OWASP Top 10 for LLM Applications

The OWASP Top 10 for LLM Applications 2025 lists the risks of putting a language model in an application. Its central authorization entry is LLM06 Excessive Agency: a model given more functionality, permission or autonomy than its task needs. This page maps PermDock features to each entry; the agentic list covers autonomous agents in more depth.

Scope of this mappingCopy Anchor Link

PermDock decides what a model's tool calls, retrievals and model choices may reach, as the person the model acts for. It does not inspect prompts, filter model output for content, or train models. For injection, poisoning and misinformation its part is the blast radius: what a misled model can still do.

Mapping tableCopy Anchor Link

ID	Name	PermDock mitigation
LLM01	Prompt Injection	An injected instruction still runs through the same decision: the subject comes from verified credentials, never from model output, and destructive permissions carry approval: 'human'. PermDock does not detect injection.
LLM02	Sensitive Information Disclosure	An operation's results permission filters what a tool returns (filterResults), pick drops restricted fields, and generated RLS holds the model's token to the user's rows (agents, field-level grants).
LLM03	Supply Chain	Runtime entries depend on @standard-schema/spec only, releases publish through npm trusted publishing with provenance, and every release attaches a CycloneDX SBOM (threat model). Model provenance stays with the model host.
LLM04	Data and Model Poisoning	Not PermDock's control. Decisions read subject, context and loaded rows from the application, never from training data or conversation memory, so poisoned data cannot grant.
LLM05	Improper Output Handling	Tool arguments are model output: validate: 'boundary' parses them against the resource schema before any rule runs, and a failure is denied with issues (validation). Escaping output for HTML, SQL or a shell stays with the application.
LLM06	Excessive Agency	One permission per tool; the decision is the user's grants intersected with the delegation, so an agent never exceeds its user; tool lists are filtered per caller; approval and limit bound autonomy (OWASP agentic, ASI02 and ASI03).
LLM07	System Prompt Leakage	Authorization never lives in the prompt. Grants are in the policy and decided outside the model, so a leaked system prompt reveals no credential and changes no decision.
LLM08	Vector and Embedding Weaknesses	Retrieval is a query like any other: permdock.where narrows a vector search to the rows the user may read, generated RLS applies to embedding tables, and filterResults drops chunks the results permission refuses, so one tenant's documents never reach another's context (protected queries).
LLM09	Misinformation	Not PermDock's control. A denied decision carries alternatives, the permitted actions on the same resource, so a model reports what it can do instead of inventing it.
LLM10	Unbounded Consumption	limit grants cap calls per subject; the model gate (decideModel, permittedModels) restricts expensive models by permission; gatewayOptions attributes AI Gateway spend to the user and tenant (agents).

Using this page in an auditCopy Anchor Link

The permdock-audit skill and permdock doctor report tools registered without a permission, agent adapters without an actor, and destructive permissions without approval: the LLM06 checks. For LLM02 and LLM08, check that every retrieval tool either narrows its query with permdock.where or declares a results permission.

SourcesCopy Anchor Link

• OWASP Top 10 for LLM Applications 2025, entry names LLM01:2025 to LLM10:2025.
• OWASP Top 10 for Agentic Applications for ASI02 and ASI03 in depth.
• Threat model for the invariants referenced above.