OWASP ACS v0.1 Released — How to Control AI Agents That Abuse Their Permissions

Recently, smart AI agents like GPT-6 Astra or Claude Fable 5.1, which can manipulate computers and handle complex tasks, have been gaining significant attention. But what happens if an agent makes unauthorized charges on your card or deletes important data on a whim? In fact, OWASP, the organization behind security standards, elevated this issue of 'excessive agency' to #3 on its 2026 security threats list. Here is an easy, fun, and concise guide to the Agent Control Standard (ACS) v0.1—the new relief pitcher that has emerged to contain and manage rogue agents.

Stop Before It Goes Rogue: The Core Mechanism of ACS v0.1

In the past, we had to rely on makeshift solutions like refining prompts, hoping the AI agent wouldn't act out. It was essentially like getting into a verbal argument with the agent, begging it, 'Please don't execute weird commands.'

However, ACS v0.1, released by OWASP, introduces declarative execution control rules that machines can read and enforce immediately. The core is a structure that places two reliable gatekeepers at every point where an agent makes a move.

The first is the tool request hook, which activates right before an agent calls a specific tool. The second is the tool result hook, which operates right before the results of a tool are delivered to the agent. By passing through these two hooks, you can fundamentally block injection attacks where unauthorized external code enters the agent and takes over the entire system.

At the recent MCPCon Japan in Tokyo, practical ways to integrate these security controls into enterprise infrastructure were shared. The trend involves linking authentication systems like Keycloak or OAuth, widely used in existing enterprises, with agent permission management, and utilizing the Linux Foundation-led open-source 'agentgateway' as a relay server for the data layer to help developers safely control agent traffic.

In the next step, we will design and examine a detailed JSON policy schema example that intuitively shows how these two runtime hooks are actually declared and operate.

eBPF and Sandboxing: Building the Safest Digital Prison

At the recent MCPCon Japan, specific infrastructure standards for applying these security control rules to actual operating environments were discussed. This is because no matter how much you stipulate 'do not perform dangerous actions' at the application level, it is useless if the operating system running the agent is not isolated.

In response, developers are actively adopting measures to build independent security sandboxes with virtual machines or containers, combined with eBPF technology. eBPF acts as a 'high-speed security camera' that monitors an agent's movements in real-time at the kernel level, the deepest part of the system. It imposes almost no burden on server performance, yet instantly blocks the agent the moment it attempts to access unauthorized files or communicate with a suspicious external network.

An open-source ecosystem to integrate this into real-world enterprise systems is also establishing itself rapidly. The open-source 'agentgateway,' shared by the Agentic AI Foundation (AAIF) under the Linux Foundation, acts as a hub that safely controls agent network traffic. By combining this with permission management using Keycloak or verified user authentication tools like OAuth, developers can easily build powerful agent systems in corporate environments without worrying about security.

An Ingredients Label for the Agent You Use: AgBOM

Have you ever carefully checked the ingredients list on the back of the packaging when buying processed food at a grocery store? You do this to check for allergens or harmful additives.

The Agent Bill of Materials (AgBOM) introduced by OWASP ACS v0.1 serves the exact same purpose. It is a digital ingredient label that transparently lists which software libraries the agent you use depends on and which tools it is authorized to use.

This concept was created by extending industry-standard formats for software security like CycloneDX or SPDX. Thanks to this, corporate security teams can automatically and quickly scan to see if any libraries with security vulnerabilities are included or if unauthorized, dangerous tools are connected before deploying the agent for practical work.

If you check an agent's specification in a very simple JSON format, the structure looks like this.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "component": {
    "name": "Customer-Support-Agent",
    "type": "application",
    "properties": [
      { "name": "ai:model", "value": "gpt-6-astra" },
      { "name": "ai:allowed_tools", "value": "read_db, send_email" }
    ]
  }
}

Security management becomes much simpler when the base infrastructure and tool permissions used by an agent are clearly defined like this. Clearly understanding what your AI assistant is made of is the first step toward introducing controllable agents.

Only Controllable Autonomy Gains Trust

For agent technology to naturally permeate our daily lives and work, the top priority is to have perfect control. This is because autonomy that isn't properly controlled can lead to unpredictable accidents rather than being a helpful assistant.

To achieve this, security infrastructure that supports practical development environments, not just security standards, is evolving rapidly. The industry has already begun incorporating user authentication solutions like Keycloak or OAuth standard permission systems into agent control. With the addition of open-source projects like the 'agentgateway' supported by the Linux Foundation, developers can build practical infrastructure to safely control traffic without worrying about costs.

If you want a safe AI assistant by your side that doesn't abuse its permissions, it's time to look beyond simple prompt engineering and focus on infrastructure-level security. Only with a secure fence in place can the brilliant autonomy of an agent truly shine.