AI Agent Permission & Tool-Access Review Checklist

Reviews what tools, data and actions an AI agent can reach and whether a human approves high-impact actions.

Available soon

Format: Excel
Size: 75 KB
Length: 11 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Use this workbook with the Generative AI Security Standard and the LLM Application Security Review Procedure. Complete it for every feature whose model chooses which tools to call, or whose tools can change something. The LLM Application Security Review Procedure asks for it at review depth 2 or 3 when the feature has tools (E-7).
2	On the Checklist sheet, name the agent and its inventory entry (AI System & Use Case Inventory), the owner and the reviewer. Pick the review depth. Enter the date of the review and the date the switch-off was last tested.
3	Answer the rule of two (A, B and C). Read what the sheet says it asks of you. That count is the record AP-08 asks for.
4	List every action the agent can take on the Action Review sheet, one row each. Say what kind of action it is, whether it can be undone (a read counts as undone unless you say it cannot be), whether it leaves the organisation, the highest data level it touches, and whether it touches personal data. For code or commands, say whether they run in a sandbox. The Approval Rules sheet shows the order in which the rules apply. Spending has no approval step of its own. It is controlled through the cap on steps, tool calls, spend and time (AP-13, GS-21), and payments through the payment rule: the agent never releases a payment (GS-27, AP-10).
5	Read the Approval needed here column. It is the approval the rules give for this agent: a person each time for every action when all three properties of the rule of two hold (step 3 of the Approval Rules sheet). Choose the Approval in place: what really happens today. The Check column says OK, or what is wrong.
6	Work down the Checklist sheet. For each item choose Met, Not met, Not checked or Not applicable. Met needs the place where the evidence is kept. Not applicable needs a reason in the note. AP-10 is never not applicable.
7	For every item that is Not met, say what is missing in the Note and enter the finding in the AI Security Findings & Exceptions Register. Write its ID in the Finding ID column. The register rates it and sets the due date.
8	Read the counts at the top of the Checklist sheet. They show items met, not met and not checked, area by area, and the actions to fix. They never become a score or a share. Send the result to the Head of Information Security with the review (E-7).
9	Repeat the review at the interval of the feature's depth and after any change of tool, permission or model (AP-18). The sheet works out the next date from the depth. To clear the EXAMPLE, delete the EXAMPLE sheet.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

GS-24: Count three properties of a feature: it reads untrusted content (A), it can reach sensitive data (B), and it can change state or communicate outside the organisation (C). With all three it needs a person to approve every action. With two the review records the residual risk. The review procedure (A03) counts them.

GS-25: A person approves, seeing the exact action and not a summary of it, before any action that is irreversible, leaves the organisation, changes access, runs code outside a sandbox or affects a person. The agent permission checklist (A09) gives the answer for each kind of action. Spending is controlled through the cap on spend in the agent permission review (AP-13) and the hard spending cap (GS-21), and payments through the payment rule (GS-27), not through this approval. A decision about a person is made by a named person (P24 AG-06).

GS-26: A feature that can act (send, change records, run commands or spend) has a switch-off that one named person can use in one step. It stops the feature, revokes its keys and tool access, and is tested before release and after any change to the feature (NIST AI RMF MANAGE 2.4).

GS-27: No feature releases a payment or changes supplier bank details, by any tool or path (P24 AG-16). A feature may draft a payment request that a named person then makes through the normal approval. This requirement takes no exception (GS-30).

The rules on which AI may be used, with which data, who approves a use and how a use is recorded are P24's (AG-01 to AG-22). This pack does not change them. It sets what a generative AI feature has to do to be secure once a use is approved, and what the organisation checks before the feature goes live and while it runs.

P24 AG-16: An AI system that can act on its own (send messages, change records, approve or release payments, run commands) is Tier 3 until assessed. It runs under a named identity with the least access it needs, and it never releases a payment or changes supplier bank details.

This document helps you secure the generative AI your organisation builds, configures or buys. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. A test that finds no problem does not show that a feature is secure. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts: confirm it with counsel.

