You asked how we cover A01–A10 Agentic.
Here's all ten.

OWASP	Agentic risk (2026)	INTEGRITAS vector	Primitive / control	How we close it
ASI01	Agent Goal Hijack	Vector 04 — Intent	Intent Attestation (IA)	Live proof the agent's effective objective still matches its signed mandate. Drift = denial. This is the hijack-killer.
ASI02	Tool Misuse & Exploitation	Vector 01 — Capability	Default-deny runtime + zero ambient authority	The agent can only ever name tools/actions explicitly granted in its mandate. An ungranted tool call is unsayable, not merely blocked.
ASI03	Agent Identity & Privilege Abuse	Vector 02 — Identity	Quantum-Safe Identity (QID)	NIST hybrid post-quantum signatures bind every action to an unforgeable identity. No spoof, no clone, no silent privilege escalation.
ASI04	Agentic Supply Chain Compromise	Vector 05 — Channel	Containment Fabric (CF) + SUPPLY-CHAIN-SENTINEL	Agents interoperate only through the fabric; a poisoned package or agent-instruction file is stopped before it reaches the runtime.
ASI05	Unexpected Code Execution	Vector 01 — Capability + blast-radius grading	Reversibility-graded action mediation	Destructive/irreversible operations are graded and quorum-gated; DROP DATABASE and SELECT 1 are not the same action.
ASI06	Memory & Context Poisoning	Vector 03 — State / Memory	Proof-of-Integrity (PoI)	Tamper-evident, cryptographically-attested state. An agent cannot rewrite its own history or smuggle a poisoned goal past the proof chain.
ASI07	Insecure Inter-Agent Communication	Vector 05 — Channel	Containment Fabric (CF) + QID-authenticated messages	Every inter-agent message is authenticated and validated through the fabric. A spoofed instruction cannot mislead the swarm.
ASI08	Cascading Agent Failures	Systemic lock — circuit breaker	Network-wide fail-safe halt	A network-wide fail-safe halts cascading failures until a human re-arms it. The flash-crash failure mode is contained by design.
ASI09	Human-Agent Trust Exploitation	Vector 04 Intent + Vector 07 Accountability	Intent Attestation + Proof-of-Integrity	The agent cannot commit the org to actions outside its attested mandate, and every interaction is provable after the fact — no plausible-sounding rogue action slips through.
ASI10	Rogue Agents	All 7 vectors — by construction	Economic Integrity (EI) + the full cage	Containment is structural, not advisory: a violation costs the agent, every vector is locked, the fail-safe is armed. A rogue agent is contained by mathematics, not trust.

OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10), OWASP GenAI Security Project — genai.owasp.org ↗. This page maps an independent framework to our own controls; it is an INTEGRITAS capability claim, not an OWASP endorsement.

OWASP Agent Control Standard (ACS) — mapped to the doors

On 2 September 2026 the OWASP GenAI Security Project took donation of an Agent Control Standard (ACS) “toward practical runtime enforcement” — in its words, “putting enforceable controls around what these systems can access, decide and do”. The standard (specification v0.1.0, releases of 9 September 2026) has no numbered controls; it is a wire specification: a mandatory core of ten requirements, six optional conformance profiles, nineteen lifecycle hooks, five dispositions. It asks one thing of every runtime that hosts superintelligent AI agents: that each action be inspectable, traceable and instrumentable before it runs. A door stands at every one of its hooks, and every verdict is signed at the highest post-quantum grade the standard registers. Where the standard defers to later versions — streaming, multi-tenancy, agent-to-agent — the doors are already open and counted. The table below groups the map by the standard’s three verbs; the unit-by-unit map is kept in the house record.

ACS	What the standard governs	INTEGRITAS vector	Doors (number · name)	How we close it
ACS · ACCESS	What a superintelligent AI agent can reach — tools, data, counterparties	Vector 01 — Capability · Vector 02 — Identity	Door 32 · Agent identity / credentials · Door 33 · Capability grant / mandate / containment · Door 37 · Network egress / proxy · Door 114 · Privilege layering	Access is granted by a signed mandate and a passport, default-deny, checked when the tool is called — never only when the tools are listed.
ACS · DECIDE	What the agent may decide on its own, and what needs a human	Vector 04 — Intent	Door 86 · Oversight efficacy · Door 87 · Approver device binding · Door 88 · Mandate widening by the agent · Door 101 · Observation-to-action atomicity	The consequential decision goes to the accountable human; no answer is a refusal; the agent cannot widen its own mandate; the approval binds the exact parameters shown.
ACS · DO	What the agent actually executes, and the record of it	Vector 05 — Action	Door 22 · Action path / sinks (external calls) · Door 26 · Autonomous fund movement · Door 112 · Mandate-bound signing · Door 122 · Control-plane write guard	Execution is bound to what was approved and signed in the path; every action closes with a signed receipt or a signed NOT-DONE — the runtime enforcement the standard asks for, with the evidence.

OWASP GenAI Security Project, Agent Control Standard donation announced 1–2 September 2026 (genai.owasp.org ↗). Read at the primary 15 October 2026 (resource page 1 Sep, press release 2 Sep, repository releases 9 Sep 2026). Map grouped by verb; door numbers and names are public at /doors.html. An INTEGRITAS capability claim, not an OWASP endorsement.