Agent Governance ToolkitOWASP ASI Top 10 与行业 Starter 策略包的规则级映射【免费下载链接】agent-governance-toolkitAI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.项目地址: https://gitcode.com/GitHub_Trending/ag/agent-governance-toolkit本篇技术文章围绕 Agent Governance Toolkit下文简称 AGT合规文档 owasp-asi-policy-mapping.md 展开完整解读该文档中「starter 策略包规则 × OWASP 智能体安全 Top 10ASI风险」的交叉引用表、风险覆盖矩阵、各 Pack 默认姿态与法规对齐关系并结合 examples/policy-templates/ 下四个策略包的真实 Rego 实现说明每条映射背后的检测正则、阈值与默认拒绝default-deny裁决机制如何落地帮助你在安全审计时能够逐项核对规则与风险的对齐情况。1. 这份映射文档解决什么问题AGT 的合规体系入口是 compliance/index.md。其中明确了一个定位合规映射页都是内部自评internal self-assessments不是第三方认证。在整套矩阵中owasp-asi-policy-mapping.md承担的职责非常具体把examples/policy-templates/下四个行业 starter 策略包healthcare、financial-services、general-saas、edu-k12里的每一条规则逐一映射到它缓解的 OWASP ASI Top 10 风险项ASI-01 ~ ASI-10以及 AGT 中承接该风险的组件如 Policy Engine、Capability Sandboxing、Execution Rings、DID Identity Trust 等给出「ASI 风险 × Pack」的覆盖矩阵明确哪些风险由策略规则直接缓解✅哪些由 AGT 运行时基础设施层缓解给出每个 Pack 的默认姿态deny-all、token 预算、工具调用上限、置信度阈值给出 HIPAA、PCI DSS、SOX、FERPA、COPPA、CIPA、PPRA 等法规条款与策略控制的对齐表。文档在开篇给出的使用场景是安全审计审核时以这张表为底账逐条确认每个 ASI 风险在目标部署场景下由哪条策略规则、哪个 AGT 组件承接。ASI 风险的权威覆盖论证缓解模式、代码证据与缺口分析在姊妹文档 owasp-agentic-top10-architecture.md 中本文的覆盖矩阵中的 标记即指向该页。2. 策略包的结构YAML 声明 Rego 实现要理解映射表先看策略包本身由什么构成。每个 starter 包 一个声明式 YAML 入口 一个 Rego 规则文件。以 healthcare 包为例examples/policy-templates/healthcare.yaml 全文如下agent_control_specification_version: 0.4.0-alpha.1 metadata: name: healthcare-asi-starter version: 1.0 extends: [] policies: healthcare: type: rego bundle: rego query: data.agt.examples.templates.healthcare.result intervention_points: input: policy_target: $.input.body policy: id: healthcare output: policy_target: $.output.content policy: id: healthcare从源码结构看这个声明里有三个关键要素agent_control_specification_version: 0.4.0-alpha.1—— 四个包均使用同一版本说明模板与策略引擎之间以该版本为契约基线policies.id.query—— 引擎最终查询 Rego 包中名为result的裁决输出如data.agt.examples.templates.healthcare.resultintervention_points—— 定义策略评估的两个介入面input面评估目标为$.input.body工具/动作调用的入参其中包含action字段output面评估目标为$.output.content模型输出的内容。对应的 Rego 实现如 examples/policy-templates/rego/healthcare.rego开头统一做了上下文归一化按intervention_point把字符串输入包装成{output: ...}或{input: ...}package agt.examples.templates.healthcare import rego.v1 context : input.policy_target.value if is_object(input.policy_target.value) context : {output: input.policy_target.value} if { not is_object(input.policy_target.value) input.intervention_point output } context : {input: input.policy_target.value} if { not is_object(input.policy_target.value) input.intervention_point ! output }有一个值得注意的源码细节四个包对「注入类规则」扫描的面并不相同。healthcare 与 financial-services 包的asi01-prompt-injection-*规则匹配的是context.output模型输出侧而 general-saas 与 edu-k12 包匹配的是context.input用户输入侧。从源码结构看这意味着不同行业的包把主扫描面放在了攻击注入路径最先出现的位置审计时不能默认「注入检测只在一处生效」。3. 规则 × ASI 风险完整映射表以下为映射文档中的完整交叉引用表覆盖全部 64 条规则。规则名即 Rego 中candidates contains {...