Implementation guide
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Source Attribution & Citation Integrity
Cite the source documents
Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.
OWASP AISVS v1.01, requirement 7.4.1
In plain English
When an answer is built from retrieved documents, show which documents it came from. People can then check the answer, and you can trace a bad answer back to the content that caused it.
What good looks like
- Every answer that used retrieval lists its sources.
- Each source links to the document, and where possible to the section.
- The user can tell when an answer has no supporting source.
- Sources shown are ones the user is allowed to open.
How teams usually do it
- Return a source identifier, title and location with each retrieved chunk, and display them with the answer.
- Use the citation features of your model API where available, which tie passages of the answer to the documents supplied.
- Keep the same source list in the logs for each response.
Suggested evidence
- Sample responses or screenshots showing citations.
- The response format definition, including the source fields.
- Logs linking responses to retrieved chunk IDs.
Common mistakes
- Showing sources only in debug mode.
- Listing every retrieved document, including those the answer did not use.
- Citing documents the user has no permission to open.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.