OWASP Agentic AI Threat Coverage
Coverage report mapping TAP’s controls to the OWASP Agentic Security Initiative threat taxonomy for agentic applications (T1–T15). TAP is an enforcement point at the action boundary: the moment an agent’s call leaves for a real API. The threats below are the ones that live at that boundary.
Last reviewed: 2026-07-24.
T2: Tool Misuse
Every outbound call passes TAP’s policy engine before a credential is attached: destination hosts are allowlisted per credential, URL patterns split into auto-approve vs require-approval, and HTTP methods are declared per request. A prompt-injected or malfunctioning agent that attempts an out-of-policy call gets a block or a human-approval pause, not an executed request. See Policies & Approval.
T3: Privilege Compromise
Credential isolation is TAP’s core mechanic: agents authenticate to the proxy with their own TAP key and reference credentials by name; secret values are injected server-side and stripped from responses, so there is nothing in the agent’s context, memory, or logs to escalate or exfiltrate. Host binding pins each credential to its real upstream, so a compromised agent cannot redirect a live token to an attacker-controlled host. In the hosted service, secrets live in a hardware enclave whose key release is bound to attested code measurements. See Security Model.
T8: Repudiation & Untraceability
Every credentialed call is logged and attributable to a specific agent key; every approval decision is attributable to a specific human, gated by passkey. The proxy is a single choke point, so the audit trail is complete by construction rather than by instrumentation discipline.
T10: Overwhelming the Human in the Loop
Approval fatigue is a policy problem: TAP’s per-credential auto-approve / require-approval split means humans only see the calls that matter, with the exact request payload shown verbatim. Reviewers approve a specific action, not a vague summary, and low-risk reads never reach them at all.
T6: Intent Breaking & Goal Manipulation (partial)
TAP does not detect goal manipulation, but it contains its blast radius. A goal-hijacked agent still cannot execute a consequential action without the literal payload passing policy and, where configured, a human approval. Manipulated intent meets an enforcement boundary before it meets your accounts, infrastructure, or money.