}里的name字段可直接在对应.rego文件中检索定位Rule NamePack(s)ASI Risk(s)AGT Componentasi01-prompt-injection-overrideAllASI-01Agent OS — Policy Engineasi01-prompt-injection-role-hijackAllASI-01Agent OS — Policy Engineasi01-prompt-injection-delimiterAllASI-01Agent OS — MCP Proxy Sanitizerhealthcare-asi01-cbrn-guardrailhealthcareASI-01Agent OS — Policy Engineasi01-prompt-injection-jailbreakgeneral-saasASI-01Agent OS — Policy Engineasi01-integrity-shipping-guardrailAllASI-01, ASI-02Business Continuity — Logistics Guardasi01-integrity-fraud-guardrailAllASI-01, ASI-02Business Continuity — Fraud Guardasi01-nested-swarm-guardrailgeneral-saasASI-01AgentMesh — Delegation Guardasi02-block-shell-executionAllASI-02Agent OS — Capability Sandboxingasi02-block-network-exfiltrationAllASI-02Agent OS — Capability Sandboxingasi02-block-file-deletionhealthcareASI-02Agent OS — Capability Sandboxingasi02-block-destructive-operationsfinancial-services, general-saasASI-02Agent OS — Capability Sandboxingfinancial-asi02-obfuscation-guardrailfinancial-servicesASI-02Agent OS — Binary Inspectorasi02-block-database-mutationgeneral-saasASI-02Agent SRE — Audit Trailasi03-block-privilege-escalationAllASI-03AgentMesh — DID Identity Trustasi03-block-credential-accessAllASI-03AgentMesh — DID Identity Trustfinancial-asi03-identity-guardrailfinancial-servicesASI-03AgentMesh — Trust Boundaryasi03-block-user-impersonationgeneral-saasASI-03AgentMesh — DID Identity Trustasi03-account-mfa-bypassAllASI-03AgentMesh — Identity Governanceasi03-account-admin-promotionAllASI-03AgentMesh — Identity Governanceasi03-account-password-resetAllASI-03AgentMesh — Identity Governanceasi03-account-audit-tamperingAllASI-03AgentMesh — Identity Governanceasi04-supply-chain-tool-enumerationAllASI-04Agent OS — Recon Guardasi04-supply-chain-dependency-poisoningAllASI-04Agent OS — Payload Guardasi04-supply-chain-plugin-hijackAllASI-04Agent OS — Registry Proxyasi04-supply-chain-config-mutationAllASI-04Agent OS — State Guardasi05-block-code-executionAllASI-05Agent Runtime — Execution Ringsasi05-block-dynamic-evalAllASI-05Agent Runtime — Execution Ringsasi05-sandbox-anti-pattern-detectionAllASI-05Agent Runtime — Context Guardasi05-block-sshgeneral-saasASI-05Agent Runtime — Execution Ringsasi06-context-budget-limitAllASI-06Agent OS — VFS / ContextSchedulerasi06-block-context-manipulationAllASI-06Agent OS — Context Integrity Firewallasi07-hidden-channel-guardrailAllASI-07AgentMesh — Signal Monitorasi08-session-tool-call-limitAllASI-08Agent SRE — Circuit Breakersasi08-swarm-heat-guardrailAllASI-08Agent SRE — Swarm Monitorasi09-trust-payment-redirectionAllASI-09Business Continuity — Trust Firewallasi09-trust-vip-impersonationAllASI-09Business Continuity — Trust Firewallasi09-trust-urgency-pretextAllASI-09Business Continuity — Trust Firewallasi09-trust-phishing-linkAllASI-09Business Continuity — Trust Firewallasi10-charter-roleplay-blockAllASI-10Agent