EXAMPLE: the distributor, as at 30 Sep 2026. The EXAMPLE sheet shows the rule of two for its three generative features and thirteen worked actions.

Adapting this template.

Small organisation: one agent is often one row of tools. Fill the checklist once for the agent, list every action on the Action Review sheet, and keep the evidence in the place you already keep your change records.

Regulated organisation: add columns to the right of the calculated ones for what your regulator asks of automated processing. Do not insert columns between the existing ones, because the formulas read them by position.

Service provider or outsourced IT: if a supplier hosts the agent or runs its tools, you still complete the checklist under your own owner. Ask the supplier for the tool list, the permissions and the logs, and record what it could not show as Not met.

Replace the [[placeholders]]. Delete the EXAMPLE sheet before use. Keep the formulas.

Fill one copy of the Checklist and Action Review sheets for each agent. To review a second agent, save a copy of the workbook.

Rows are limited to the number the formulas cover. To add rows to the Action Review sheet, copy a whole blank row to the bottom of the table.

This workbook is your own record. Keep it with the feature's other review evidence (E-1 to E-9).

Checklist

Agent permission and tool-access review: [[agent or feature]]

One copy of this workbook for each agent. Yellow cells are yours. State now, the counts, the next review date and the Check column calculate. Counts only, never a score.

The agent

Agent or feature	[[Name of the agent]]
Entry in the AI System & Use Case Inventory	[[AI-nnn]]
AI use owner	[[Name]]
Reviewer (not the person who built the agent at depth 3)	[[Name]]
Review depth (A03)
Date of this review	[[YYYY-MM-DD]]
Date the switch-off was last tested (AP-17)	[[YYYY-MM-DD]]
Next review due (calc)		The interval of the depth's tier (AP-18).

The rule of two (GS-24, AP-08)

What it asks of you			Answer A, B and C
A: does the agent read untrusted content?				Content from outside the organisation or from anyone who can submit text, or a feature that customers or the public use directly.
B: can the agent reach sensitive data?				Any data above Public, or any personal data.
C: can the agent change state or communicate outside?				It has write tools, it sends output, or it acts without a person reading its output first.
Properties that hold

Where the review stands

Items met, of those that apply			0 of 18 applicable items met; 0 not met, 18 not checked
Items not met			None
Items not checked			AP-01, AP-02, AP-03, AP-04, AP-05, AP-06, AP-07, AP-08, AP-09, AP-10, AP-11, AP-12, AP-13, AP-14, AP-15, AP-16, AP-17, AP-18
Actions with weaker approval than needed			0 actions listed; 0 need a person each time; 0 the agent must never do; 0 have weaker approval than needed

By area

Area	Items	Apply	Not checked
Purpose	1	1	1
Tools	2	2	2
Permissions	1	1	1
Identity	2	2	2
Data	2	2	2
Actions	3	3	3
Approvals	1	1	1
Limits	1	1	1
Memory	1	1	1
Agents	1	1	1
Logging	1	1	1
Stop	1	1	1
Review	1	1	1
All items	18	18	18

Counts of items, never a share.

