howtosecure.ai
Implementation guide OWASP AISVS v1.01

Orchestration & Agentic Security · Component Isolation and Tool Authorization

Untrusted data can't call tools

AISVS 9.3.5 Level 2

Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.

OWASP AISVS v1.01, requirement 9.3.5

In plain English

Keep the component that reads untrusted content away from the component that can call tools. If one model both reads a poisoned email and has the power to send emails, an injected instruction can act. Separating the two removes that path.

What good looks like

  • Untrusted content is processed by a component with no tool-calling ability.
  • Only structured, validated results pass from that component to the one that calls tools.
  • The separation is built into the architecture and does not depend on prompt wording.
  • Tests with injected content show no unauthorised tool call results.

How teams usually do it

  • The dual-LLM pattern: a quarantined model with no tools reads untrusted content and returns values in a fixed schema, and a privileged planner that never sees the raw content decides what to do.
  • Stricter designs that track where data came from and restrict what tainted values may be used for. Google DeepMind's CaMeL is a published example.
  • At minimum, removing write-capable tools from any agent session that has read untrusted content.

Suggested evidence

  • An architecture diagram and data flow.
  • Tool permissions for each component.
  • Injection test results.

Common mistakes

  • One agent that reads the inbox and can also send mail.
  • Passing the quarantined model's free-text summary to the planner, which carries the injection across.
  • Relying on an injection classifier alone for an agent with powerful tools.

Related requirements

9.3.6 Separate untrusted tool output from the agent · 2.1.3 Screen inputs for prompt injection

Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.

Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.