Operationalizing OWASP LLM Top 10 Controls in Enterprise AI Platforms

Abstract

Enterprises have moved large language model applications from pilot projects into production systems handling customer conversations, internal knowledge retrieval, and increasingly autonomous agentic workflows, introducing a risk surface that differs materially from what conventional application security programs address. OWASP has responded with the Top 10 for Large Language Model Applications, most recently revised in its 2025 edition, and a newly published Top 10 for Agentic Applications covering autonomous, tool-using systems. These taxonomies name and prioritize risk but leave engineering teams to translate categories such as prompt injection or excessive agency into controls that fit an existing cloud-native delivery pipeline. This paper proposes a reference architecture and implementation framework mapping each of the ten OWASP LLM Top 10 2025 categories to specific, deployable controls built on commonly used cloud primitives: managed model gateways, service mesh identity, retrieval-augmented generation pipelines, and continuous delivery tooling. The framework is informed by production engineering practice with retrieval-augmented generation and agentic workloads on Kubernetes using a managed foundation model service. Five real, publicly documented incidents, including a corporate data leak, a manipulated dealership chatbot, a legal ruling on chatbot liability, an indirect prompt injection exfiltration attack, and a zero-click vulnerability in a widely used enterprise copilot, are analyzed against the proposed controls to show where the framework would have reduced impact or prevented the incident outright. A four-stage maturity model helps organizations sequence adoption. Open challenges discussed include the immaturity of evaluation tooling for non-deterministic systems and the persistent tension between guardrail thoroughness and production latency.