Claude Code treats CLAUDE.md as context, not enforced configuration, so a rule written there can lose to the task in front of it. Here's what does enforce one, from permission rules to a PreToolUse hook you write yourself to AgentTrail Guard, tested on a real --force-reset.
OWASP now ranks the ten critical risks of autonomous, tool-using agents. We walk ASI01 to ASI10 with concrete coding-agent scenarios, then map where AgentTrail stops the risk, where it only gives you visibility, and where it doesn't help at all.
The OWASP Top 10 for LLM Applications (2026) treats the model as a component. When that model can call tools and run commands, three of its risks become yours to enforce. Here's LLM01 to LLM10, and where an action-governance layer actually moves the needle.
Coding agents don't remember your team's corrections. The same deprecated API, the weakened test, the wrong logger come back every session. The fix isn't a better memory. It's catching each repeat as it recurs and enforcing it outside the model.
