Wombat

WAF-AGN-110 – Agent outputs and actions MUST be validated, sandboxed, and restricted to allowlists

Pillar: Agentic | Severity: 🟠 High | Category: Agentic Governance | Automatable: Medium

Description

Agent-generated outputs MUST be validated against schemas, business rules, or human-defined constraints before downstream use. Agent tool invocations MUST be sandboxed and restricted to an explicit allowlist of functions and parameters. High-impact actions MUST require confirmation or human-in-the-loop approval. Validation failures MUST be logged, alerted, and used to refine guardrails.

Rationale

Risk Description

Risk

Unvalidated agent outputs can trigger incorrect business decisions or data corruption.

Risk

Unsandboxed tool access allows prompt injection and unauthorized actions by compromised agents.

Requirements

  • Agent-generated outputs MUST be validated against schemas, business rules, or human-defined constraints before downstream use.

  • Agent tool invocations MUST be sandboxed and restricted to an explicit allowlist of functions and parameters.

  • High-impact actions MUST require confirmation or human-in-the-loop approval.

  • Validation failures MUST be logged, alerted, and used to refine guardrails.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-agn-110.tf.aws.bedrock-guardrail

Engine: terraform | Provider: aws | Automated: Yes

AWS Bedrock agent must use guardrails with blocked outputs

AWS Bedrock agent must use guardrails with blocked outputs

Scope: resource — aws_bedrock_guardrail

Assertions: * name attribute_exists — Bedrock guardrail must be configured.

Remediation: AWS Bedrock agent must use guardrails with blocked outputs

Compliant
# Example compliant with waf-agn-110.tf.aws.bedrock-guardrail
Non-Compliant
# Example non-compliant with waf-agn-110.tf.aws.bedrock-guardrail

waf-agn-110.config.agent-validation-policy

Engine: config | Provider: any | Automated: No

Agent output validation and tool allowlist policy must exist

Agent output validation and tool allowlist policy must exist

Scope: file — docs/agentic/agent-validation-policy.md

Assertions: * exists attribute_exists — Agent validation and tool allowlist policy must exist.

Remediation: Agent output validation and tool allowlist policy must exist

Compliant
# Example compliant with waf-agn-110.config.agent-validation-policy
Non-Compliant
# Example non-compliant with waf-agn-110.config.agent-validation-policy

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls