Mapping ACS Controls to the OWASP Top 10 for Agentic Applications (2026)

This is the part that turns ACS from an abstract architecture into an actual guardrails program: which control addresses which cataloged risk.

The ten risks below (ASI01–ASI10) are OWASP’s; the mapping to ACS controls is this guide’s synthesis, meant as a starting point for your own risk-to-control matrix.

The Risk-to-Control Mapping

Detailed Analysis by Risk

ASI01 — Agent Goal Hijack

The Risk: Attacker-supplied content redirects the agent’s objective

ACS Controls:

• User Message hook — filters inbound prompts for injection patterns
• Knowledge Retrieval hook — screens retrieved content for manipulative instructions
• Guardian Agent policy — evaluates context for goal-redirection attempts

How It Helps: Every piece of inbound content is treated as untrusted at the point it enters context. The Guardian Agent can:

• Deny obviously malicious inputs
• Modify suspicious inputs to remove injection attempts
• Allow clean inputs to proceed

Implementation Notes:

• Start with known injection patterns (prompt injection, jailbreaks)
• Add policy rules for out-of-scope topic detection
• Monitor for false positives in legitimate user requests

ASI02 — Tool Misuse & Exploitation

The Risk: A legitimate tool is used in an unsafe or unintended way

ACS Controls:

• Tool Call Request hook — evaluates tool calls before execution
• Parameter inspection — checks tool parameters, not just tool names
• Tier 3 classifiers — industry-specific tool usage rules

How It Helps: Every tool call is evaluated against policy before it executes:

• Deny high-risk calls (e.g., database deletion without approval)
• Modify parameters to narrow scope (e.g., limit query results)
• Allow safe calls to proceed

Implementation Notes:

• Don’t just inspect tool names — check parameters
• Implement parameter-level validation for high-impact tools
• Require approval for destructive actions

ASI03 — Agent Identity & Privilege Abuse

The Risk: The agent operates with more privilege than intended, or inherits a user’s identity

ACS Controls:

• Tier 3 enterprise classifiers — organizational identity and access rules
• Trace identity fields — audit trail tying actions to specific identities
• Emerging identity workstream — non-human agent authentication

How It Helps: Runtime enforcement plus an audit trail:

• Enforce scoped identities per agent or session
• Track which identity performed each action
• Audit privilege usage patterns over time

Implementation Notes:

• Implement just-in-time access credentials
• Use scoped identities rather than borrowing user sessions
• Monitor for privilege escalation patterns

ASI04 — Agentic Supply Chain Vulnerabilities

The Risk: New tools, MCP servers, or dependencies discovered at runtime introduce risk

ACS Controls:

• Inspect / dynamic AgBOM — tracks all agent components
• MCP Outbound hook — gates connections to MCP servers
• Component approval policy — checks new components against allow-lists

How It Helps: Every new component is captured and checked:

• Detect when an agent connects to a new MCP server
• Block connections to unapproved servers
• Audit component changes over time

Implementation Notes:

• Maintain an approved component list
• Implement real-time AgBOM updates
• Require approval for new MCP server connections

ASI05 — Unexpected Code Execution

The Risk: Natural-language paths trigger unintended code execution

ACS Controls:

• Tool Call Request hook — applies to code-execution tools
• Tier 3 classifiers — industry-specific code execution rules
• Parameter validation — inspects generated code before execution

How It Helps: Code-execution calls pass through the same gate as other tools:

• Deny obviously malicious code
• Modify code to add safety checks
• Require approval for high-risk operations

Implementation Notes:

• Treat code-execution tools as high-risk
• Implement sandboxing for code execution
• Require human approval for system-level operations

ASI06 — Memory & Context Poisoning

The Risk: Long-term memory or retrieved content is manipulated to reshape future behavior

ACS Controls:

• Memory Context Retrieval hook — screens memory reads
• Memory Store hook — screens memory writes
• Knowledge Retrieval hook — screens knowledge source access

How It Helps: Both read and write paths are inspectable:

• Block poisoned content from being written to memory
• Screen memory reads for suspicious patterns
• Audit memory access patterns over time

Implementation Notes:

• Gate both write and read paths
• Implement memory content validation
• Consider one-time memory audits for existing data

ASI07 — Insecure Inter-Agent Communication

The Risk: Spoofed or manipulated messages between agents in a multi-agent system

ACS Controls:

• A2A hooks — task delegation, cancellation, status messages
• Authentication policies — verify agent identities
• Authorization rules — enforce inter-agent permissions

How It Helps: All inter-agent communication passes through Guardian Agent:

• Authenticate message sources
• Authorize task delegations
• Audit inter-agent communication patterns

Implementation Notes:

• Implement agent-to-agent authentication
• Define authorization rules for task delegation
• Monitor for suspicious communication patterns

ASI08 — Cascading Failures

The Risk: An error or compromise in one agent propagates through a connected system

ACS Controls:

• Trace (OpenTelemetry/OCSF) — cross-agent observability
• A2A hooks — contain failing agents
• Circuit breaker policies — stop propagation

How It Helps: Full cross-agent trace plus containment:

• Detect failure propagation in real time
• Contain failing agents before they affect others
• Reconstruct failure chains for post-mortem analysis

Implementation Notes:

• Implement circuit breakers for agent interactions
• Monitor for error propagation patterns
• Define containment policies for different failure modes

ASI09 — Human-Agent Trust Exploitation

The Risk: Confident, polished agent output manipulates a human into an unsafe approval

ACS Controls:

• Agent Response hook — screens outbound responses
• Risk pattern detection — identifies manipulative content
• Response modification — adds warnings or holds suspicious responses

How It Helps: Guardian Agent can intervene before human sees response:

• Flag responses that match risk patterns
• Modify responses to add safety warnings
• Hold responses requiring human review

Implementation Notes:

• Implement response risk scoring
• Define patterns for manipulative content
• Require human approval for high-risk responses

ASI10 — Rogue Agents

The Risk: An agent operates outside policy through compromise, drift, or design failure

ACS Controls:

• Full Instrument + Trace + Inspect stack — complete visibility
• Deny at any hook — kill switch capability
• AgBOM component removal — disable compromised components

How It Helps: The closest thing ACS offers to a kill switch:

• Deny actions at any hook point
• Reconstruct behavior from trace data
• Remove compromised components from AgBOM

Implementation Notes:

• Implement emergency stop procedures
• Maintain trace data for incident response
• Define component revocation processes

Building Your Risk-to-Control Matrix

This mapping is a starting point. Build your own matrix by:

1. Assess your agent estate — which ASI risks are most plausible given what your agents do?
2. Prioritize hook coverage — focus on controls that address your highest-risk scenarios
3. Map to regulatory requirements — connect ASI risks to compliance obligations
4. Test and validate — verify controls effectively mitigate identified risks
5. Iterate and update — refine the matrix as your agent estate evolves

Key Takeaways

1. ACS provides controls for all ASI risks — each OWASP risk maps to specific ACS hooks and policies
2. Instrument provides the control points — hooks at every decision point enable risk mitigation
3. Trace provides the evidence — audit trails support incident response and compliance
4. Inspect provides the inventory — AgBOM tracks components that could introduce risk
5. Build your own matrix — use this mapping as a starting point for your risk-to-control analysis

Next Steps

• Implementation Guide — follow the step-by-step process to implement controls for your risks
• Governance Checklist — assess your maturity in addressing ASI risks