OWASP mapping

Security teams think in the OWASP lists for AI systems. This page takes each entry of the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026 and states what Parmana does about it. Parmana sits between an AI agent and the systems it acts on. It decides whether an action may run, releases only approved actions, and signs a record of each one. It does not see or filter what the model reads or writes, so risks about the model itself are outside it. The ratings say so plainly:

Covered: Parmana enforces a control for the risk, for every action that goes through it, with evidence you can run.
Partly: Parmana limits what the risk can lead to, or covers part of it. The rest is named.
Not covered: the risk is about the model, its data or its runtime, which Parmana does not see. Where Parmana still limits the damage, the entry says how.

Evidence refers to sections of docs/CLAIMS.md (for example 2.47), threats in THREAT-MODEL.md (T1 to T18), and attack scenarios you can run with npm run evaluate -- EV-xx (Evaluate Parmana). Open issues are named by their entry in Limitations.

OWASP Top 10 for LLM Applications 2026

Risk	Rating	What Parmana does	Evidence	What remains
LLM01 Prompt Injection	Partly	Does not detect injection. Limits what an injected agent can do: no action runs without a person’s signed approval for that action and resource, facts the agent declares cannot authorize, and its key is limited to named actions.	2.44, 2.47; T1, T2, T4; EV-04, EV-06, EV-12	Parameters an approval does not fix (for example a message’s text) are the agent’s choice. A person can be persuaded to approve.
LLM02 Sensitive Information Disclosure	Partly	Connector credentials are resolved inside the gateway at release and never reach the agent, a decision or a record.	2.23; T10; EV-10	What the model reads, and what it says, is outside Parmana.
LLM03 Excessive Agency	Covered	The core purpose. Each API key may call named actions only. Each action is bound to one policy. Every action needs a signed human approval for that action, resource and amount. Approval and authorization are single use and expire. Only the gateway can release an action.	2.8, 2.16, 2.22, 2.47, 3.1, 3.16; T1, T2, T5, T6, T9; EV-01 to EV-05, EV-11, EV-12	Actions the agent can take by other routes are outside Parmana. Any trusted approver can approve any action (G-50).
LLM04 Supply Chain	Partly	Parmana’s own supply chain: actions and base images pinned to exact digests, CodeQL and dependency review on every change, signed build provenance and an SBOM with every SDK release. Connectors are registered through maker checker.	2.49; T17	Models, model files and datasets are outside Parmana.
LLM05 Data and Model Poisoning	Not covered	Parmana has no model or training data. A poisoned model is limited the same way as an injected one: it still cannot act without a signed approval.	2.47	Detecting poisoning is outside Parmana.
LLM06 Unbounded Consumption	Partly	Per caller rate limits on `/execute` and on failed authentication; request bodies have a size limit.	3.14; T16	Model tokens and cost are outside Parmana.
LLM07 Misinformation	Not covered	Parmana does not judge whether the model is right. A wrong conclusion still cannot become an action without a person’s signed approval, and the signed record shows exactly what was approved and done.	2.5, 2.47	Checking facts is outside Parmana.
LLM08 Hidden Context Exposure	Not covered	Parmana keeps two things out of the agent’s context: connector credentials, and policy rule conditions (the server tells an agent what a request must carry, never the rules).	2.23, 2.48	The agent’s own prompt and context are outside Parmana.
LLM09 Vector and Embedding Weaknesses	Not covered	Parmana uses no retrieval or embeddings.	None	Outside Parmana.
LLM10 Improper Output Handling	Partly	Model output that would become an action is checked before it runs: each connector forwards only listed parameters, signals must equal the action’s own values and have the declared types, targets are validated (for example a GitHub repository), and an external endpoint must be public and receives only allowed parameters.	2.44, 2.50, 2.52; T4, T18; EV-06	Other uses of model output (shown to users, stored, run as code) are outside Parmana.

