Implementation guide
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Output Safety
Block harmful responses
Verify that automated classifiers scan every response and block content that matches defined harmful content categories.
OWASP AISVS v1.01, requirement 7.3.1
In plain English
Scan every response with an automated classifier before it reaches the user, and block anything in your defined harmful-content categories. Input screening is not enough. A harmless-looking prompt can still produce a harmful answer.
What good looks like
- Every response is classified before delivery, including streamed responses and tool-generated text.
- Categories and thresholds are chosen for your audience and written down.
- Blocked responses are replaced with a neutral message and logged.
- If the classifier is unavailable, the response is held back.
How teams usually do it
- The content safety service from your provider or cloud, for example Azure AI Content Safety, Amazon Bedrock Guardrails or the OpenAI Moderation API.
- An open moderation model in your own stack, for example Llama Guard or ShieldGemma.
- For streaming, check the text in chunks before it is released, or hold the stream until the check passes.
Suggested evidence
- Classifier configuration and thresholds.
- Test results per category.
- Block rates and sampled reviews of blocked and passed responses.
Common mistakes
- Streaming output to the user before it has been checked.
- Relying on the model's own refusals as the only output control.
- Failing open when the moderation call times out.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.