Acceptance criteria
Support agentless and optional-agent patterns, and avoid kernel mode, reverse proxy and major network changes unless justified and tested.
Why it matters
Kernel components, proxies and network changes add operational risk that should be justified.
How to verify
The vendor documents the deployment architecture and justifies any privileged component.
OWASP adoption context
Endpoint and network design risks span the listed employee AI settings; broad coverage should not assume that one deployment architecture fits every surface.
Framework mappings
Justified, tested deployment choices provide secure-architecture, configuration and change/acceptance-review inputs and can reduce unnecessary privileged interception exposure. Agentless deployment is not intrinsically more secure, and these frameworks do not prohibit kernel components or reverse proxies.
Agent choices and justified network changes document AI component controls, computing resources and deployment requirements. Tests provide readiness evidence, but the configuration still needs assessment in the actual deployment environment.
Justified and tested deployment choices provide readiness evidence when assessed against a defined deployment plan and acceptance criteria. Avoiding kernel components or reverse proxies is not itself resource documentation or proof of safe deployment.
Justified, tested deployment choices can provide configuration-acceptance evidence when assessed against a security baseline. Agentless deployment is not inherently safer, and avoiding a technology class does not establish a network-access safeguard.