Compliance

OWASP Agentic Top 10 Compliance

The OWASP Top 10 for Agentic Applications is the industry standard for identifying and mitigating security risks in autonomous AI agent systems. Published by the OWASP GenAI Security Project in December 2025, it defines the ten most critical risks observed in production agentic deployments.

Below is how Clevername maps to each risk — with specific controls, enforcement mechanisms, and the features that address them.

Total risks10 / 10All OWASP Agentic risks addressed

Fully covered8Multiple layered controls per risk

Partially covered2Core controls in place, advanced mitigations ongoing

Compliance Matrix

Each risk card shows the OWASP threat description, how Clevername addresses it, and which features provide the controls.

ASI01

Agent Goal Hijack

Covered

Threat

Attackers redirect agent objectives by manipulating instructions, tool outputs, or external content. Prompt injection, indirect injection via tool responses, and adversarial context manipulation can cause agents to abandon their intended task and pursue attacker-controlled goals.

How Clevername addresses this

CleverGuard 4-tier scanner (data-label gate, regex pattern shield, Gemma 3 4B ML classifier, LLM classification) scans every input and output in real time

ML classifier (Gemma 3 4B + LoRA) catches injection attempts that bypass regex; full governed pipeline (including the beta Tier-3 deep scan, which runs on every request for governed agents and escalates on ambiguity/disagreement for ungoverned traffic) reaches 94.8% detection / 14.75% FP across a 310-attack corpus (our own internal test set, not an independent third-party benchmark) — the always-on Tiers 0–2 baseline measured against live traffic is 94.7% / 2.66% FP, see /cleverguard

Agent Review guardrail profiles define allowed scope — goal deviation is blocked at the gateway

Drift detection flags scope violations against frozen review baseline

CleverGuard ScannerAgent ReviewDrift Detection

ASI02

Tool Misuse

Covered

Threat

Agents misuse legitimate tools due to prompt injection, misalignment, or unsafe delegation. An agent with access to a database tool might execute destructive queries, or a code execution tool might be used to exfiltrate data.

How Clevername addresses this

Scoped cnk_* tokens enforce per-agent tool allowlists — agents can only call explicitly permitted tools

Agent Review questionnaire compiles per-tool parameter constraints into guardrail profiles

Tool drift detection flags out-of-scope tool usage in real time, and blocks it (error code -32403) when enforcement is enabled

Budget caps prevent runaway API spend across tool calls

High-risk action patterns (A4) trigger automatic SignedApproval requests for human sign-off

Scoped TokensAgent ReviewDrift DetectionGateway

ASI03

Identity & Privilege Abuse

Covered

Threat

Attackers exploit inherited or cached credentials, delegated permissions, or agent-to-agent trust relationships. Over-privileged agents accumulate access beyond what their task requires.

How Clevername addresses this

Agent-key bindings enforce cross-agent credential isolation — agents cannot access another agent’s keys

BYOK storage in GCP Secret Manager with per-user scoping — keys are never shared across agents

Scoped tokens with tool allowlists, budget limits, and time expiry — least-privilege by default

Trust tier scoring (trusted/standard/elevated_review/untrusted) based on guardrail risk score

Key Interception strips credentials from prompts before they reach the LLM

Key InterceptionBYOKScoped TokensGateway

ASI04

Agentic Supply Chain Vulnerabilities

Covered

Threat

Malicious or tampered tools, MCP server descriptors, models, or agent personas compromise execution. Attackers can poison tool registries, inject malicious tool descriptions, or tamper with agent configurations.

How Clevername addresses this

MCP Marketplace with admin review before server activation

Reserved MCP server name blocklist prevents namespace hijacking

Agent Review version-hash revalidation — any change to agent config, tools, or bindings triggers re-review

Integration binding fingerprint included in version hash; drift triggers resubmit_required

Manifest verification for tool integrity

Agent ReviewMCP MarketplaceDrift Detection

ASI05

Unexpected Code Execution

Partially Covered

Threat

Agents generate or execute attacker-controlled code without proper sandboxing. Code injection through prompts or tool outputs can lead to arbitrary command execution on host systems.

How Clevername addresses this

CleverGuard scanner detects code injection and exfiltration command patterns

Tool allowlists restrict which execution tools an agent can access

Clevername governs tool calls but does not itself execute agent code — code execution stays in your own runtime, which you sandbox

URL blocklists prevent navigation to attacker-controlled endpoints

CleverGuard ScannerScoped Tokens

ASI06

Memory & Context Poisoning

Partially Covered

Threat

Persistent corruption of agent memory, RAG stores, or contextual knowledge. Attackers inject malicious content into long-term memory that influences future agent behavior across sessions.

