⚡ Quick Summary
Published by OWASP Gen AI Security Project, this guide provides practical technical guidance for designing, developing, deploying, and operating secure LLM-powered agentic applications. It is part of the OWASP Agentic Security Initiative (ASI) and translates the threats and mitigation principles in ASI Threats & Mitigations into implementation-focused architectural patterns and developer guidance. Its stated audience is software developers, AI/ML engineers, security architects and engineers, and technical leads building, securing, or assessing workflow and agentic AI applications.
The guide structures its approach around six key components: generative language models, orchestration, reasoning and planning, memory modules, tool integration frameworks, and operational environments. It maps these components to threats including memory poisoning, tool misuse, privilege compromise, intent breaking, repudiation, unexpected remote code execution, communication poisoning, and rogue agents. It then sets out controls across design, build, deployment, and runtime, including least privilege, sandboxing, input and output validation, memory isolation, guardrails, monitoring, logging, incident response, and human-in-the-loop approval. It distinguishes controls for single-agent, centrally orchestrated multi-agent, and swarm architectures, and includes red teaming and behavioural testing approaches.
🧩 What’s Covered
The guide moves from architecture and threat surfaces to lifecycle controls, deployment, and assurance:
- Agentic components and attack surface: Defines KC1–KC6, covering models, orchestration, reasoning, memory, tool integration, and operational environments. It maps each component to ASI threat codes, including T1 memory poisoning, T2 tool misuse, T3 privilege compromise, T6 intent breaking, T11 unexpected RCE, and T12 communication poisoning.
- Patterns and architectures: Explains tool-use, reflection, retrieval-augmented generation (RAG), and user privilege/authentication assumptions. It compares sequential agents, hierarchical orchestrator-led systems, and collaborative swarms in terms of control flow, memory, tools, and environment access.
- Frameworks and case study: Categorises general-purpose, enterprise-integrated, data-oriented, and specialised agent frameworks. A multi-agent copilot case study illustrates an orchestrator coordinating calendar, email, Slack, and Drive agents through limited API access, alongside associated risks.
- Secure development lifecycle: Sets out design controls for threat modelling, prompt hardening, secure coding, moderation, HITL, memory security, validation, and authentication. Build and deployment guidance covers SAST, dependency scanning, sandboxing, secrets management, fuzzing, memory isolation, separated control and data planes, and short-lived credentials.
- Runtime controls and architecture-specific actions: Recommends input/output guardrails, anomaly detection, structured logs, trace IDs, SIEM integration, incident planning, OAuth 2.0/OIDC, RBAC, mTLS, policy enforcement points, zero trust, and agent identity mechanisms such as DIDs and verifiable credentials.
- Operational capabilities and supply chain: Provides capability-specific controls for API access, code execution, database and RAG access, web use, PC operations, and critical systems. Supply-chain guidance addresses SCA scanning, package locks, SBOMs, LLM provenance, version-controlled prompts, agent cards, and registry separation.
- Assurance and hardening: Covers red teaming for prompt injection, privilege escalation, and memory poisoning; behavioural testing with benchmarks; a benchmark-selection process; secure deployments; and VM/runtime hardening, including restricted namespaces, scoped capabilities, memory hygiene, and forensic logging.
💡 Why it matters?
Agentic applications can act through APIs, databases, browsers, code interpreters, operating systems, and other agents, expanding the consequences of compromised prompts, tools, memory, or credentials. This guide helps technical teams identify those control points before and after deployment, rather than treating the model as the sole security boundary.
Its lifecycle approach links design decisions to operational evidence: teams can define permission boundaries and approval points, constrain tool calls and execution environments, and retain logs of plans, tool invocations, state changes, and human decisions. The assurance material also supports testing for agent-specific failures such as plan manipulation, tool privilege escalation, and poisoned memory retrieval.
❓ What’s Missing
The guide expressly excludes high-level governance frameworks, organisational policies, and CISO-level strategic guidance, stating that these will be addressed separately in a proposed Managing Agentic Risk Guide. It also excludes detailed implementation guides for particular vendor platforms, ethical issues not directly affecting security implementation, and legal or compliance requirements specific to jurisdictions or industries. Although it names many tools, frameworks, and technologies, it generally presents them as examples rather than providing end-to-end reference implementations, configuration baselines, or selection criteria for a particular deployment. The security benchmark section gives a selection process but does not prescribe a single required benchmark or pass/fail threshold.
👥 Best For
Software developers, AI/ML engineers, security architects, security engineers, and technical leads working on LLM agents with tools, memory, APIs, code execution, browser access, or multi-agent coordination. It is especially relevant when defining lifecycle controls, testing agent-specific attack paths, or hardening production deployments.
📄 Source Details
Securing Agentic Applications Guide is an English-language, 81-page guide from the OWASP Gen AI Security Project and OWASP Agentic Security Initiative. Version 1.0 is dated July 28, 2025 and marked “Status: Released.” It is licensed under Creative Commons CC BY-SA 4.0. The document lists contributors but does not identify individual authors.
