Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Default-deny access to every AI resource
Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.
OWASP AISVS v1.01, requirement 5.2.1
In plain English
Every AI resource should refuse access by default and admit only the identities on an explicit list. That covers datasets, model endpoints, vector collections, embedding indexes and compute. Teams secure the model endpoint and forget the vector database, which often holds the most sensitive text in the system.
What good looks like
- Policies start from deny-all and grant access to named identities or roles.
- Vector stores and embedding indexes require authentication and are covered by the same rules as other data stores.
- No AI resource is reachable from the public internet unless it is meant to be.
- Access lists are reviewed on a schedule, and unused grants are removed.
How teams usually do it
- Cloud IAM and resource policies defined as code, with policy checks in the pipeline that reject wildcards.
- Network rules or private endpoints so resources are reachable only from the services that use them.
- Turning on authentication and role-based access in the vector database itself. Several ship with it switched off.
Suggested evidence
- Policy definitions for each resource type.
- The latest access review.
- A scan or test showing no unauthenticated access to vector stores or endpoints.
Common mistakes
- A vector database left open on the internal network because "only our services use it".
- Wildcard permissions granted during a launch and never removed.
- One shared API key for the vector store, used by every service and every developer.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.