I spend my weekdays thinking about liability. Not the fun kind — the regulatory kind. I'm a practicing lawyer and a medical sciences grad who somehow ended up writing open-source AI governance tooling. That combination sounds unusual because it is.
This post is about comply-agent, a Python CLI that scans AI agent configurations against the OWASP Agentic Top 10. It's not a framework. It's not a platform. It's a CLI that reads your prompts and configs, matches them against YAML rules, and tells you what's broken.
The Problem
OWASP published the Agentic Top 10 (ASI01 through ASI09) to categorize risks specific to autonomous AI agents — prompt injection, sensitive data disclosure, excessive agency, supply chain gaps, the rest. The document is good. Reading it is easy. Acting on it is hard.
Most teams I've talked to handle compliance at the end. Someone writes a system prompt, someone else wires up tool calls, a third person deploys it, and then someone in legal asks whether the agent can execute rm -rf without asking. By that point, the agent is already in production.
