Eight of the ten threats in the OWASP Agentic Top 10 are fundamentally identity and authorization failures — not novel attacks, not zero-days. This reference card maps every threat to a concrete defensive control, grounded in Zero Trust architecture principles.