The OWASP Agent Control Standard, in plain words
On September 1, 2026 the OWASP GenAI Security Project published the Agent Control Standard, version 0.1, a public preview. It defines how an AI agent is controlled before it acts. It matters if your agents move money, talk to your customers, or send data outside your walls.
The standard in four lines
- Two programs. Your agent, in any framework, stops at each step and asks a separate process, the Guardian, "may I?". The Guardian holds your rules.
- 19 hooks, 6 mandatory. The central one is
toolCallRequest, and it must fire for every action that leaves the agent: a tool, a file, a network call, a shell command. - Five answers.
ALLOW,DENY,MODIFY,ASK,DEFER. - Rules first, a model second. A deterministic layer always runs first; an LLM runs only when a rule hands it the case.
The guide covers each of these and the question to ask your own stack. Read the specification, then bring us the decisions you need to control.