OWASP Agent Control Standard: Runtime Governance for AI Agents
Content safety guardrails filter what a model says. Runtime governance controls what an agent does. On September 2, 2026, OWASP released the Agent Control Standard — the first open specification for enforcing safety policy at the execution layer, right where agent intent becomes agent action.
9 min read
From Guardrails to Governance
Content safety guardrails filter what a model says. Runtime governance controls what an agent does. The distinction matters because the risk landscape has shifted. When an agent calls a tool, accesses a system of record, modifies a database, or triggers an approval workflow, the threat is not a harmful response — it is a harmful action. Guardrails cannot intercept a tool call. They were never designed to.
On September 2, 2026, the OWASP GenAI Security Project released the Agent Control Standard (ACS) alongside an updated 2026 Top 10 for LLM Applications. ACS is the first industry-standard framework for runtime enforcement of AI agent behavior — a specification that defines how agent platforms expose middleware hooks, how safety policies are enforced through those hooks, and how evidence is produced for every decision. [1]
The standard is MIT-licensed, originated at the AI Agent Security Summit in San Francisco in May 2026, and was subsequently donated to OWASP. Its release coincides with the OWASP GenAI Security Project community exceeding 30,000 members worldwide — a scale that gives the standard immediate reach across enterprise security teams, agent framework developers, and compliance organizations. [1]
Why Agents Need a Control Layer
The 2026 Top 10 for LLM Applications tells the story in its rankings. Excessive agency — the risk that an agent takes damaging actions because it has more capability, permission, or autonomy than it needs — jumped from sixth place in 2025 to third in 2026. Prompt injection held the top spot. But the philosophical shift in the 2026 edition is about containment, not prevention: rather than trying to build an LLM that cannot be fooled, engineering teams must harden the surrounding architecture so that when a model is compromised, downstream impact is contained. [2]
That containment philosophy is exactly what ACS operationalizes. The standard addresses a gap that existing security tools leave open: model-level guardrails govern what a model outputs, and sandboxing governs where code executes, but neither governs the decision point between intent and action — whether a specific tool call, with specific parameters, by a specific agent, should be allowed to proceed.
The Four Functions: Identify, Evaluate, Enforce, Evidence
ACS defines four functions that must execute at every agent decision point. These are not abstract principles. They are concrete middleware operations that run inline before an agent action reaches a production system. [3]
Identify. Establish which agent is acting, what credentials it holds, and what context it is operating in. Agent identity is not just a name — it includes the agent's role, the user on whose behalf it acts, the session, and the trust level assigned to it. Without identity, there is no basis for authorization.
Evaluate. Assess the requested action against applicable policies. When an agent requests a tool call — say, writing to a database or calling an external API — the evaluation function checks whether that action is permitted given the agent's identity, the current context, and the declared policy. This is where the control logic lives.
Enforce. Execute the policy verdict before the action proceeds. The enforcement function returns one of three outcomes: allow, deny, or modify. A denied action never reaches the target system. A modified action may proceed with altered parameters — for example, stripping sensitive fields from a database query before it executes. This is the line between observability and authority.
Evidence. Produce an auditable record of what was requested, what policy was evaluated, what verdict was returned, and what action was taken. Evidence is not optional instrumentation. It is a first-class output of the control loop, designed to support post-hoc investigation, compliance reporting, and incident response.
These four functions form a control loop that fires at every agent decision point — not just tool calls, but also tool selection, memory writes, code execution, sub-agent invocations, and transitions from planning to execution. [3]
Middleware Hooks: Where Enforcement Happens
ACS specifies standardized middleware hooks at every point where an agent makes a decision that could have external consequences. The specification defines hook points for when an agent:
Receives input from a user or another agent
Sends output to a user, system, or downstream agent
Selects which tools to use for a task
Calls a tool with specific parameters
Transitions from planning to execution
Stores or retrieves a memory
Executes generated code
Invokes a sub-agent
At each hook, a Guardian Agent intercepts the action, evaluates it against the declared policy, and returns a verdict. The hooks are designed to be declarative and portable — a policy written for one agent framework should enforce the same behavior on another. This portability is what makes ACS a standard rather than a vendor feature. [4]
The key architectural decision is that enforcement happens inline, not asynchronously. A denied tool call never executes. This distinguishes ACS from monitoring-only approaches where violations are detected after the fact — by which point the damage is done.
Observability Is Evidence, Not Authority
The predecessor to ACS was the Agent Observability Standard (AOS), which defined itself as making AI agents trustworthy by standardizing observability. AOS framed the problem as visibility. But visibility was never going to be the whole answer. Knowing that an agent exfiltrated a customer list is a worse outcome than stopping it. [5]
Once the specification added hooks that can deny and modify actions — not just observe them — calling it an observability standard undersold what it was asking platforms to build. The rename to Agent Control Standard reflects the operational reality: the standard defines authority, not just instrumentation. A middleware hook can tell you where a decision was intercepted. A policy engine can tell you what rule it evaluated. But the enforcement function is what actually prevents the action from proceeding. [5]
This distinction matters for engineering teams evaluating agent security tooling. An observability platform that logs every tool call is valuable — but it is not runtime governance. Runtime governance means the platform can say no.
