This page is for application security engineers, red teams, and the architects who own AI agents that call tools, read untrusted content, and act on behalf of users. It maps the controls Praesidia provides to each entry in the OWASP Top 10 for LLM Applications 2025, and it lists the evidence you can export for each.
The OWASP LLM Top 10 is an awareness list, not a standard. The 2025 revision reordered and renamed several entries to reflect how LLM applications are actually deployed: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, and LLM10 Unbounded Consumption. Each entry describes a risk class and lists mitigations; the list does not tell you how much of each you need.
Agents raise the stakes on almost every entry because an agent turns model output into action. A prompt injection against a chatbot produces a bad answer; against an agent with a ticketing tool and a payments API it produces a bad transaction. That is why the controls below concentrate on what an agent is allowed to do, not only on what it is allowed to say. The OWASP LLM Top 10 applied to agents post works through each entry; the OWASP Agentic AI Top 10 guide covers the companion list for multi-agent systems.
Control mapping
| Requirement / criterion | What Praesidia provides | Evidence you can produce |
|---|---|---|
| LLM01 — Prompt Injection (direct and indirect) | Inbound guardrails that detect and block injection patterns in requests and in tool results; intent rules that block a technically valid call aimed at the wrong data; declared connections and per-tool authorization that bound what a hijacked agent can reach. | Blocked-injection records for the period; intent-rule verdicts; tool-authorization configuration. |
| LLM02 — Sensitive Information Disclosure | Outbound guardrails with PII detection and redaction before a response leaves the connection; vaulted provider keys and credentials that are shown once and never read back in plaintext; tenant isolation. | Redaction decision records; audit records of credential issuance, rotation, and revocation; tenant-scoping configuration. |
| LLM03 — Supply Chain (models, plugins, MCP servers, third-party components) | Customer control; Praesidia contributes governed MCP-server connections with per-tool authorization, non-human identity for every server and agent, and bring-your-own-key model-provider access so provider choice stays with you. | MCP-server inventory; per-tool rules; provider configuration. See tool poisoning in MCP. |
| LLM04 — Data and Model Poisoning | Customer control (training and fine-tuning pipelines sit outside the platform); Praesidia contributes guardrails on what agents may write to data stores and an attributable record of every write-capable tool call. | Write-tool authorization rules; audit records of writes by agent and time. |
| LLM05 — Improper Output Handling | Outbound guardrails that block or redact model output before downstream systems consume it; policies that restrict which tools an agent may invoke with that output. | Outbound block and redact records; tool-restriction rules. |
| LLM06 — Excessive Agency | Least-privilege connections (no implicit trust between entities), per-tool authorization that separates read from write and delete, human approval gates before consequential actions, and single-agent revocation that contains blast radius. | Connection map per agent; approval decisions with approver and time; revocation events. See excessive agency controls. |
| LLM07 — System Prompt Leakage | Customer control (do not place secrets or authorization logic in prompts); Praesidia contributes credentials held outside the prompt under vaulted non-human identity, and outbound rules that can block known sensitive strings. | Credential configuration showing no secrets in agent configuration; outbound block rules. |
| LLM08 — Vector and Embedding Weaknesses | Customer control (retrieval stores live in your stack); Praesidia contributes per-connection authorization to the retrieval tools an agent may call and PII redaction on what comes back through them. | Retrieval-tool authorization; redaction records on retrieval responses. |
| LLM09 — Misinformation | Customer control; Praesidia contributes human approval gates so a person reviews consequential agent output before it takes effect, and LLM-based guardrail evaluation for topical and policy restrictions where the risk justifies its cost. | Approval records; LLM-evaluation guardrail configuration and verdicts. |
| LLM10 — Unbounded Consumption | Hard spend caps per agent, team, and workflow that stop before the invoice; rate limits and volume caps per connection; spend attribution and anomaly alerting. | Budget and rate-limit configuration; triggered-cap events; spend attribution reports. |
| Cross-cutting — Identity and attribution | A distinct non-human identity per agent, MCP server, and application, with just-in-time ephemeral credentials by default, rotation, and revocation; hop-by-hop attribution across agent-to-agent chains. | Credential lifecycle events; chain views for any request. |
| Cross-cutting — Detection and forensics | An append-only record of every request, response, and policy decision on routed connections, optional cryptographic tamper-evidence, an offline verifier, alerting, and SIEM forwarding. | Signed bundle export plus verifier result; forwarded events; alert history. |
What this mapping is not
The OWASP LLM Top 10 has no certification scheme and is not a legal requirement, so this mapping supports your assessment and does not constitute certification or an assurance that your deployment is secure. It shows which controls Praesidia contributes against each risk class and what evidence you can pull for a reviewer. Whether the controls are configured tightly enough for your threat model is a judgment your security team makes, ideally with an adversarial test rather than a document review.
Several entries are substantially outside a governance control plane. LLM04 lives in your training and fine-tuning pipeline. LLM08 lives in your retrieval store and embedding pipeline. LLM07 is a design discipline about what you put in prompts. LLM09 is a product question about when a human must check the machine. Praesidia narrows the consequences of each, by limiting what an agent can reach and recording what it did, without removing the underlying work.
Two scoping statements belong in any security review. Praesidia inspects and records connections routed through it; agent traffic that bypasses the platform is neither inspected nor recorded. And when cryptographic signing is enabled, the offline verifier proves exported records were not altered after signing, not that every action was captured in the first place. Both limits are stated at /security/verify-your-audit-trail.
Getting started
- Register every agent and MCP server at /start, following the getting-started guide, and declare connections so no entity trusts another implicitly. Most LLM06 exposure disappears at this step.
- Attach controls per connection: inbound injection and intent rules, outbound PII redaction, per-tool authorization separating read from write, a budget cap, and rate limits. The guardrails and policies docs show each option; the MCP server governance guide covers the server side.
- Run an injection test through a governed connection using the patterns in how to detect prompt injection, and confirm the block appears in the trail with the originating agent attributed.
- Export the test window and verify it offline per /security/verify-your-audit-trail; from agent action to audit evidence shows the path. Hand the bundle and the verifier output to your penetration tester with the configuration.
Common questions
No. It is an awareness document from the OWASP GenAI Security Project ranking the ten most significant risk classes for LLM applications, revised for 2025. Nobody certifies against it, but security reviewers, customers, and penetration testers use it as a checklist, so being able to say what you do for each entry is a practical requirement. This mapping supports your assessment and does not constitute certification.
LLM01 prompt injection, because agents read untrusted tool output and web content; LLM06 excessive agency, because agents hold real permissions; LLM03 supply chain, because MCP servers and plugins are third-party code; and LLM10 unbounded consumption, because an agent in a loop spends money and calls tools without a human watching.
No control alone does, which is why OWASP lists it first. Inbound guardrails detect and block known injection patterns; the durable defence is limiting what a compromised agent can do, through per-tool authorization, declared connections, intent rules, approval gates, and budget caps, and being able to see and prove what happened afterwards. Praesidia provides each of those layers; you decide how tightly to set them.
The Agentic Security Initiative publishes a separate Top 10 for agentic systems covering risks such as goal manipulation, privilege compromise, and cascading failures across agents. The two lists overlap heavily on controls. This page maps the LLM list; the agentic list is covered in the OWASP Agentic AI Top 10 guide linked below.
Scoped access to a test organization with representative connections, the guardrail and policy configuration, and an export of the audit trail for the test window. If cryptographic signing is enabled, they can verify that export offline, which tells them the record they are reading was not altered after the fact.