Implementation guide
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Carry data labels through to outputs
Verify that data classification labels propagate to downstream resources (embeddings, prompt caches, model outputs).
OWASP AISVS v1.01, requirement 5.2.7
In plain English
When data is labelled confidential, the label should follow it into everything made from it: embeddings, prompt caches and model outputs. Otherwise the controls downstream have no idea what they are holding and treat it all as public.
What good looks like
- Embeddings carry the classification of the document they came from.
- Prompt and response caches record the highest classification of anything involved.
- Outputs inherit the highest classification of their inputs, and logging, display and export rules use it.
- A classification change at the source reaches the derived data.
How teams usually do it
- A classification field in vector metadata, set from the source at ingestion.
- A "high-water mark" rule in the application: a response is classified at the level of the most sensitive source it used.
- Reading labels from the system that already holds them, such as Microsoft Purview sensitivity labels or your document management system.
Suggested evidence
- The metadata schema and ingestion code.
- Samples of embeddings, cache entries and outputs showing their labels.
- A downstream rule that acts on the label, such as a logging redaction.
Common mistakes
- Labelling source documents and treating their embeddings as unclassified. Text can often be reconstructed from embeddings.
- Caching a response built from confidential data and serving it to someone with lower clearance.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.