Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Separate untrusted tool output from the agent
Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.
OWASP AISVS v1.01, requirement 9.3.6
In plain English
Treat what tools return as untrusted, and process it apart from the agent's own decision-making. Tool output is the main route for indirect prompt injection: the agent asks for a web page and receives instructions.
What good looks like
- Tool output is handled in a separate processing step before it reaches the agent's context.
- In context it is marked as untrusted data, with its source.
- It cannot change the agent's instructions, permissions or tool list.
- It is validated and screened (9.3.2 and 2.1.3) before use.
How teams usually do it
- A pipeline for tool results: schema validation, size limits, injection screening, then wrapping in labelled delimiters.
- Returning results in the tool-result role your model API provides, never in the system or user role.
- A separate, tool-less model to extract the needed fields from large or risky outputs (see 9.3.5).
Suggested evidence
- A design showing how tool output is handled.
- Prompt assembly code.
- Tests with injected instructions in tool results.
Common mistakes
- Appending tool output to the prompt as though it were trusted text.
- Putting retrieved content into the system prompt.
- Tool descriptions and error messages treated as trusted when they come from third parties too.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.