How ACS Fits the Broader Security Stack
ACS does not replace existing security layers. It occupies a specific position in the defense-in-depth stack for agentic systems:
Model-level guardrails filter harmful content in model inputs and outputs. They address what the model says. They do not govern tool calls, code execution, or multi-step planning.
Execution sandboxing isolates where agent-generated code runs. MicroVMs, gVisor, and container isolation bound the blast radius of code execution. But sandboxing does not evaluate whether the code should run in the first place — our article on agent sandboxing covers how isolation works at the infrastructure level.
Runtime governance (ACS) operates at the decision layer between intent and action. It evaluates whether a specific agent should be allowed to take a specific action with specific parameters at a specific time. This is the layer that was missing before ACS defined it.
Identity and access management governs which agents exist, what roles they hold, and what systems they can authenticate to. ACS consumes identity information but does not define how identity is provisioned.
Together, these layers form the containment architecture that the 2026 Top 10 calls for: assume the model will be compromised, and engineer the surrounding system so that compromise does not cascade into production harm. [2]
The 2026 Top 10: What Changed and Why
ACS was released alongside the 2026 edition of OWASP's Top 10 for LLM Applications, which incorporates contributions from hundreds of security experts and surpassed 10,000 downloads within 48 hours of release. The ranking changes tell a clear story about where risk has migrated. [6]
Prompt injection remains at number one — it is still the most common attack vector against LLM-based systems. Sensitive information disclosure holds at number two. But the significant shift is excessive agency jumping to number three, up from sixth in 2025. Supply chain and data model poisoning risks moved down to fourth and fifth. [2]
The rise of excessive agency reflects the production reality of 2026: agents now have real tools, real credentials, and real autonomy. The vulnerability is not that the model produces bad output — it is that the model produces bad output and something acts on it. ACS is the direct response to this risk: if excessive agency is the threat, runtime governance is the control.
The 2026 edition also introduces Appendix A, which maps every LLM Top 10 risk into established enterprise security standards including OWASP, MITRE ATLAS, NIST, and CSA frameworks — giving compliance teams a direct path from risk identification to control implementation. [6]
What Engineering Teams Should Do Now
ACS is a v0.1 public preview. The specification will evolve. But the core design — identify, evaluate, enforce, evidence — is stable enough to build against. Here is what matters for engineering teams deploying agents today:
Instrument your decision points. Before you can enforce policy, you need to know where decisions happen. Map every point where your agent selects a tool, calls an API, executes code, or hands off to another agent. These are your hook points.
Separate policy from code. Hardcoded if-statements in your agent orchestration layer are not governance. Declarative policies that can be updated, audited, and version-controlled independently of application code are governance. ACS encourages this separation by design.
Start with deny-by-default. An agent should have access to zero tools and zero external systems by default. Each capability is explicitly granted based on task requirements. This is the same principle of least privilege that the responsible AI engineering discipline calls for — applied at the runtime layer.
Log everything, enforce what matters. Not every tool call needs human approval. But every tool call needs an auditable record. Focus enforcement gates on irreversible actions — database writes, external API calls, financial transactions, credential access — and log everything else for post-hoc review.
Evaluate framework support. ACS defines a vendor-agnostic standard, but adoption depends on agent frameworks exposing the required hook points. Check whether your agent framework — LangChain, CrewAI, AutoGen, or a custom orchestrator — supports middleware interception at the points ACS specifies. If it does not, you may need to wrap tool calls with your own interception layer. [4]
Where This Goes Next
ACS sits within OWASP's broader Agentic Security Initiative, a suite of five interconnected documents covering threat taxonomy, architectural threat modeling, developer and operator security controls, a ranked Top 10 risk list for agentic applications, and governance mapping. The Agent Control Standard adds the runtime enforcement layer that the other documents reference but do not define. [3]
The Cloud Security Alliance's research note on the 2026 release frames the trajectory: the AI security community is moving from cataloguing risks to operationalizing controls. ACS is the clearest example of that shift — a standard that does not describe what could go wrong, but defines the machinery for preventing it at execution time. [7]
For engineering teams building agentic systems, the message is straightforward. Content safety guardrails protect the conversation. Sandboxing protects the host. Runtime governance protects the business. ACS gives that third layer a standard to build against — and with a 30,000-member community behind it, the standard has the weight to become the default.
OWASP Agent Control Standard (ACS) in 2026: Runtime Governance, Middleware Hooks, and Execution-Time Policy Enforcement for AI Agents | AI Driven Dev