The items, AP-01 to AP-18

Item	Area	What to check	Requirement	State now	Check
AP-01	Purpose	The agent's purpose and the tasks it may do are written in one paragraph and match its inventory entry.	GS-01	Not checked	Choose a state
AP-02	Tools	Every tool and connector it can call is listed with its version and owner and is on the approved list.	GS-16	Not checked	Choose a state
AP-03	Tools	Each tool does one job and takes a strict input. No tool runs any command or fetches any address, except in a sandbox.	GS-22	Not checked	Choose a state
AP-04	Permissions	Each tool holds the least permission its job needs, set in the target system and not in the prompt.	GS-23	Not checked	Choose a state
AP-05	Identity	The agent acts as the signed-in person or under a named service identity on the privileged and service account inventory. No shared or personal credentials.	GS-23	Not checked	Choose a state
AP-06	Identity	Credentials are held by the application or a secrets store, and the model never sees them.	GS-10	Not checked	Choose a state
AP-07	Data	The data it can reach is listed with levels, the data permission check of the approved tool list (P24 A07) is applied to each, and special category data is not reachable.	GS-08	Not checked	Choose a state
AP-08	Data	The untrusted sources it reads are listed, and the rule of two result is recorded.	GS-24	Not checked	Choose a state
AP-09	Actions	Every action it can take is listed with its kind, whether it can be undone and whether it leaves the organisation, with the approval level the agent permission rules give (GS-25).	GS-25	Not checked	Choose a state
AP-10	Actions	No tool and no path lets it release a payment or change supplier bank details.	GS-27	Not checked	Choose a state
AP-11	Actions	A matter about a person is drafted at most. A named person decides.	GS-25	Not checked	Choose a state
AP-12	Approvals	The person sees the exact action before approving, not a summary of it.	GS-25	Not checked	Choose a state
AP-13	Limits	A cap on steps, tool calls, spend and time per task is set and was tested.	GS-21	Not checked	Choose a state
AP-14	Memory	What the agent stores between sessions, for whom and for how long is written down, writes are logged, and a person can clear them.	GS-14	Not checked	Choose a state
AP-15	Agents	Where one agent calls another, the original person's permission goes with the call, and no agent can give another more than it has.	GS-23	Not checked	Choose a state
AP-16	Logging	Every tool call is logged with arguments, result, identity and any approval.	GS-19	Not checked	Choose a state
AP-17	Stop	A named person can switch the agent off in one step, which revokes keys and tool access. The date of the last test is recorded.	GS-26	Not checked	Choose a state
AP-18	Review	The review is repeated at the interval of the feature's depth and after any change of tool, permission or model.	GS-18	Not checked	Choose a state

Sign-off

Role	Name	Date	Signature or reference
Reviewed (reviewer named above)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accepted (AI use owner)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Approved (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]

Action Review

Every action the agent can take, and the approval each needs

One row for each action. Yellow cells are yours. The step, the approval the rules give, the approval needed here and the Check column calculate. The Approval Rules sheet shows the order of the rules (AP-09 to AP-12).

Where the actions stand

Actions	0 actions listed; 0 need a person each time; 0 the agent must never do; 0 have weaker approval than needed

To fix

Rule of two	Not answered on the Checklist sheet

The actions

Ref	Action: what the agent can do	Kind	Can be undone?	Leaves the organisation?	Data level	Personal data?	Run in a sandbox? (execute only)	Step	Approval the rules give	Rules	Approval needed here	Approval in place	Check

A-01

A-02

A-03

A-04

A-05

A-06

A-07

A-08

A-09

A-10

A-11

A-12

A-13

A-14

A-15

A-16

A-17

A-18

A-19

A-20

A-21

A-22

A-23

A-24

A-25

What to put in each column

Column		What to enter
Action		What the agent can do, in a few words, for example "send an email to a supplier".
Kind		The kind of action. Choose the nearest. If an action fits two, list it twice.
Can be undone?		Yes if one step puts things back as they were. A read changes nothing, so it counts as undone: answer Yes, or leave the cell blank. Answer No for a read only if it cannot be undone.
Leaves the organisation?		Yes if the action sends anything to a person or system outside the organisation.
Data level		The highest data level the action touches (P15).
Personal data?		Yes if the action touches personal data.
Run in a sandbox?		Only for an action of kind execute: Yes if the code runs in a sandbox with no network access to internal systems and no secrets (GS-22).
Approval in place		What actually happens today. Choose from the four levels.

Approval Rules

The order in which the rules decide the approval

The first step that applies decides. The approval, the reason and the rules are those of the method behind GS-25, so this sheet and the Action Review sheet cannot differ. Spending has no approval step of its own. It is controlled through the cap on steps, tool calls, spend and time (AP-13, GS-21), and payments through the payment rule: the agent never releases a payment (GS-27, AP-10).

