Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Access Controls on Memory & RAG Indices
Lock document metadata after writing
Verify that document metadata tags are immutable after the initial write.
OWASP AISVS v1.01, requirement 8.1.2
In plain English
The metadata on a stored document says who owns it, who may see it and where it came from. Retrieval and access control depend on it. Once written, it should not be changeable in place, or an attacker who can edit it can make restricted content public or pass off planted content as trusted.
What good looks like
- Metadata fields that carry ownership, permissions, source and classification cannot be updated after ingestion.
- A correction is made by writing a new version and retiring the old one.
- Only the ingestion service has write access to these fields.
- Attempts to change them are refused and logged.
How teams usually do it
- An ingestion service that is the sole writer to the vector store. Applications and agents get read-only credentials.
- Versioned records: re-ingest with a new ID and mark the old record superseded.
- A hash of the metadata stored with each record and checked at retrieval, where the database cannot enforce write-once itself.
Suggested evidence
- Store access rights showing who can write.
- The update procedure for corrections.
- A test showing an in-place metadata update is refused.
Common mistakes
- Letting the application or an agent update access metadata on existing vectors.
- An "upsert" API open to many services, which overwrites metadata without anyone noticing.
- Treating metadata as descriptive when it decides who sees what.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.