OWASP Agent Control Standard workflow
An open OWASP standard where a separate guardian agent inspects an AI agent's action before it runs and allows, denies or edits it
- 259 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Hooks send the guardian a description of every tool call, commands and paths included
- The reference guardian's channel is unsigned, and on failure it lets actions through by default
Install
- Works in
Manual install
Clone GenAI-Security-Project/agent-control-standard, go to reference-implementations/agt, run `bun install` and, in one terminal, `bun run guardian`. Copy `hosts/claude-code/settings.json` to the project's `.claude/settings.json`. Before working, set `ACS_ON_DECISION_FAILURE=deny` and tell the user the channel is not authenticated.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Hooks send the guardian a description of every tool call, commands and paths included
- The reference guardian's channel is unsigned, and on failure it lets actions through by default
This is third-party code. Review the repository files before installing.
What it does
ACS (Agent Control Standard) is a specification for the exchange between an AI agent and a separate guardian agent. Before acting, the agent sends a JSON-RPC 2.0 request, for example `steps/toolCallRequest` before a tool call, and the guardian answers: allow, deny or modify. An event log lets you reconstruct what happened. The standard defines nineteen hook methods. The repository also holds a working example. The reference implementation runs Microsoft's Agent Governance Toolkit behind the ACS interface and connects Claude Code and OpenCode to it through hooks. It needs only `bun`: after `bun install` and `bun run guardian` the guardian listens on port 8787, and a command like `echo rm -rf /` in Claude Code is refused with the code `destructive_shell_command_blocked`. Python adapters for Claude Code, Cursor and the NVIDIA NeMo Agent Toolkit sit alongside, with conformance checks.
Who it is for. Security teams and platform engineers who want to place policy between an agent and its tools without changing the agent.
Good fit when
- You want to show a guardian refusing a dangerous agent command and run such an example in minutes
- A platform team picks an exchange format between an agent and a policy system and wants an open specification
- Claude Code or Cursor hooks should connect to an external action check
- You build your own guardian or adapter and test it against the conformance checks
Not a fit when
- You need ready protection for production: the reference implementation itself lists its gaps
- Claude Code's built-in permissions are enough: a separate guardian adds another process
- You need checks on model output content: only two of the nineteen hooks run live
Example request
Run the reference guardian from agent-control-standard, connect Claude Code to it and show it blocking `echo rm -rf /`Limitations
The standard is version 0.1.0. In the reference guardian the channel is not authenticated: it does not implement the HMAC-SHA256 signature that ACS-Core requires, so any process that can reach the port can read decisions and influence them. The default failure posture is `proceed`: a crashed or unreachable guardian silently stops governing, and refusing on failure needs `ACS_ON_DECISION_FAILURE=deny`. Of the nineteen methods only `steps/toolCallRequest` and `steps/toolCallResult` are evaluated. Some commands need `trash-cli`, installed separately from `bun`.
How to disable. Remove the hooks from `.claude/settings.json` and stop the guardian process, and Claude Code works as before. The clone can be deleted; it installs nothing into the system.
FAQ
What is a guardian agent?
A separate process that receives a description of the action from the agent before it runs and answers: allow, deny or modify. The decision and its reason go to a log.
How can I see the standard working quickly?
In the reference implementation run `bun install`, then `bun run guardian`, and connect Claude Code by copying `hosts/claude-code/settings.json`. The request `echo rm -rf /` is refused.
What happens if the guardian crashes?
By default the agent carries on without a check. To refuse actions on failure, set `ACS_ON_DECISION_FAILURE=deny` for the guardian.
Which agents have adapters?
The repository has adapters for Claude Code, Cursor and the NVIDIA NeMo Agent Toolkit, and the reference hooks connect Claude Code and OpenCode.
Who is behind the project?
The OWASP GenAI Security Project maintains the standard. The code is Apache-2.0 and the documentation has its own license, described in LICENSING.md.
Discussion
No questions or reviews yet.
Related
WorkflowsA policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Agent Governance Toolkit
Agent Governance Toolkit (Claude Code plugin)
A Microsoft plugin for Claude Code whose hooks inspect prompts and tool calls against a policy and block dangerous commands.
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
README in short
The description starts with a run: clone, start the guardian and see a command refused. Next come an honest list of the reference implementation's gaps, an example JSON-RPC request and response, and links to the specification, adapters and ways to contribute.