OWASP Top 10 for Agentic Applications 2026

Risk	Rating	What Parmana does	Evidence	What remains
ASI01 Agent Goal Hijack	Partly	A hijacked agent can ask, but cannot act: every action needs a signed human approval for that action and resource, and declared facts cannot authorize.	2.44, 2.47; T2, T4; EV-04, EV-06	Within an approved action and resource, unfixed parameters are the agent’s choice. Detecting the hijack is outside Parmana.
ASI02 Tool Misuse and Exploitation	Covered	Tools are reached only through the gateway, after a policy per action and a signed approval. Each connector forwards only listed parameters; Slack posts only to listed channels; external endpoints must be public and are pinned to the addresses checked.	2.47, 2.50, 3.1; T2, T9; EV-04, EV-11	Tools the agent can reach without Parmana are outside it. An external endpoint’s answer is its claim (G-82).
ASI03 Identity and Privilege Abuse	Partly	Each API key is limited to named actions, principals and tenants, and the server, not the agent, records who submitted a request. Connector credentials stay inside the gateway. Approver keys are added and revoked through maker checker.	2.16, 2.23, 2.45, 3.16; T1, T10, T11; EV-10, EV-12	Any trusted approver can approve any action or policy change (G-50).
ASI04 Agentic Supply Chain Vulnerabilities	Partly	Connectors to external systems are registered through maker checker, each bound to one policy, and every release to them is signed. Parmana’s own build is pinned, scanned and released with provenance and an SBOM.	2.49, 2.50; T11, T17	MCP servers, plugins and tools the agent loads itself are outside Parmana.
ASI05 Unexpected Code Execution	Not covered	Parmana runs no code from agents or policies: a policy is data, and a `matches` pattern with a nested quantifier is refused.	2.3	Code the agent runs in its own environment is outside Parmana.
ASI06 Memory and Context Poisoning	Not covered	A poisoned memory can lead an agent to ask for the wrong thing, which still needs a signed approval. Facts are checked again at release, so a change between approval and execution is refused.	2.29, 2.47; T7; EV-09	The agent’s memory is outside Parmana.
ASI07 Insecure Inter-Agent Communication	Not covered	Each agent is a separate caller with its own key and limits; one agent cannot act with another’s. Releases from Parmana to external endpoints are signed and verifiable.	2.16, 2.50, 3.16	Messages between agents are outside Parmana.
ASI08 Cascading Failures	Partly	Fails closed: a misconfigured server refuses to start, an audit write failure refuses the request, an action whose outcome is unknown is reported as such (`502`), and a business transaction id runs once.	2.17, 2.19, 2.20; T8, T15; EV-15	Failures inside other agents and systems are outside Parmana.
ASI09 Human-Agent Trust Exploitation	Partly	An approver signs a specific action, resource and amount, not a general permission; each approval is single use and expires. The `approval.needed` event names exactly what to sign.	2.42, 2.46, 2.47; T3; EV-05	A person can still be persuaded to approve a request they did not read closely.
ASI10 Rogue Agents	Partly	A rogue agent holds only its API key: limited to named actions, unable to approve, and every action it takes is signed and recorded. Its key can be revoked.	2.5, 2.16, 2.47, 3.16; T1, T2, T12	Detecting that an agent has gone rogue is outside Parmana.

Reading this page

“Covered” is for actions that go through Parmana. An agent that can also call a system directly is not governed there. Give agents credentials only to Parmana.
Each rating has evidence you can check. Run the named attack scenarios with npm run evaluate, or read the claim and its tests in docs/CLAIMS.md.
Open issues that touch these risks are G-50 (approvers are not limited to particular actions or policies), G-51 and G-76 (declared facts are not checked against another system; they can only refuse) and G-82 (an external endpoint’s answer is its claim). See Limitations.
For regulation (EU AI Act, NIST AI RMF, ISO/IEC 42001, RBI), see Regulation mapping.
The lists are OWASP’s. Entry names and order are from the 2026 editions. This page maps Parmana to them; it is not an OWASP assessment or endorsement.

Self hosted

Deploy

Security

Operate

OWASP Top 10 for LLM Applications 2026

OWASP Top 10 for Agentic Applications 2026

Reading this page

​OWASP Top 10 for LLM Applications 2026

​OWASP Top 10 for Agentic Applications 2026

​Reading this page

OWASP Top 10 for LLM Applications 2026

OWASP Top 10 for Agentic Applications 2026

Reading this page