Implementation guides
A plain-English guide to each of the 282 requirements in the OWASP AISVS: what good looks like, how teams usually do it, the evidence to keep and the mistakes to avoid.
Not sure which ones apply to your system? Take the assessment to get a list scoped to it.
Training Data Integrity & Traceability
13 guides
This chapter addresses protecting the integrity and traceability of training data as it is sourced, handled, and maintained.
Training Data Origin & Data Security
Data Labeling and Annotation Security
Input Validation
12 guides
This chapter addresses validation of all inputs as a first-line defense against prompt injection, one of the most damaging attacks on AI systems.
Prompt Injection Defenses
- Normalise input before the model sees it Level 1 2.1.1
- Catch encoding tricks hidden in input Level 1 2.1.2
- Screen inputs for prompt injection Level 1 2.1.3
- Reject input that is too long Level 1 2.1.4
- Allow-list the characters you accept Level 1 2.1.5
- System instructions beat user instructions Level 2 2.1.6
- Stop special tokens being injected Level 2 2.1.7
- Detect many-shot jailbreaks Level 3 2.1.8
Model Lifecycle Management & Change Control
15 guides
This chapter addresses control of model changes so that unauthorized or unsafe modifications cannot reach production.
Model Authorization & Integrity
Model Validation & Testing
Controlled Deployment & Rollback
Secure Development Practices
Infrastructure, Configuration & Deployment Security
14 guides
This chapter addresses hardening AI-specific infrastructure components against model theft, data leakage, and cross-tenant contamination.
AI Workload Sandboxing & Validation
AI Hardware Security
Access Control & Identity for AI Components & Users
11 guides
This chapter addresses access control challenges that AI systems introduce beyond traditional application security.
Authentication
AI Resource Authorization & Classification
- Default-deny access to every AI resource Level 2 5.2.1
- Search only what the user may see Level 2 5.2.2
- Fetch sensitive data, don't train it in Level 2 5.2.3
- Filter out data the user may not see Level 2 5.2.4
- Keep authorisation decisions outside the agent Level 2 5.2.5
- Just-in-time access to model weights Level 3 5.2.6
- Carry data labels through to outputs Level 3 5.2.7
Supply Chain Security for Models
7 guides
This chapter addresses defending against AI supply chain attacks that exploit third-party models, frameworks, or datasets to embed backdoors, bias, or exploitable code.
Model Artifact Integrity
AI BOM & Supply Chain Monitoring
Model Behavior, Output Control & Safety Assurance
14 guides
This chapter addresses constraining, validating, and monitoring model outputs so that unsafe, malformed, or high-risk responses cannot reach users or downstream systems.
Output Format Enforcement
Hallucination Detection & Mitigation
Output Safety
Memory, Embeddings & Vector Database Security
11 guides
This chapter addresses securing the embeddings and vector stores that act as semi-persistent and persistent "memory" for AI systems through Retrieval-Augmented Generation (RAG).
Access Controls on Memory & RAG Indices
Embedding Sanitization & Validation
Orchestration & Agentic Security
37 guides
This chapter addresses ensuring autonomous and multi-agent systems execute only authorized, intended, and bounded actions.
Execution Budgets, Loop Control, and Circuit Breakers
High-Impact Action Approval and Irreversibility Controls
- Human approval before irreversible actions Level 1 9.2.1
- Show the full action in approval requests Level 2 9.2.2
- Classify how reversible each action is Level 2 9.2.3
- Enforce the reversibility rules Level 2 9.2.4
- Limit how the agent can change itself Level 2 9.2.5
- AI review of risky plans, on top of policy Level 2 9.2.6
- Protect the AI reviewer from injection Level 2 9.2.7
- Bind approvals to the exact action Level 3 9.2.8
- Keep approval keys away from the agent Level 3 9.2.9
- Approve chains at their riskiest step Level 3 9.2.10
- Re-approve if the agent goes beyond the plan Level 3 9.2.11
Component Isolation and Tool Authorization
- Sandbox every tool Level 1 9.3.1
- Check tool outputs against a schema Level 1 9.3.2
- Tools declare the access they need Level 2 9.3.3
- Enforce what tools declare Level 2 9.3.4
- Untrusted data can't call tools Level 2 9.3.5
- Separate untrusted tool output from the agent Level 2 9.3.6
- Allow-list what the agent installs or calls Level 2 9.3.7
- Contain tools that break policy Level 3 9.3.8
- Isolate agent-writable storage Level 2 9.3.9
Agent and Orchestrator Identity
Agent Authorization, Delegation, and Continuous Enforcement
- Fine-grained rules for tool use Level 2 9.5.1
- Pass the user's permissions down the chain Level 2 9.5.2
- Code decides access, never the model Level 2 9.5.3
- Keep secrets out of the model's context Level 2 9.5.4
- Rules for handing work between agents Level 2 9.5.5
- Re-check permissions in long sessions Level 3 9.5.6
- Delegated authority never grows Level 2 9.5.7
Shutdown and Graceful Degradation
Model Context Protocol (MCP) Security
39 guides
This chapter addresses secure discovery, authentication, authorization, transport, and use of MCP-based tool and resource integrations.