How Clevername addresses this

CleverGuard scans all content entering agent context (input direction scanning)

Scanner detects injection attempts embedded in tool outputs and retrieved documents

Project file context is text-extracted and cached server-side — not user-editable at runtime

Guardrail profiles constrain what data sources each agent can access

CleverGuard ScannerAgent ReviewGateway

ASI07

Insecure Inter-Agent Communication

Covered

Threat

Spoofed, manipulated, or intercepted agent-to-agent communications. In multi-agent systems, compromised agents can send malicious instructions to other agents or intercept sensitive data in transit.

How Clevername addresses this

All agent traffic routed through Hub Core gateway — no direct agent-to-agent communication

TLS 1.3 encryption on all inter-service communication

Scoped tokens with tool allowlists prevent cross-agent capability escalation

Child token scope narrowing in multi-agent spawn trees

HMAC-signed audit trail provides tamper-evident chain of custody for all messages

GatewayScoped TokensAudit Trail

ASI08

Cascading Failures

Covered

Threat

Single-point faults propagate through multi-agent workflows at scale. One compromised or failing agent triggers chain reactions across dependent agents, amplifying damage exponentially.

How Clevername addresses this

Budget enforcement across spawn trees — aggregate spend tracked with $0.01 minimum reservation (TOCTOU fix)

Spawn policy enforcement: max depth and concurrency limits

Rate limiting (instance-count-aware) prevents cascading overload

Auto-restrict on drift score threshold stops compromised agents before damage spreads

90-day task retention with stale schedule auto-disable

GatewayDrift DetectionScoped Tokens

ASI09

Human-Agent Trust Exploitation

Covered

Threat

Agents exploit anthropomorphism and authority bias to manipulate users. Agents may confidently recommend risky actions, fabricate rationales, or socially engineer users into revealing secrets or approving dangerous changes.

How Clevername addresses this

Agent Review requires human quorum voting before any agent goes live

High-risk actions (A4 pattern matching) require explicit SignedApproval — no auto-approve for dangerous operations

Key Interception detects and strips credentials from user prompts before they reach the LLM

CleverGuard scans for social engineering and authority spoofing patterns

FP Dispute system provides human override of automated scanner decisions

Agent ReviewKey InterceptionCleverGuard Scanner

ASI10

Rogue Agents

Covered

Threat

Malicious or compromised agents deviate from their intended purpose, appear compliant on the surface, but pursue hidden goals or hijack workflows. Rogue agents may exfiltrate data, accumulate privileges, or undermine other agents.

How Clevername addresses this

Continuous drift detection compares every action against the frozen review baseline

Combined drift scoring with auto-restrict — agents exceeding thresholds are automatically suspended

Version-hash revalidation catches configuration tampering between governance and activation

Model drift detection flags unauthorized model changes

Full audit trail with HMAC signature chain — every action is logged and tamper-evident

SIEM forwarding (Splunk, Datadog, Elasticsearch, Sentinel) for external SOC monitoring

Drift DetectionAgent ReviewAudit TrailGateway

Our Approach

Why Clevername covers the full OWASP Agentic surface

Most AI security tools focus on one layer — scanning content after the fact, or checking identity at the door. Clevername operates across the entire agent lifecycle: from pre-deployment governance to continuous runtime enforcement to tamper-proof audit.

Pre-deployment governance

Every agent passes through the Agent Review — a human governance board with a 27-question security intake that compiles into machine-enforceable guardrail profiles. No agent activates without sign-off.

Inline enforcement

Clevername sits in the execution path, not alongside it. Every tool call, every LLM request, every agent action passes through our gateway where scoped tokens, scanner checks, and guardrail profiles are enforced before the action happens.

Continuous drift detection

Governance is not a one-time event. Clevername continuously compares agent behavior against the frozen review baseline. Tool drift, model drift, and scope violations trigger auto-restrict before damage spreads.

Tamper-proof audit

Every API call is logged with an HMAC signature chain. SIEM forwarding to Splunk, Datadog, Elasticsearch, and Sentinel provides independent verification. The chain of custody is unbreakable.

By the Numbers

4Scanner tiersData-label, regex, ML, LLM

94.8%Detection rateFull governed pipeline (incl. beta Tier-3) · 310-attack corpus

14.75%False-positive rateFull governed pipeline (incl. beta Tier-3) · internal eval

27Review questionsSecurity intake

Ready to govern your AI agents?

Start with a free account, or explore the Gateway to add governance to your existing agent stack in minutes.

MITRE ATLAS MatrixAdversarial AI/ML threat coverage across 10 ATLAS tactics.Read →NIST AI RMF 1.0U.S. federal AI risk management standard across GOVERN, MAP, MEASURE, MANAGE.Read →CleverGuard Scanner4-tier runtime security: data labels, regex, ML, and LLM classification.Read →Security ArchitectureFull technical reference: cryptography, IAM, threat model, audit.Read →