI04Defensive surface →
  4. 04

    Cascading-failure containment

    Response plans exist, but not circuit breakers, blast-radius caps, or planner-executor isolation.

    Surfaces atASI08
  5. 05

    Tool-use infrastructure controls

    No tool identity/registration, tool→agent authentication, or agent-tool-call logging (the Tool Registry surface).

    Surfaces atASI02ASI03ASI05
  6. 06

    Runtime agent monitoring

    Deployment hardening covers the outside world, not runtime monitoring inside the agent — malicious models or images, unauthorised egress, in-container privilege escalation.

    Surfaces atASI05ASI10
  7. 07

    Resource & cost-abuse controls

    No AI-service entitlement or cost-governance controls against theft-of-service and agent-flooding (the Token / Cost Tracking surface).

    Surfaces atASI01ASI10
  8. 08

    I/O schema controls & determinism

    Data policy exists, but not schematic controls at the agent-model boundary that enable real-time guardrail enforcement and reduced non-determinism.

    Surfaces atASI01ASI06ASI08

Security

Where to next

SecurityThe MAESTRO architectural lensOpen SecurityTry to break it firstRed teaming: the offensive lens — the four pillars and the twelve agentic test categories mapped to the threats they attack.Open the red-team guide SecuritySee it applied: the RPA expense agentWalk one agent — an expense-reimbursement RPA — through the OWASP baseline and all seven MAESTRO layers.Read the case study SecuritySecurity Threat ModelThe OWASP LLM and Agentic Threats catalogs, mapped to the defenses this project documents.See the threat model

Search

Search patterns, frameworks, and pages.