Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Access Controls on Memory & RAG Indices
Scope every retrieval
Verify that retrieval operations enforce scope constraints.
OWASP AISVS v1.01, requirement 8.1.3
In plain English
Every search of a vector store or memory should be limited to what is in scope for that user, tenant and task. The limit has to be applied by code on every query. An instruction in the prompt does not count.
What good looks like
- A scope filter (tenant, user or group, and where relevant the task or data domain) is applied to every query.
- A query with a missing or empty scope value fails. It does not fall back to searching everything.
- The filter is added by a service the agent and application cannot bypass.
- Tests confirm queries cannot reach out-of-scope data, including through unusual query paths.
How teams usually do it
- A retrieval service that wraps the vector store and injects mandatory metadata filters from the authenticated request.
- Row-level security or per-tenant namespaces in the database as a second layer.
- For agents, scoping retrieval to the collections the current task needs.
Suggested evidence
- Retrieval code showing the filter and the fail-closed behaviour.
- Test results for out-of-scope queries.
- Query logs showing the scope applied.
Common mistakes
- A code path that drops the filter when the scope value is empty.
- Letting the model choose which collection or filter to use through a tool parameter.
- An admin or debug endpoint that searches without any scope.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.