Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Tools declare the access they need
Verify that tool manifests declare required privileges, resource limits, and output validation requirements.
OWASP AISVS v1.01, requirement 9.3.3
In plain English
Each tool should come with a manifest that states what access it needs, what resource limits apply and how its output is validated. A written declaration gives reviewers something to challenge and gives the runtime something to enforce.
What good looks like
- Every tool has a manifest.
- It lists required privileges (files, network destinations, credentials, scopes), resource limits and the output schema.
- Manifests are reviewed when a tool is added or changed.
- Requested access is the minimum for the tool's job, and a reviewer has checked that.
How teams usually do it
- A manifest file stored with the tool's code and reviewed in pull requests.
- A template with required fields, checked in CI.
- For third-party tools, a manifest you write yourselves at onboarding.
Suggested evidence
- Manifests for the current tools.
- A review record where requested access was challenged or reduced.
Common mistakes
- Manifests that ask for broad access because nobody pushed back.
- Manifests written once and not updated when the tool gains features.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.