Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Check tool outputs against a schema
Verify that tool outputs are validated against schemas.
OWASP AISVS v1.01, requirement 9.3.2
In plain English
Check what each tool returns against a schema before the agent uses it. Tool output is untrusted. It may come from a web page, another organisation's API or a compromised service, and it goes straight into the model's context.
What good looks like
- Each tool has an output schema with types, allowed values and size limits.
- Output that does not match is rejected. It is not passed on.
- Free-text fields are length-limited and treated as data (see 9.3.6).
- Rejections are logged.
How teams usually do it
- JSON Schema or typed-parser validation in the tool gateway, applied to every result.
- Size caps on results, with truncation flagged to the agent.
- For MCP tools, declaring and enforcing the output schema that the protocol supports.
Suggested evidence
- Schemas and validation code.
- A test with malformed and oversized output.
- Rejection logs.
Common mistakes
- Passing raw tool output straight into the prompt.
- A schema with one giant string field, which validates anything.
- Validating shape and ignoring size, so a tool can flood the context.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.