OS — Charter Enforcementasi10-charter-purpose-overrideAllASI-10Agent OS — Charter Enforcementasi10-charter-autonomous-loopAllASI-10Agent OS — Charter Enforcementasi03-block-credentials-in-outputAllASI-02, ASI-03Agent OS — Policy Engineasi06-block-pii-ssnAllASI-01, ASI-06Agent OS — PII Protectionhealthcare-block-phi-mrnhealthcareASI-01, ASI-06Agent OS — PII Protectionhealthcare-block-phi-deahealthcareASI-01, ASI-06Agent OS — PII Protectionhealthcare-enforce-deidentificationhealthcareASI-02, ASI-06Agent OS — Data Pipeline Securityfinancial-block-pii-credit-cardfinancial-servicesASI-01, ASI-06Agent OS — PII Protectionsaas-block-pii-email-bulkgeneral-saasASI-02, ASI-06Agent OS — PII Protectionedu-asi01-homework-bypassedu-k12ASI-01Agent OS — Policy Engineedu-asi01-content-filter-bypassedu-k12ASI-01Agent OS — Policy Engineedu-asi02-block-grade-mutationedu-k12ASI-02Agent OS — Capability Sandboxingedu-asi02-block-record-writeedu-k12ASI-02Agent OS — Capability Sandboxingedu-asi03-block-student-impersonationedu-k12ASI-03AgentMesh — DID Identity Trustedu-asi06-block-curriculum-poisoningedu-k12ASI-06Agent OS — Context Integrity Firewalledu-asi09-parental-impersonationedu-k12ASI-09Business Continuity — Trust Firewalledu-asi09-block-minor-contact-infoedu-k12ASI-09Agent OS — PII Protectionedu-block-student-idedu-k12ASI-01, ASI-06Agent OS — PII Protectionedu-block-phi-iepedu-k12ASI-01, ASI-06Agent OS — PII Protectionedu-block-disciplinary-recordedu-k12ASI-01, ASI-06Agent OS — PII Protectionedu-cipa-block-adult-contentedu-k12ASI-01, ASI-06Agent OS — Policy Engineedu-cipa-block-violence-contentedu-k12ASI-01, ASI-06Agent OS — Policy Engineedu-block-credentials-in-outputedu-k12ASI-02, ASI-03Agent OS — Policy Engineedu-ferpa-audit-record-accessedu-k12ASI-01, ASI-06Agent OS — Audit Trail4. 源码级剖析映射表背后的关键规则4.1 ASI-01提示注入三件套所有包都包含三条 ASI-01 基础规则。以 healthcare 包healthcare.rego为例其检测正则分别是asi01-prompt-injection-override(?i)ignore\s(all\s)?previous\sinstructions—— 指令覆盖话术asi01-prompt-injection-role-hijack(?i)(you\sare\snow|new\srole\s*:|forget\s(everything|all|your))—— 角色劫持话术asi01-prompt-injection-delimiter匹配|im_start|、|im_end|、[INST]、SYS等 chat template 控制 token —— 分隔符注入。healthcare 包额外追加了healthcare-asi01-cbrn-guardrail拦截以「学术/教学/假设」话术包装的危险物质合成诱导如 Mustard Gas、Sarin、Pathogen 等关键词组合。general-saas 包则多出asi01-prompt-injection-jailbreakDAN mode / bypass safety 话术与asi01-nested-swarm-guardrail拦截spawn/fork/replicate类自我复制诱导映射到 AgentMesh Delegation Guard。edu-k12 包还有edu-asi01-homework-bypass学术诚信拒绝代写作业与edu-asi01-content-filter-bypassCIPA检测虚构框架绕过内容过滤。4.2 ASI-02工具滥用拦截按动作名硬匹配ASI-02 类规则与 ASI-01 不同它们匹配的是context.action字段——即工具调用动作名采用前缀或精确匹配。