Step	When it applies	Approval	Why	Rules
1	The action releases a payment or changes supplier bank details	Never by the agent	A feature never releases a payment or changes supplier bank details. A person makes the payment through the normal approval.	GS-27, AG-16
2	The action decides a matter about a person	Never by the agent	A named person decides a matter about a person. The feature may draft or inform, never decide.	GS-25, AG-06
3	All three properties of the rule of two hold for the agent (it reads untrusted content, reaches sensitive data and can change state or communicate outside): a person approves every action that steps 1 and 2 do not forbid	A person approves each time	The feature reads untrusted content, reaches sensitive data and can change state or communicate outside the organisation: all three properties of the rule of two hold, so a person approves every action it takes.	GS-24, GS-25
4	The action changes access or privilege	A person approves each time	A change of access or privilege is approved by a person who sees the exact change.	GS-25, GS-23
5	The action runs code or a command outside a sandbox	A person approves each time	Code or a command run outside a sandbox is approved by a person who sees it.	GS-25, GS-22
6	The action leaves the organisation, or sends something	A person approves each time	An action that leaves the organisation is approved by a person who sees the exact content and recipient.	GS-25, GS-07
7	The action deletes something, or cannot be undone	A person approves each time	An action that cannot be undone is approved by a person.	GS-25
8	The action changes Confidential or personal data	A person approves each time	A change that touches Confidential or personal data is approved by a person.	GS-25, GS-08
9	The action changes something inside the organisation, and can be undone	Allowed, logged and sampled	A reversible change inside the organisation is allowed, logged and sampled by a person.	GS-19, GS-25
10	The action only reads, in the signed-in person's own context	Allowed and logged	A read in the signed-in person's own context is allowed and logged. The data level must still be one the tool is approved for.	GS-19, GS-23

The rule of two (GS-24) is step 3. When all three properties hold on the Checklist sheet, a person approves every action the agent takes, except the payments and decisions about a person that steps 1 and 2 keep from the agent. The Action Review sheet applies it in the Step column and the Approval needed here column.

A person approves the exact action, not a summary of it (AP-12). A decision about a person is made by a named person (P24 AG-06): No AI output decides, alone, a matter that affects a person's job, pay, discipline, credit, access to a service or legal position (GDPR Article 22). A named person makes the decision after reading the evidence. A use that decides or shapes such a decision, or that falls in an area of Annex III of the EU AI Act whatever it does, is Tier 3 and is not started before the Tier 3 decision. A use that only informs such a decision is Tier 2.

Special category data is never reachable by an agent (AP-07). The data level column takes the P15 levels only, because special category data never goes into an AI tool (P15 CL-19).

A payment is never released by the agent (GS-27, P24 AG-16). It may draft a payment request that a named person then makes through the normal approval.

EXAMPLE

EXAMPLE: the distributor, the rule of two and thirteen actions

The distributor, as at 30 Sep 2026. Every value is made up. Delete this sheet before use.

The rule of two for the three generative features

Feature	What it is	A: untrusted content	B: sensitive data	C: acts or sends	Properties	Review depth	Tools	What it asks of the review
LF-1	Draft and summarise with the office-suite assistant	Yes	Yes	No	2 of 3	Depth 2	none	Two hold. The review records the residual risk (GS-24). Write it in the note against AP-08.
LF-2	Image generator in the design tool	No	No	No	0 of 3	Depth 1	none	Fewer than two hold. GS-24 asks for nothing more here. The other items still apply.
LF-3	Customer-service chatbot proposed by the contact centre	Yes	Yes	Yes	3 of 3	Depth 3	read	All three hold. A person approves every action the agent takes (GS-24). The Action Review sheet applies this.

LF-3, the customer-service chatbot: Held under P24 until the contact centre's P06 assessment (planned 1 Dec 2026), a bar on training on our data and processor terms are in place. The review waits for the questionnaire and the red team test. All three properties hold, so a person approves every action it takes. The facts hold no item states for it: the review waits, so this example marks no item AP-01 to AP-18.

