Implementation guide
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · Authentication
Step-up sign-in for high-risk operations
Verify that high-risk AI operations (model deployment, weight export, training data access, production configuration changes) require step-up authentication.
OWASP AISVS v1.01, requirement 5.1.1
In plain English
Ask for a fresh, stronger proof of identity at the moment someone deploys a model, exports weights, reads training data or changes production AI settings. A stolen session or token should not be enough to do any of those. This is known as step-up authentication.
What good looks like
- The list of high-risk operations is written down and covers at least the four in the requirement.
- Each one needs multi-factor authentication performed at the time of the action. A sign-in from earlier in the day does not count.
- The rule applies to every route: console, command line and API.
- Step-up events are logged with who, what and when.
How teams usually do it
- Conditional access or authentication-context policies in the identity provider that force re-authentication for named actions. OpenID Connect supports this through the max_age and acr_values parameters, and RFC 9470 defines how an API can demand it.
- Phishing-resistant factors (FIDO2 security keys or passkeys) for the step-up.
- An approval step in the deployment pipeline that needs a hardware-key tap from an authorised person.
Suggested evidence
- Identity provider policies for the listed operations.
- Log entries showing step-up for recent deployments and exports.
- A test showing the action is refused without fresh authentication.
Common mistakes
- Accepting this morning's login for a weight export this afternoon.
- Protecting the console while the same action works through a long-lived API token with no step-up.
- Using SMS codes or push approvals, which phishing and push-fatigue attacks defeat.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.