Summary: OWASP’s six mitigation playbooks for agentic AI, each split into proactive, reactive and detective steps and mapped to the threats it covers — plus an assessment of which controls are actually implementable.
Sources: raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf
Last updated: 2026-07-29
Six playbooks, aligned to the decision path steps. Each is structured proactive (prevention) → reactive (response) → detective (monitoring). Numbering runs 1–6 with no playbook 2 gap despite the decision path having six steps and the playbooks nominally tracking them; Playbook 6 is labelled “Step 5” in the source though multi-agent threats are step 6.
Coverage map
| Playbook | Threats covered |
|---|---|
| 1. Preventing AI agent reasoning manipulation | T6, T8, T7 |
| 2. Preventing memory poisoning & AI knowledge corruption | T1, T5 |
| 3. Securing AI tool execution & preventing unauthorized actions across supply chains | T2, T3, T11, T4, T16*, T17 |
| 4. Strengthening authentication, identity & privilege controls | T3, T9, T16* |
| 5. Protecting HITL & preventing threats rooted in human interaction | T10, T15 |
| 6. Securing multi-agent communication & trust mechanisms | T12, T14, T13 |
(source: Agentic-AI-Threats-and-Mitigations-1.1.pdf, pp. 34–35)
* T16 appears in the overview table for playbooks 3 and 4 but in neither playbook’s own header. See agentic-threat-taxonomy for the document’s internal inconsistencies.
OWASP notes deliberate overlap: memory integrity spans playbooks 2 and 5; privilege management spans 3 and 4; multi-agent trust validation spans 6 and 5 (p. 34). And a scoping caveat — these address AI-specific risks only, and “foundational security measures (e.g., software security, LLM protections, and access controls) should also be implemented.”
The playbooks
Each is covered in full on its threat page rather than duplicated here:
- Playbook 1 → intent-breaking-and-deception
- Playbook 2 → memory-poisoning and cascading-hallucination
- Playbook 3 → tool-misuse and agentic-supply-chain
- Playbook 4 → identity-and-privilege-threats
- Playbook 5 → human-in-the-loop-threats
- Playbook 6 → multi-agent-threats
What is actually implementable
The playbooks read as a uniform list of ~90 bullets. They are not uniform in maturity. Sorting them is the most useful thing this page can do.
Deployable today, specified concretely enough to build:
- Execution sandboxes — isolated containers, no sensitive system or network access, CPU/memory limits, syscall restriction, destroy-after-execution (Playbook 3)
- Session isolation for memory; retention limits by sensitivity (Playbook 2)
- Just-in-time tool access with immediate revocation (Playbook 3)
- Rate limiting and per-agent execution quotas (Playbooks 3, 6)
- Cryptographic / immutable audit logging (Playbooks 1, 5)
- Mutual authentication and encryption for agent-to-agent communication (Playbooks 4, 6)
- Short-lived, expiring agent credentials; MFA on high-privilege agent accounts (Playbook 4)
- Digital signing of prompt templates, agent cards and tool definitions; agent SBOMs (Playbook 3)
- Version control and peer review for prompt repositories (Playbook 3)
- Topology segmentation and role-scoped inter-agent communication (Playbook 6)
- Limiting an agent’s ability to render links (T15 entry)
Requires design work but tractable:
- Pre-commit memory validation with source attribution (Playbook 2)
- Knowledge lineage tracking and versioned rollback (Playbook 2)
- Decision approval discrepancy tracking — denied-then-approved, repeated overrides (Playbook 6)
- Risk-tiered HITL routing with adaptive intervention thresholds (Playbook 5)
- Goal consistency validation against the agent’s assigned objectives (Playbooks 1, 5)
Named but not solved — capability does not reliably exist:
- Probabilistic truth-checking of new knowledge against trusted sources (Playbook 2)
- Behavioural consistency analysis and truthfulness verification models (T7)
- Agent trust scoring (Playbook 6) — no scoring function is specified
- Deception detection (T7)
- Cryptographic attestation of agent integrity — the document itself states these mechanisms “do not yet exist” for LLMs (T13)
Recurring pattern worth naming: where a threat cannot be caught by rules, the document’s default is another model checks the first model — appearing in T6, T7, T9 and T15. This is a real technique with a real ceiling: the checking model is subject to the same threats, and in a multi-agent setting it becomes part of the T13 surface it was deployed to police.
Where to start
If a single playbook is being adopted first, Playbook 3 delivers the most risk reduction per unit of effort — sandboxing, JIT access and tool allowlisting are conventional controls with conventional implementations, and they cover the two threats OWASP names as the key agentic attack vectors (T2 and, via Playbook 2’s overlap, T1).
Related pages
- agentic-threat-taxonomy — the threats these mitigate
- agentic-ai-threats-and-mitigations — the source page
- owasp-mapping — where the LLM Top 10’s own mitigations already apply
- ATLAS mitigations — technique-level defensive mappings
- Code of Practice security mitigations — the corpus’s most prescriptive control set