Thirteen worked actions

Case	Action	Kind	Can be undone?	Leaves the organisation?	Data level	Personal data?	Sandboxed?	Approval the rules give	Rules
AA-A	Read the signed-in person's own calendar	read	Yes	No	Internal	No		Allowed and logged	GS-19, GS-23
AA-B	Create a draft document in the person's own folder	write	Yes	No	Internal	No		Allowed, logged and sampled	GS-19, GS-25
AA-C	Send an email to a supplier	send	No	Yes	Internal	No		A person approves each time	GS-25, GS-07
AA-D	Release a supplier payment	payment	No	Yes	Confidential	No		Never by the agent	GS-27, AG-16
AA-E	Change a supplier's bank details	change-supplier-bank	Yes	No	Confidential	No		Never by the agent	GS-27, AG-16
AA-F	Reject a job applicant	decide-person	No	No	Confidential	Yes		Never by the agent	GS-25, AG-06
AA-G	Add a person to a group	change-access	Yes	No	Internal	No		A person approves each time	GS-25, GS-23
AA-H	Run a command on a server	execute	No	No	Internal	No	No	A person approves each time	GS-25, GS-22
AA-I	Run code in a sandbox with no network	execute	Yes	No	Public	No	Yes	Allowed, logged and sampled	GS-19, GS-25
AA-J	Delete a record	delete	No	No	Internal	No		A person approves each time	GS-25
AA-K	Update a customer record with personal data, reversibly	write	Yes	No	Confidential	Yes		A person approves each time	GS-25, GS-08
AA-L	Read a Confidential file in the person's own context	read	Yes	No	Confidential	No		Allowed and logged	GS-19, GS-23
AA-M	Read a document in the person's own context, with nothing said about undoing it	read		No	Internal	No		Allowed and logged	GS-19, GS-23

Where the case gives no value, the sheet shows No for leaves the organisation and personal data, and Internal for the data level. The answer does not change. A read that says nothing about undoing it is left blank, because a read counts as undone (AA-M).

With the rule of two at 3 of 3, as for LF-3, 5 of the 13 cases move from allowed to a person each time: AA-A, AA-B, AA-I, AA-L, AA-M.

The cases show the order. Reading a file is allowed and logged; changing a customer record with personal data needs a person even though it can be undone; running a command on a server needs a person; releasing a payment or changing a supplier's bank details is never the agent's.

Lists

ItemState	ActionKind	YesNo	DataLevel	ApprovalLevel	ReviewDepth
Met	read	Yes	Public	Never by the agent	Depth 2: standard
Not met	write	No	Internal	A person approves each time	Depth 3: full
Not checked	send		Confidential	Allowed, logged and sampled
Not applicable	delete			Allowed and logged

