The OWASP Top 10 for Large Language Model Applications is a useful security reference, but production teams need to turn it into a working checklist. The goal is not to name the risks in a slide deck. The goal is to know which systems are exposed to each risk, what controls exist, and what evidence proves the controls are operating.
A production checklist should be tied to the AI inventory. Each system should have a risk review that reflects its model, data, tools, users, and deployment context.
Prompt injection and tool misuse
Check whether the system can receive untrusted input, retrieve untrusted content, or call tools based on model output. Controls may include instruction hierarchy, content isolation, tool allowlists, confirmation prompts, least-privilege permissions, and human approval for sensitive actions.
Evidence should include test cases, blocked attempts, tool-call logs, and review of high-risk actions.
Sensitive information disclosure
Identify what data the system can access and return. Review prompt templates, retrieval sources, permissions, logging, vendor retention, and output controls. For agents, verify that tool responses do not expose data beyond the user's permissions.
The checklist should record data categories, access controls, and incidents or blocked disclosures.
Supply chain and model dependencies
Track providers, models, plugins, tools, frameworks, retrieval systems, and hosted components. Review vendor terms, security posture, update behavior, and dependency ownership. A model or tool change can alter risk even when the user interface stays the same.
Excessive agency
Review whether the system can take actions beyond what is necessary. Limit tool scope, transaction size, message sending, record changes, code execution, and workflow triggers. Add approval gates for irreversible or sensitive actions.
Excessive agency is not only a design flaw; it is a governance failure if the approval record never described the authority granted to the agent.
Monitoring and response
Production systems should log relevant prompts, tool calls, outputs, policy decisions, blocked actions, and incidents according to retention rules. Monitoring should route alerts to owners who can respond.
The checklist is complete only when each risk has an owner, a control, an enforcement point, and evidence. That turns OWASP from a reference into an operating security program.