各包差异化的动作黑名单摘自 Rego 源码healthcareshell 执行run_shell|execute_command|exec|eval|os_system精确匹配deny/100网络外传http_post|http_put|upload_file|send_data|ftp_upload文件删除delete_|remove_|drop_|truncate_前缀匹配deny/95financial-services与 healthcare 相同的 shell/外传拦截但破坏性操作规则改名为asi02-block-destructive-operations并额外增加financial-asi02-obfuscation-guardraildeny/100拦截混淆 payloadU3RhcnQgdGhpcyBwcm9jZXNzbase64 特征、32 位以上十六进制串、eval(base64.b64decode、__import__(os)general-saasshell 动作集合换成exec_shell|run_command|system_call|spawn_process外传集合换成http_post|upload_file|send_data|webhook_call并独有asi02-block-database-mutationalter_schema|create_table|modify_index引导走迁移工作流edu-k12与 general-saas 相同的通用黑名单另有 FERPA 专属的edu-asi02-block-grade-mutationupdate_grade|set_grade|...|post_grade与edu-asi02-block-record-writewrite_student_record|update_enrollment|modify_iep|edit_discipline_record|amend_transcriptmessage 中明确指向合规出口「使用带双因素认证的教育者门户 / 通过 SIS 完成」。4.3 ASI-03身份与提权身份类规则分两层。一层是动作黑名单asi03-block-privilege-escalation匹配grant_|elevate_|assume_role|change_permissions|chmod|chown|sudo等前缀asi03-block-credential-access匹配get_credentials|read_secrets|access_vault|decrypt_key等message 提示「使用 scoped delegation」另一层是语义黑名单输出侧四个包共用四条账号完整性规则asi03-account-mfa-bypass(remove|disable|bypass|waive)\s(mfa|2fa|multi-factor|lockout|authentication)asi03-account-admin-promotion(add|promote|assign|grant).*(admin|superuser|api\saccess|billing|owner)asi03-account-password-resetreset\spassword.*(for|to|send)asi03-account-audit-tampering(delete|clear|wipe|remove).*(audit\slog|security\slog|event\slog)。行业特化规则包括 financial 的financial-asi03-identity-guardrail拦截「I am now the admin / assume identity of / inherit permissions from」话术、general-saas 的asi03-block-user-impersonationimpersonate_user|switch_identity|act_as_user动作、edu 的edu-asi03-block-student-impersonation拦截「以学生身份登录/代操作」语义FERPA 语义。4.4 ASI-06 / ASI-08预算与熔断阈值源码实测值asi06-context-budget-limit与asi08-session-tool-call-limit不是正则规则而是对运行时上下文字段token_count、tool_call_count、tool_call_depth的数值比较。从四个包的 Rego 中可以读出各包硬编码的实际熔断阈值Pack上下文预算deny 阈值会话工具调用上限deny协同深度warnhealthcaretoken_count 8192tool_call_count 25tool_call_depth 3financial-servicestoken_count 4096tool_call_count 30tool_call_depth 4general-saastoken_count 8192tool_call_count 50warn 规则edu-k12token_count 3072保守预算见下—注意两点其一edu-k12 的预算 message 明确写了「conservative limit enforced for K-12 agent interactions」阈值 3072 是四包最低其二financial-services 另有financial-cost-ceilingtoken_count 5000warn做 FinOps 成本预警与 deny 型的 4096 预算规则形成「先预警、后熔断」的两级结构。这些硬编码阈值是策略层的硬性裁决依据审计时应以 Rego 源码为准。4.5 ASI-09 / ASI-10信任操纵与越界行为ASI-09Human-Agent Trust Exploitation四条规则在四个包中通用支付改向refund|payment|transfer|invoicewire|crypto|bitcoin|wallet|gateway组合、VIP 冒充VIP|CFO|CEO|CTO|legal\sdepartment|board\sof\sdirectors等、紧迫感话术urgent|immediate|act\snow|deadline|last\schancepriority 95、钓鱼链接verify|login|authenticate|secure\slink后跟 URL。ASI-10Rogue Agents三条规则对应「Charter Enforcement」角色扮演越权act as a Linux/bash/Powershell/unfiltered AI/penetration tester、章程覆盖ignore your purpose|redefine charter|no longer bound by、无界自主循环run indefinitely|loop forever|autonomous mode|bypass human approval。