execute

change-access

payment

change-supplier-bank

decide-person

Definitions

Definitions

Term	Meaning in this workbook
Agent	A feature in which the model chooses which tools to call and in what order, with tool results fed back to it. An agent can act, so P24 treats a system that acts as Tier 3 until assessed (AG-16).
Tool	A function the model can ask the application to run: search, read a file, send an email, run a query, run code. Also called a plugin, extension, skill or connector. A connector gives access to another system.
Excessive agency	A feature that can do more than its task needs, with more functions, more permission or more freedom than the task needs, so that a wrong or manipulated output causes damage.
Untrusted content	Any content the feature reads that came from outside the organisation or from a person who can submit text: customers' messages, supplier documents, inbound email, web pages, tickets, public files, and the output of a tool that fetches such things.
Rule of two	Three properties of an agent: A it reads untrusted content, B it can reach sensitive data, C it can change state or communicate outside the organisation. The count of those that hold is the result (GS-24).
Properties that hold	The count of A, B and C answered Yes. With three, a person approves every action. With two, the review records the residual risk.
Kind of action	One of read, write, send, delete, execute, change-access, payment, change-supplier-bank or decide-person. Choose the nearest.
Never by the agent	The agent has no way to do this. A person does it through the normal route.
A person approves each time	A person sees the exact action and approves it before it happens.
Allowed, logged and sampled	The agent may do it. It is logged, and a person samples the log.
Allowed and logged	The agent may do it. It is logged.
Approval the rules give	The approval from the ten steps of the Approval Rules sheet. Step 3 is the rule of two: it applies when all three properties hold on the Checklist sheet.
Approval needed here	The approval the rules give for this agent, with the rule of two applied: a person each time for every action when all three properties hold (step 3).
Approval in place	What happens today. It is compared with the approval needed here, and a weaker one is flagged.
Met	You looked at the agent and the evidence shows the item holds. Say where the evidence is.
Not met	The item does not hold. Say what is missing and put the finding in the register.
Not checked	Nobody has looked yet. The sheet counts it apart, and it is never counted as met.
Not applicable	The item cannot apply to this agent. Say why in the note. AP-10 is never not applicable: the agent either has a path to a payment or it does not.
Switch-off test	A test that one named person can stop the agent in one step and that its keys and tool access are revoked (GS-26). The date of the last test is recorded.
Finding	A confirmed gap between a feature and this standard, found in a review, a configuration check, a test or an incident, rated on P05's scales.
AP-nn, GS-nn	One of the items of this checklist, and the requirement of the Generative AI Security Standard that the item checks.
AG-nn	A rule of P24, the pack on AI governance. It decides which AI may be used and who approves a use.
EXAMPLE	An illustration: the distributor, as at 30 Sep 2026. Every name and value is made up.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.2 — Privileged access rights	Checklist sheet, AP-04 and AP-05: the agent's access rights are allocated and limited to the task
ISO/IEC 27001:2022	Annex A 5.15 — Access control	Checklist sheet, AP-04 and AP-05: the agent's access rights are allocated and limited to the task
ISO/IEC 42001:2023	Annex A 3.2 — AI roles and responsibilities	Checklist sheet: roles for the AI system, and the process by which it is used responsibly
ISO/IEC 42001:2023	Annex A 9.2 — Processes for responsible use of AI systems	Checklist sheet: roles for the AI system, and the process by which it is used responsibly
NIST CSF 2.0	PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties”	Checklist and Action Review sheets: permissions follow least privilege and are reviewed
EU AI Act — Regulation (EU) 2024/1689	Article 26(2) — deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support”	Checklist sheet, reviewer and sign-off: a named person with the competence and authority to oversee, which the approval steps rely on
EU AI Act — Regulation (EU) 2024/1689	Article 26(5) — deployers monitor the operation of the high-risk system on the basis of the instructions for use; where they have reason to consider that use may present a risk within the meaning of Article 79(1) they inform the provider or distributor and the market surveillance authority “without undue delay” and suspend use; where they identify a serious incident they “immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities”	Checklist sheet, AP-16 and AP-17: monitoring the operation of the system and being able to suspend use
EU AI Act — Regulation (EU) 2024/1689	Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026	Checklist sheet: the dates for high-risk systems are those Article 113 sets after the amending Regulation. The checklist states none
EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI)	Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689	Checklist sheet: the amending Regulation changed the dates for high-risk systems
GDPR — Regulation (EU) 2016/679	Article 25(2) — the controller implements measures so that, “by default, only personal data which are necessary for each specific purpose of the processing are processed”; this covers the amount collected, the extent of processing, the period of storage and accessibility, and by default personal data are not made accessible “without the individual’s intervention to an indefinite number of natural persons”	Action Review sheet and AP-07: by default only the personal data necessary for the purpose is reachable
GDPR — Regulation (EU) 2016/679	Article 32(1) — appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the likelihood and severity of risk to people's rights and freedoms	Checklist sheet, AP-04 to AP-06 and AP-16: security of processing that is appropriate to the risk
OWASP Top 10 for LLM Applications 2026	LLM03:2026 Excessive Agency — “the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM”; its root causes are excessive functionality, excessive permissions and excessive autonomy. Its prevention list starts with minimising tools, tool functionality and tool permissions, executing tools in the user’s context, requiring user approval for high-impact actions and complete mediation in logic rather than by the model	Checklist sheet and Approval Rules sheet: excessive functionality, permissions and autonomy, and approval for high-impact actions
OWASP Top 10 for Agentic Applications 2026	ASI02 Tool Misuse & Exploitation — the 2026 LLM list says that, in agentic systems, Excessive Agency “can manifest as ASI02: Tool Misuse & Exploitation, ASI03: Identity & Privilege Abuse and ASI08: Cascading Failures”. The agentic document itself was not read	Checklist sheet, AP-03: tools misused through their own permissions
OWASP Top 10 for Agentic Applications 2026	ASI03 Identity & Privilege Abuse — named in the 2026 LLM list, with ASI02 and ASI08, as a way Excessive Agency shows up in agentic systems. The agentic document itself was not read	Checklist sheet, AP-05 and AP-15: identity and privilege abuse, including one agent passing on more than it has
OWASP Top 10 for Agentic Applications 2026	ASI06 Memory & Context Poisoning — the 2026 LLM list points to it (as “ASI06:2026 Memory and Context Poisoning”) for “agent-memory attacks that do not rely on embedding geometry”. The agentic document itself was not read	Checklist sheet, AP-14: memory that carries a planted instruction into later sessions
MITRE ATLAS 2026.09	AML.T0053 — AI Agent Tool Invocation	Action Review sheet: the technique of making an agent call a tool, which the approval steps limit
MITRE ATLAS 2026.09	AML.T0086 — Exfiltration via AI Agent Tool Invocation	Action Review sheet and the rule of two: data leaving through an agent's tool call
MITRE ATLAS 2026.09	AML.T0080 — AI Agent Context Poisoning	Checklist sheet, AP-14: planting instructions in an agent's context
Careful adoption of agentic AI services (joint guidance, 2026)	Careful adoption of agentic AI services, joint guidance of the Canadian Centre for Cyber Security, ASD’s ACSC, CISA, NSA, NCSC-NZ and NCSC-UK, dated 1 May 2026 on the Cyber Centre’s page, which says it recommends “a layered defence and strict access controls to reduce the likelihood of compromise”. Cited by title, date and authors; the guidance itself was not read	Checklist sheet: layered defence and strict access control for agents
NCSC blog (8 December 2025)	NCSC, “Prompt injection is not SQL injection (it may be worse)”, Dave Chismon, 8 December 2025: “As there is no inherent distinction between ‘data’ and ‘instruction’, it’s very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be.” It suggests viewing prompt injection as an exploitation of an “inherently confusable deputy” and says “If the system’s security cannot tolerate the remaining risk, it may not be a good use case for LLMs.”	Checklist sheet, rule of two: design for an agent that will sometimes be fooled
NIST AI RMF 1.0	GOVERN 2.1 — “Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.”	Checklist sheet, owner, reviewer and sign-off: roles and responsibilities for managing AI risk are documented
NIST AI RMF 1.0	MANAGE 2.4 — “Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.”	Checklist sheet, AP-17: a way to supersede, disengage or deactivate an agent

Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR); OWASP Top 10 for LLM Applications, 2026 edition; MITRE ATLAS 2026.09; NIST AI 600-1; NIST AI RMF 1.0; NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); as published and read on 8 October 2026

Regulation (EU) 2024/1689 binds the operators of its Article 2(1). Article 15 sets requirements for high-risk AI systems, and the provider of such a system answers for them. An organisation that uses another party’s AI system under its own authority is a deployer (Article 3(4)), and its duties are those of Article 26 and the other articles that name deployers. This pack cites Article 15 as the Act’s own statement of what security a high-risk system needs, and cites no system as high-risk. Counsel confirms the role and the category of each system.

Regulation (EU) 2016/679 binds controllers and processors. Article 25 asks the controller for data protection by design and by default, and Article 32 for security of processing that is appropriate to the risk. Both apply to an LLM application that processes personal data. Whether an organisation is a controller or a processor for a given application depends on the facts, and counsel confirms it.

OWASP, MITRE ATLAS, NIST AI 600-1, NIST SP 800-218A, the NCSC blog, the NCSC and CISA guidelines and the joint agency guidance on agents are voluntary guidance. They are not law, and none of them says what the AI Act or the GDPR requires. This pack cites them as their publishers state them.

This pack does not say which OWASP, MITRE ATLAS, NIST or ISO/IEC 42001 items meet a requirement of the EU AI Act or the GDPR. Each reference says what its source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act or the GDPR.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.