Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Enforce what tools declare
Verify that the runtime enforces the privileges, resource limits, and output-validation requirements declared in tool manifests.
OWASP AISVS v1.01, requirement 9.3.4
In plain English
The runtime must enforce what each tool's manifest declares. A tool then cannot use more access or resources than it asked for, and a manifest is more than documentation.
What good looks like
- The runtime grants the permissions in the manifest and nothing more.
- Resource limits from the manifest are applied to every call.
- The declared output validation runs on every result.
- A tool that tries to exceed its manifest is stopped and the attempt logged.
How teams usually do it
- Deployment tooling that generates sandbox settings, IAM roles and network policy straight from the manifest.
- A CI check that fails if deployed permissions differ from the manifest.
- Gateway enforcement of the output schema named in the manifest.
Suggested evidence
- Generated policies next to the manifests they came from.
- Tests where a tool tries an undeclared network call or file access and is blocked.
Common mistakes
- Manifests that nothing enforces.
- Hand-written runtime policies that drift from the manifest.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.