Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Memory Expiry & Revocation
Expired content stays out of results
Verify that expired vectors are excluded from retrieval results.
OWASP AISVS v1.01, requirement 8.3.1
In plain English
Once a vector has passed its expiry date, it must stop appearing in search results. Stale and withdrawn content is a security issue as well as a quality one. Expired entries may hold revoked permissions, out-of-date policy or data you were obliged to delete.
What good looks like
- Vectors carry an expiry date or time-to-live where the content calls for one.
- Retrieval excludes expired items at query time, even before they are physically deleted.
- Expired items are deleted on a schedule.
- Deleting or expiring a source document removes its vectors too.
How teams usually do it
- An expiry field in the metadata and a mandatory filter in the retrieval service.
- Native time-to-live features where the vector store has them.
- A sync job that removes vectors when the source document is deleted or withdrawn.
Suggested evidence
- Configuration and the retrieval filter.
- A test showing an expired item is not returned.
- Logs from the clean-up job.
Common mistakes
- Deleting the source document and leaving its embeddings searchable.
- Relying on a clean-up job alone, so expired content is still served until the job next runs.
- Forgetting caches that hold results retrieved before expiry.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.