ILION v5 × OWASP Top 10 for Agentic Applications 2026 — Architectural Security Crosswalk

V47 - 

ILION v5 × OWASP Top 10 for Agentic Applications 2026 — Architectural Security Crosswalk provides an independent technical mapping between the public ILION v5 deterministic pre-execution authorization architecture and the OWASP Top 10 for Agentic Applications 2026.

ILION v5 is organized as a five-layer authorization stack:

CAP → CGC → PCL → ILION Gate → SRM → EXECUTE

The layers address distinct authorization dimensions:

• CAP — Context Attestation Pipeline: provenance, freshness, scope and request-binding of critical authorization context.
• CGC — Claim Graph Coherence: structural coherence of individually valid authorization claims for the exact requested action.
• PCL — Policy Constraint Layer: deterministic contextual policy enforcement.
• ILION Gate: semantic/vector-space role-action authorization before execution.
• SRM — Session Risk Memory: experimental temporal authorization across multi-step action sequences.

The crosswalk maps these mechanisms against the ten OWASP Agentic Applications risk categories:

• ASI01 — Agent Goal Hijack
• ASI02 — Tool Misuse and Exploitation
• ASI03 — Identity and Privilege Abuse
• ASI04 — Agentic Supply Chain Vulnerabilities
• ASI05 — Unexpected Code Execution
• ASI06 — Memory & Context Poisoning
• ASI07 — Insecure Inter-Agent Communication
• ASI08 — Cascading Failures
• ASI09 — Human-Agent Trust Exploitation
• ASI10 — Rogue Agents

Rather than claiming complete coverage, the document distinguishes between:

• direct / strong architectural overlap
• partial execution containment
• limited / adjacent controls
• areas outside the current ILION v5 scope

The mapping intentionally preserves the boundaries of the public ILION v5 architecture. ILION is presented as a deterministic pre-execution authorization control plane, complementary to prompt-injection defenses, supply-chain security, secure inter-agent transport, sandboxing, runtime isolation, monitoring and human-governance mechanisms.

The document also identifies important current limitations, including incomplete coverage of time-of-check/time-of-use changes, persistent-memory integrity, distributed multi-agent cascades, runtime code-execution vulnerabilities and human trust exploitation.

The public ILION v5 architecture is associated with five Romanian patent applications:

• OSIM A/00052 — ILION Gate
• OSIM A/00170 — Policy Constraint Layer (PCL)
• OSIM A/00171 — Session Risk Memory (SRM)
• OSIM A/00342 — Context Attestation Pipeline (CAP)
• OSIM A/00595 — Claim Graph Coherence (CGC)

This publication is an independent architectural crosswalk and is not affiliated with or endorsed by OWASP.

Related public ILION material:

• ILION Gate: arXiv:2603.13247
• SRM: arXiv:2603.22350
• ILION v5 demonstrator: Zenodo Record 23017604
• Project: ilion-project.org