Where it applies, and to whom.
Any team building LLM-powered applications or agents — not a law or certification, but increasingly referenced inside vendor security questionnaires and cited by emerging AI regulation as a baseline for what "reasonable" LLM security looks like.
How Prefactor maps to OWASP LLM Top 10.
OWASP Top 10 for Large Language Model Applications, issued by OWASP Foundation, applies to anyone building llm-powered applications. This page covers what affects AI agent teams specifically and how to map controls to it.
Source: official OWASP LLM Top 10 reference. This page is practical guidance — confirm interpretation with your counsel.
What it requiresMalicious input subverts the agent
How Prefactor addresses itRuntime guardrails detect and block injection and out-of-policy actions before execution; traces flag anomalous inputs.
What it requiresAgent leaks sensitive data
How Prefactor addresses itPII and sensitive-data detection in outputs, with redaction or blocking.
What it requiresUnsafe outputs reach downstream systems
How Prefactor addresses itEval suites validate outputs; guardrails block unsafe or malformed actions before they execute.
What it requiresAgent does more than intended
How Prefactor addresses itScoped permissions and runtime enforcement; high-risk actions are routed for human approval.
What it requiresHallucinated or wrong outputs
How Prefactor addresses itEval suites score groundedness and accuracy on real traffic; drift detection catches regressions.
What it requiresRunaway cost or resource use
How Prefactor addresses itCost and token tracking with limits enforced at runtime, and anomaly alerts on spend spikes.
The detail, in full.
Frequently asked questions
Does using a 'compliant' provider make us compliant?
Can Prefactor make us compliant?
Key provisions for AI agents
- LLM01: Prompt Injection
- LLM02: Insecure Output Handling
- LLM03: Training Data Poisoning
- LLM04: Model DoS
- LLM05: Supply Chain
- LLM06: Sensitive Information Disclosure
- LLM07: Insecure Plugin Design
- LLM08: Excessive Agency
- LLM09: Overreliance
- LLM10: Model Theft
Who is affected
Anyone building LLM-powered applications
Evidence collection
Auditors and reviewers typically expect:
- Continuous, dated evidence — not point-in-time snapshots
- Override and intervention records — proof humans actually retained control
- Eval results tied to specific agent versions
- Risk decisions tied to changes
- Incident records, even minor ones
- Plain-language documentation
Common gaps in OWASP LLM Top 10 for AI agents
1. Logs not tamper-evident — application database isn't audit evidence.
2. Human oversight is theoretical — system allows override but nobody uses it.
3. Post-market monitoring is reactive — only investigated when something breaks.
4. No change management — prompts edited in production with no record.
5. Retrieval corpus not in scope of data governance — only training data is considered.
Implementation timeline
30 days: Inventory agents in scope. Begin technical documentation. Enable comprehensive tamper-evident logging.
90 days: Operate risk management. Stand up human oversight. Establish post-market monitoring cadence. First self-assessment.
180 days: Complete documentation. Pre-conformity review. Incident reporting workflow. Full readiness.