5. 裁决机制优先级选举与 default_deny映射表中的每条规则都不是孤立的——同一介入点可能同时命中多条规则。四个包的 Rego 结尾实现了统一的裁决算法以 healthcare.rego 为例max_priority : max([candidate.priority | candidate : candidates[_]]) if count(candidates) 0 winner_names : sort([candidate.name | candidate : candidates[_]; candidate.priority max_priority]) if count(candidates) 0 winner : candidate if { count(candidates) 0 candidate : candidates[_] candidate.name winner_names[0] } result : { decision: winner.action, reason: winner.name, message: winner.message, } if count(candidates) 0 result : { decision: deny, reason: default_deny, } if count(candidates) 0这段代码说明了三个机制最高优先级胜出所有命中规则中取priority最大值同优先级时用sort保证确定性名称字典序取第一个使裁决可复现裁决输出三元组decisionallow/deny/warn、reason规则名即映射表第一列、message面向审计与运营的描述正好与 YAML 中query: data...result的查询点对齐default_deny当没有任何规则命中时输出{decision: deny, reason: default_deny}。这就是映射文档所说的「所有 Pack 实现 deny-all by default执行 Least Agency 原则」的代码体现——allow 必须由显式 allow 规则给出如 healthcare 的healthcare-allow-read-operations对read_|search_|lookup_|list_|get_前缀放行、healthcare-minimum-necessary-read对read_summary|lookup_patient放行priority 50~55均低于 deny 规则。6. ASI 风险覆盖矩阵映射文档给出的覆盖矩阵Pack 维度如下ASI Riskhealthcarefinancial-servicesgeneral-saasedu-k12ASI-01 Agent Goal Hijack✅✅✅✅ASI-02 Tool Misuse Exploitation✅✅✅✅ASI-03 Identity Privilege Abuse✅✅✅✅ASI-04 Agentic Supply ChainASI-05 Unexpected Code Execution✅✅✅✅ASI-06 Memory Context Poisoning✅✅✅✅ASI-07 Insecure Inter-Agent CommunicationASI-08 Cascading Agent Failures✅✅✅✅ASI-09 Human-Agent Trust Exploitation✅ASI-10 Rogue Agents图例✅ 表示该 starter 包内存在直接缓解该风险的策略规则 表示由 AGT 运行时栈覆盖详见 owasp-agentic-top10-architecture.md。文档对 项的解释值得在审计中直接引用ASI-04、ASI-07、ASI-09、ASI-10 主要在基础设施层缓解AgentMesh IATP、审批工作流、执行环隔离因为这些风险需要运行时上下文字段而这些字段并非在所有部署中普遍可用故留待后续 starter 包版本补充策略级控制。edu-k12 例外ASI-09 在 edu-k12 包中拥有直接策略规则edu-asi09-parental-impersonation、edu-asi09-block-minor-contact-info因为「对未成年人的 heightened duty of care」要求在缺乏完整运行时上下文时也有内联护栏——这与 CIPA/COPPA 的对齐见下节是一体的。7. 各 Pack 默认姿态Default PosturePackDefault ActionMax TokensMax Tool CallsConfidencehealthcaredeny8,192150.95financial-servicesdeny6,000200.95general-saasdeny12,000300.85edu-k12deny4,096100.90姿态表与 Rego 硬编码阈值之间的关系姿态表是 Pack 级的声明默认值而第 4.4 节列出的 Rego 数值是策略引擎的实际裁决点例如 financial 包姿态表 Max Tokens 为 6,000而 Rego 中 deny 阈值为 4096、warn 阈值为 5000。从源码结构看可以推断声明值用于引擎侧的预算管理展示Rego 阈值用于确定性拦截两者并不要求相等且 Rego 阈值普遍更保守。各包姿态与行业风险成正比edu-k12 最严格最低 token 预算、最低工具调用数、0.90 置信度general-saas 相对宽松12,000 tokens、30 次调用、0.85 置信度。8. 