Implementation guide
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Output Format Enforcement
Check outputs against a schema
Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.
OWASP AISVS v1.01, requirement 7.1.1
In plain English
Whenever software reads the model's output, check that output against a strict schema first and reject anything that does not fit. Treat model output like input from an untrusted user. It is usually well formed, and the exceptions are where injection and data-handling bugs get through.
What good looks like
- Every output that code consumes has a written schema: field names, types, allowed values and length limits.
- Output is validated before any other code uses it.
- Output that fails is rejected. The application retries or returns an error, and never tries to repair and use it.
- Fields that drive actions, such as a tool name or a status, are limited to a fixed list of values.
How teams usually do it
- The structured output or JSON Schema mode of your model API, which constrains the model to the schema.
- Your own validation on top, with a typed parser such as Pydantic or Zod, or a JSON Schema validator. Validate even when the provider enforces the schema: it guarantees shape, and you still need to check values.
- Constrained decoding libraries (for example Outlines or Guidance) for self-hosted models.
Suggested evidence
- The schemas and the validation code.
- Tests with malformed, oversized and unexpected-value output.
- Logs showing rejected outputs in production.
Common mistakes
- Using the provider's structured output mode and skipping your own checks.
- A schema that allows free-form strings in fields that later reach SQL, a shell or HTML.
- "Fixing" broken JSON with a lenient parser and carrying on.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.