Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Fetch sensitive data, don't train it in
Verify that sensitive data is retrieved via retrieval pipelines (e.g., RAG queries, embedding lookups) to prevent permanent storage in models.
OWASP AISVS v1.01, requirement 5.2.3
In plain English
Keep sensitive data out of training and fine-tuning, and fetch it at answer time through retrieval. Data trained into a model cannot be deleted, cannot be permission-checked and may be repeated to anyone. Data fetched at answer time stays under your normal access controls.
What good looks like
- A written rule says which classes of data may never be used for training or fine-tuning.
- The assistant reaches sensitive data only through retrieval, with access checks (see 5.2.2).
- Deleting or restricting a source document removes it from future answers.
- Training sets are checked against the rule before each run.
How teams usually do it
- Retrieval-augmented generation over permission-aware stores for anything confidential or personal.
- A classification check in the training data pipeline that blocks restricted classes.
- Where fine-tuning on sensitive material is unavoidable, a model per tenant or per permission group, treated as being as sensitive as the data.
Suggested evidence
- The policy on what may be used for training.
- Training dataset reviews showing sensitive data was excluded.
- A test showing a deleted document no longer appears in answers.
Common mistakes
- Fine-tuning on support tickets or chat logs that contain customers' personal data.
- Fine-tuning one shared model on documents only some users may see.
- Forgetting that a retrieval cache or conversation memory can keep the data alive after the source is deleted.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.