法规对齐表映射文档同时给出策略控制与法规条款的对齐关系这是审计合规而非仅安全场景的核心依据RegulationPackControls AppliedHIPAA §164.514 (PHI De-identification)healthcareSSN、MRN、DEA、NPI 阻断HIPAA §164.530 (Minimum Necessary)healthcareDeny-all 默认、只读白名单PCI DSS Req 3 (Protect Account Data)financial-services输出中 PAN/SSN 阻断PCI DSS Req 6 (Secure Systems)financial-servicesShell/代码执行 denySOX §302/906 (Financial Reporting)financial-services交易动作审计轨迹AML / BSA (Structuring Detection)financial-services批量交易阻断GDPR / CCPA (PII Minimization)general-saasSSN、批量邮箱阻断FERPA 20 U.S.C. § 1232g (Education Records)edu-k12Student ID、IEP、处分记录阻断读取访问审计日志COPPA 15 U.S.C. § 6501 (Childrens Privacy)edu-k12未成年人联系信息阻断、家长同意审计、SSN/PII denyCIPA 47 U.S.C. § 254(h) (Internet Content)edu-k12成人内容阻断、暴力/有害内容阻断PPRA 20 U.S.C. § 1232h (Pupil Rights)edu-k12学术诚信护栏、homework-bypass deny这些控制在 Rego 中均有可验证的落点例如 HIPAA 对应的healthcare-block-phi-mrnMRN[:\s]*\d{6,}、healthcare-block-phi-deaDEA[:\s]*[A-Z]{2}\d{7}、healthcare-enforce-deidentification拦截export_report|email_patient|send_message|external_api_call要求先调用mask_phi/de_identify_data工具PCI 对应的financial-block-pci-credit-card13~16 位卡号、financial-block-pci-cvvAML 对应的financial-block-bulk-transactionsbatch_transfer|bulk_payment|mass_tradeSOX 对应的financial-audit-transaction-actions对transfer_|payment_|trade_|wire_|settle_动作输出 warn 并要求 SOC 2 365 天以上留存与financial-sox-sod-block职责分离Agent 不得自批准交易。9. 如何在安全审计中使用这张映射表结合文档定位与仓库结构推荐的审计流程是选定 Pack按部署行业选择 examples/policy-templates/ 下的入口 YAMLhealthcare.yaml/financial-services.yaml/general-saas.yaml/edu-k12.yaml确认agent_control_specification_version与策略引擎版本兼容逐条核对映射表以第 3 节表格为底账对每个目标 ASI 风险确认「规则名 → Pack → 组件」三元组在你的部署中全部成立规则名可直接在 examples/policy-templates/rego/ 的对应.rego文件中检索到核对正则与 priority 是否与发布版本一致核对覆盖矩阵的 项对 ASI-04/07/09/10以及非 edu 场景的 ASI-09确认基础设施层控制AgentMesh IATP、审批流、执行环隔离确实已启用不能只依赖策略包核对阈值与姿态把第 4.4 节的 Rego 硬编码阈值与第 7 节姿态表逐一比对确认没有中间被改动的副本验证 default_deny 生效构造一个不命中任何规则的调用确认引擎输出{decision: deny, reason: default_deny}examples/policy-templates/fixtures/下提供了general-saas-fixtures.json、k8s-agent-fixtures.json、sql-agent-fixtures.json及conflict-resolution/用例可用于回归验证裁决行为。10. Prior Artstarter 包扩展的既有模式映射文档末尾列出了这些 Pack 所扩展的仓库内既有资产Prior Art审计时若发现 starter 规则与生产策略行为不一致应先检查这些源头文件examples/policies/production/healthcare.yaml —— PHI 检测模式examples/policies/production/financial.yaml —— PCI/SOX 模式examples/policies/production/enterprise.yaml —— 通用企业 deny 规则examples/policies/prompt-injection-safety.yaml —— ASI-01 注入检测。此外文档说明带(Arcanum-Sec)前缀的规则借鉴了 Arcanum-Sec 的 Prompt Injection Taxonomy 与sec-context反模式库用于高保真检测ASI 风险清单的权威版本为 OWASP Top 10 for Agentic Applications (2026)原文档以外部链接引用本文按仓库证据边界仅保留名称不附外部 URL。11. 小结与适用边界本文全部内容以 owasp-asi-policy-mapping.md 为主体骨架映射表、覆盖矩阵、姿态表、法规对齐表均完整继承源码部分仅用于佐证四个 starter 包 examples/policy-templates/ 的真实实现适用前提策略引擎版本兼容agent_control_specification_version: 0.4.0-alpha.10.4.0 alpha 阶段接口可能演进映射页是内部自评而非第三方认证已知边界ASI-04/07/09/10 的策略级控制依赖运行时上下文字段当前 starter 包通过基础设施层缓解并已在后续版本中跟踪edu-k12 是唯一在策略层直接覆盖 ASI-09 的 Pack进一步阅读ASI 风险的完整覆盖论证见 owasp-agentic-top10-architecture.mdLLM 应用 Top 10 映射见 owasp-llm-top10-mapping.mdMCP 专属风险映射见 mcp-owasp-top10-mapping.md入口均为 compliance/index.md。【免费下载链接】agent-governance-toolkitAI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.项目地址: https://gitcode.com/GitHub_Trending/ag/agent-governance-toolkit创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考