Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Embedding Sanitization & Validation
Validate what agents write to memory
Verify that no component reachable from agent execution can write agent outputs or tool outputs to trusted agent memory without explicit source validation.
OWASP AISVS v1.01, requirement 8.2.3
In plain English
An agent's memory shapes what it does next. If an agent or tool can write whatever it has just read into trusted memory, one poisoned web page or email becomes a permanent instruction. Nothing should enter trusted memory without a check on where it came from.
What good looks like
- Every write to trusted memory passes through a validation step that the agent cannot bypass.
- Each memory entry records its source: user, tool, document or the agent's own output.
- Tool output and web content are stored as untrusted unless explicitly validated.
- When memory is read back, untrusted entries are presented to the model as data and never as instructions.
How teams usually do it
- A memory service with separate trusted and untrusted stores, where only the service can write to the trusted one.
- Validation rules for promotion to trusted memory: an approved source, an injection scan and, for important facts, user confirmation.
- Showing users what the assistant has remembered and letting them delete entries.
Suggested evidence
- The memory architecture and write-path code.
- Sample entries showing source tags.
- A test where injected content in a tool result fails to reach trusted memory.
Common mistakes
- Saving web page or email content straight into long-term memory.
- A "remember this" tool the model can call with any text and no checks.
- Recording the source and then ignoring it when the memory is loaded.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.