Component Integrity
Authentication & Authorization
- Check the token on every MCP request Level 1 10.2.1
- Validate MCP token claims Level 1 10.2.2
- MCP servers don't store tokens Level 1 10.2.3
- List only the tools a user may use Level 2 10.2.4
- Authorise every MCP tool call Level 2 10.2.5
- Accept only tokens issued for this server Level 1 10.2.7
- Protect request state from tampering Level 1 10.2.8
- Bind client credentials to their issuer Level 2 10.2.9
- Use one-time request state only once Level 2 10.2.10
Secure Transport
- Encrypted, authenticated transport for remote MCP Level 1 10.3.1
- Use stdio only locally Level 1 10.3.2
- Check Origin and Host headers Level 1 10.3.3
- No fallback to older MCP protocol versions Level 2 10.3.4
- Sender-constrained MCP tokens Level 3 10.3.5
- Check protocol version before trusting headers Level 2 10.3.6
Schema, Message, and Input Validation
- Validate MCP responses against their schema Level 1 10.4.1
- Screen MCP responses for prompt injection Level 1 10.4.2
- Reject unknown or oversized MCP parameters Level 1 10.4.3
- Strict schema validation on MCP servers Level 2 10.4.4
- Limit MCP payload size Level 2 10.4.5
- Sign MCP tool responses Level 2 10.4.6
- Ask before installing a local MCP server Level 2 10.4.7
- Re-approve tools when their definition changes Level 3 10.4.8
- Proxies don't share authorisation between clients Level 2 10.4.9
- Bind consent to the approved MCP endpoint Level 2 10.4.10
- Drop tools with invalid header annotations Level 1 10.4.11
- Reject headers that don't match the body Level 2 10.4.12
- Limit schema validation depth Level 2 10.4.13
- Don't fetch remote schema references Level 1 10.4.14
- Reject schemas with unresolved references Level 2 10.4.15
- Keep private cached responses private Level 2 10.4.16
- Mark user-specific results as private Level 2 10.4.17
- Don't collect secrets through elicitation Level 2 10.4.18
- Keep personal data out of elicitation URLs Level 1 10.4.19
- Ask before opening elicitation URLs Level 2 10.4.20
- Open elicitation pages out of the model's sight Level 2 10.4.21
Adversarial Robustness
19 guides
This chapter addresses keeping AI systems reliable and abuse-resistant when facing evasion, inference, extraction, or poisoning attacks.
Model Alignment, Safety, and Robustness Testing and Training
- Model is safety-trained Level 1 11.1.1
- Run an alignment test suite on every update Level 1 11.1.2
- Test against known adversarial attacks Level 1 11.1.3
- Harden the model against adversarial input Level 2 11.1.4
- Track harmful-content rate for regressions Level 3 11.1.5
- Report adversarial results alongside normal ones Level 2 11.1.6
Membership-Inference and Model-Inversion Mitigation
Model-Extraction Defense
Model Runtime Anomaly Detection
Monitoring, Logging & Anomaly Detection
21 guides
This chapter addresses real-time and forensic visibility into what the model and other AI components see, do, and return, so that AI-specific threats can be detected and triaged.
Request & Response Logging
Detection and Alerting
- Alert on jailbreak and injection attempts Level 1 12.2.1
- Spot unusual or probing behaviour Level 2 12.2.2
- Custom rules for AI attack patterns Level 2 12.2.3
- Include query details in extraction alerts Level 2 12.2.4
- Track token use per user and team Level 2 12.2.5
- Watch AI traffic for covert channels Level 3 12.2.6
Model, Data, and Performance Drift Detection
Proactive Security Behavior Monitoring
AI-Assisted Secure Coding (Appendix C)
69 guides
This appendix lists organizational controls for using AI coding tools safely. The range is baseline to advanced. Scope is coding, code review, and the rest of the SSDLC.
AI-Assisted Secure-Coding Workflow
AI Tool Qualification & Threat Modeling
Secure Prompt & Context Management
- No secrets in prompts Level 1 AC.3.1
- Strip sensitive data from context Level 1 AC.3.2
- Screen repository content for injection Level 1 AC.3.3
- System instructions beat repository content Level 1 AC.3.4
- Reject oversized repository input Level 2 AC.3.5
- Encrypt prompts and responses Level 3 AC.3.6
- Scan agent session records for credentials Level 2 AC.3.7
Validation of AI-Generated Code
Explainability & Traceability of Code Suggestions
Continuous Feedback, Adversarial Testing & Model Fine-Tuning
AI-Generated Infrastructure & Pipeline Artifacts
Autonomous Agent Change Control Constraints
AI Artifact Origin Validation for Deployment
Generation Audit Trail Completeness and Validation
AI Code-Review & Assistant Bot Hardening
- Review bots treat PR content as untrusted Level 1 AC.11.1
- Lock review bot prompts and policy Level 1 AC.11.2
- Review bots return structured output only Level 1 AC.11.3
- Sandbox review bots Level 2 AC.11.4
- A policy engine authorises bot actions Level 2 AC.11.5
- Log review bot activity and watch egress Level 2 AC.11.6
- Read-only mode for untrusted fork PRs Level 2 AC.11.7
- Keep attack-testing review bots Level 3 AC.11.8
CI/CD Pipeline Hardening Specific to AI Augmentation
- Never run fork code with write access or secrets Level 1 AC.12.1
- Don't leave credentials in untrusted workspaces Level 1 AC.12.2
- Approve secret-bearing jobs for forks Level 1 AC.12.3
- Ephemeral, isolated runners for AI tooling Level 2 AC.12.4
- Security review for workflow file changes Level 2 AC.12.5
- Stream pipeline logs to security monitoring Level 2 AC.12.6
- Treat artifacts from untrusted PRs as data Level 2 AC.12.7
- Re-check open PRs after a workflow fix Level 2 AC.12.8
Adversarial AI Detection in Inbound Contributions
- Flag unusual contribution patterns Level 1 AC.13.1
- Approve first-time contributors' PRs Level 1 AC.13.2
- Detect suspicious dependencies in PRs Level 2 AC.13.3
- Map detections to MITRE ATT&CK and ATLAS Level 2 AC.13.4
- Contain adversarial contributions automatically Level 3 AC.13.5
- Profile PRs for LLM-generated code Level 3 AC.13.6