Trust
Prompt injection and excessive agency, mapped to our controls.
This page maps our controls to two risks in the LLM Top 10 for 2025, from the OWASP Gen AI Security Project. They are LLM01, prompt injection, and LLM06, excessive agency.
Each row names a control and the code that holds it. It cites the test that proves it, and its status in our repository. Production status follows our next production verification.
This is our own mapping. No third party has assessed it. Nervos holds no certification.
The two risks
Both risks, in OWASP’s own words.
The definitions below are quoted from OWASP. Each source line says when we read it.
OWASP’s pages state that, unless otherwise specified, “all content on the site is Creative Commons Attribution-ShareAlike v4.0”. We quote them with attribution, under the Creative Commons Attribution-ShareAlike 4.0 International licence.
| Risk | OWASP’s words | Source |
|---|---|---|
| LLM01 Prompt Injection | “A Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways.”“Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.” | OWASP LLM01:2025 Prompt InjectionRead October 9, 2026. |
| LLM06 Excessive Agency | Excessive Agency “enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM”.OWASP names three root causes: “excessive functionality”, “excessive permissions” and “excessive autonomy”. | OWASP LLM06:2025 Excessive AgencyRead October 9, 2026. |
Residual risk
An injected instruction can still shape a decision.
An analysis can draw on live web signals. A web page can carry hidden instructions. In OWASP’s terms, that is indirect prompt injection.
The analysis informs the write a person proposes. It also informs what an approver believes about that write. So injected text can reach a decision.
OWASP writes that “it is unclear if there are fool-proof methods of prevention for prompt injection”. We do not claim to prevent it.
Our mitigation is narrower. In our repository, a write is dispatched only under a server-recorded human authorization bound to its exact payload (AUTHZ-01).
An injected instruction can still mislead the person who approves. Authorization puts a person in the path. It does not make the analysis trustworthy.
The five analysis agents’ prompts mark the gathered web signals as untrusted data. Not every prompt that reads web content or model output carries the mark yet. Where a prompt carries the mark, it is an instruction to a model, not a guarantee.
Where caching is configured, web research is reused for up to six hours by default. It is reused for the same company and objective, so injected text in it is reused too.
Production status follows our next production verification.
LLM01
Prompt injection, and the controls that answer it.
OWASP lists seven strategies for prompt injection. This table answers four of them. The limits below name the other three.
Each claim identifier links to the claims register. A control with no register claim names its test instead. Production status follows our next production verification.
| OWASP strategy | Our control | Code and test | Repository status |
|---|---|---|---|
| Constrain model behavior“instruct the model to ignore attempts to modify core instructions” | The five analysis agents’ prompts mark the company, the objective, web signals and past memory as untrusted data. Each tells the model not to follow instructions inside them. |
| Tested in our repository |
| Segregate and identify external content“Separate and clearly denote untrusted content to limit its influence on user prompts.” | Live web signals reach each analysis agent in their own labelled block, marked as untrusted data. Not every prompt that reads web content or model output carries the mark yet. |
| Partial, tested in our repository |
| Segregate and identify external content“Separate and clearly denote untrusted content to limit its influence on user prompts.” | Where the decision record is enabled, it lists the web search as an inferred source, never a verified one. |
| Tested in our repository |
| Segregate and identify external content“Separate and clearly denote untrusted content to limit its influence on user prompts.” | Where the knowledge record is enabled, a claim from the analysis is stored as inferred at most. It is never stored as verified. |
| Tested in our repository |
| Enforce privilege control and least privilege access“handle these functions in code rather than providing them to the model” | The analysis code imports no module that reads a stored connector credential. Writes go through the execution engine, not the analysis. |
| Tested in our repository |
| Require human approval for high-risk actions“Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions.” | In our repository, a write is dispatched only under a server-recorded human authorization bound to its exact payload (AUTHZ-01). |
| Verified in our repository |
LLM06
Excessive agency, and the controls that answer it.
OWASP lists eight strategies for excessive agency. It also lists two options that “will not prevent Excessive Agency, but can limit the level of damage caused”. This table answers four strategies and one of those options.
Each claim identifier links to the claims register. A control with no register claim names its test instead. Production status follows our next production verification.
| OWASP strategy | Our control | Code and test | Repository status |
|---|---|---|---|
| Minimize extensions“Limit the extensions that LLM agents are allowed to call to only the minimum necessary.” | The analysis models are offered web search, and no tool that writes to a connected system. A write can name only an action in a fixed registry. The proposals route refuses any other action, and the execute route checks again. The registry limits writes, not model tools. |
| Partial, tested in our repository |
| Minimize extension functionality“Limit the functions that are implemented in LLM extensions to the minimum necessary.” | The analysis has no tool that creates a proposal. When a proposal names an agent, the proposals route checks that name against the registry. The analysis agents’ scope includes no action. |
| Tested in our repository |
| Require user approval“Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken.” | In our repository, a high-risk write that cannot be reversed automatically, or is for $100,000 or more, needs a second, distinct approver (AUTHZ-03). |
| Verified in our repository |
| Require user approval“Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken.” | An approval by the proposer on record is refused, at approval and again at dispatch. Until a pending migration is applied, a member can set who is on record (SOD-01). |
| Partial in our repository |
| Complete mediation“Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not.” | In our repository, a revocation stops a write up to the send, because the engine checks again just before it (AUTHZ-04). |
| Verified in our repository |
| Complete mediation“Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not.” | In our repository, a replay re-runs a write only under an authorization that still binds it (AUTHZ-02). |
| Verified in our repository |
| Complete mediation“Enforce the complete mediation principle so that all requests made to downstream systems via extensions are validated against security policies.” | In our repository, a host taken from a stored credential is validated before any request is sent (EGRESS-02). The check limits where a request may go, not what the credential may do in the connected system. |
| Verified in our repository |
| Log and monitor“Log and monitor the activity of LLM extensions and downstream systems” | Each step of an execution is recorded in a SHA-256 hash-chained ledger (HIST-02). The chain is tamper-evident. It has no external anchor yet. A rewrite of one step and every step after it still verifies. So does removing the last steps. |
| Verified in our repository |
| Log and monitor“Log and monitor the activity of LLM extensions and downstream systems” | In our repository, a write is recorded as executed only when the provider confirms it (EXEC-01). The NetSuite adapter is implemented, not yet exercised against a live account. |
| Verified in our repository |
| Log and monitor“Log and monitor the activity of LLM extensions and downstream systems” | In our repository, only a provider lookup or two agreeing operators settle an unconfirmed write, and the second must not be the proposer (EXEC-02). |
| Verified in our repository |
| Log and monitor“to identify where undesirable actions are taking place, and respond accordingly” | In our repository, execution can be halted without a deployment, and an unreadable halt setting counts as a halt (KILL-01). |
| Verified in our repository |
Limits
Where this mapping stops.
OWASP’s last strategy for prompt injection reads “Perform regular penetration testing and breach simulations”. No third party has tested Nervos yet. Our trust page lists that report as not held.
Two LLM01 strategies are not mapped to a control on this page. They are output-format validation, and input and output filtering.
Five LLM06 items are not mapped to a control on this page. They are open-ended extensions, extension permissions, running extensions in the user’s context, input and output sanitising, and rate limits.
The NetSuite adapter is implemented, not yet exercised against a live account. Nervos has no customers yet.
Production status follows our next production verification.
The claims register
Each claim this page cites, with its status in our repository.
The register gives the status of each of our security claims in our repository. Its production column follows our next production verification.