Implementation guide
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Filter out data the user may not see
Verify that post-inference filtering mechanisms prevent responses from including data that the requester is not authorized to receive.
OWASP AISVS v1.01, requirement 5.2.4
In plain English
Check each answer before it leaves and remove anything the person asking is not allowed to see. Retrieval filters are the first line. This is the backstop for what they miss, such as data carried over from earlier in the conversation, from memory or from a tool.
What good looks like
- Responses are checked against the requester's permissions before delivery.
- Restricted data found in a response is removed, or the response is blocked.
- The check covers streamed responses.
- Blocks are logged and reviewed, because each one points to a gap further upstream.
How teams usually do it
- Track which sources fed each response and compare them with the user's permissions before sending.
- Pattern and classifier checks for data types the user's role should never receive, such as other customers' identifiers or payment data. Cloud DLP services and tools like Microsoft Presidio do this.
- Buffer streamed output in chunks so the check runs before text reaches the screen.
Suggested evidence
- Filter configuration and test cases.
- Log entries for blocked or redacted responses.
Common mistakes
- Assuming retrieval filters catch everything, when the model can repeat data from earlier turns, shared memory or tool results.
- Streaming tokens to the user and checking the response afterwards.
- Treating this filter as the main control. It is pattern-based and will miss things.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.