Implementation guide
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Keep authorisation decisions outside the agent
Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.
OWASP AISVS v1.01, requirement 5.2.5
In plain English
The component that decides what an agent may do has to run outside the agent. If the check lives in the agent's own process or prompt, an attacker who manipulates the agent can talk it out of the check or rewrite it.
What good looks like
- Authorisation decisions are made by a separate service or process that the agent cannot modify.
- The agent has no write access to policies or to the policy engine's configuration.
- Every tool call passes through an enforcement point that asks that service before running.
- Decisions use verified identity and request details. Text the model produced about its own permissions is ignored.
How teams usually do it
- A policy engine such as Open Policy Agent or Cedar (for example through Amazon Verified Permissions), run as its own service.
- A tool gateway or proxy between the agent and its tools that calls the policy engine on each request.
- Policies in version control, changed by review, deployed by a pipeline the agent has no credentials for.
Suggested evidence
- An architecture diagram showing the policy engine apart from the agent runtime.
- Access rights showing the agent identity cannot write policies.
- Decision logs from the policy engine.
Common mistakes
- Authorisation checks written into the agent's own code or system prompt.
- A policy file sitting on a disk the agent's code-execution tool can write to.
- Letting the agent pass its own role or tenant as a parameter.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.