Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Contain tools that break policy
Verify that policy violations trigger automatic containment of affected tools, such as stopping their execution, isolating them, or revoking their permissions.
OWASP AISVS v1.01, requirement 9.3.8
In plain English
When a tool breaks policy, contain it automatically: stop it, isolate it or take away its permissions. An alert that waits for a person leaves the tool running in the meantime. This is a Level 3 control.
What good looks like
- Defined policy violations trigger containment without waiting for a person.
- Containment covers stopping execution, isolating the tool and revoking its credentials.
- A person is alerted to investigate, and restoring the tool needs approval.
- The mechanism is tested.
How teams usually do it
- Monitoring rules that call the runtime to kill the tool's process, mark it disabled in the tool registry and revoke its tokens.
- Runtime security tooling (for example Falco or eBPF-based enforcement such as Tetragon) for sandbox-level violations.
- A circuit breaker in the gateway that disables a tool after repeated denials.
Suggested evidence
- Containment rules.
- A test record showing time from violation to containment.
- An incident or drill record including restoration approval.
Common mistakes
- Alerting only, with the tool still running.
- Stopping the process and leaving its credentials valid.
- Containment so jumpy it fires on normal errors and gets disabled.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.