Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Isolate agent-writable storage
Verify that services reachable from agent or tool sandboxes enforce the defined run, task, or tenant isolation policy on agent-writable state, including object names.
OWASP AISVS v1.01, requirement 9.3.9
In plain English
Agents and tools write to storage buckets, queues, caches and scratch space. Those services must keep runs, tasks and tenants apart themselves, including in the names of objects created. If the agent chooses the path, it can choose someone else's.
What good looks like
- Every writable service checks which run, task or tenant a request belongs to, using a verified identity.
- Object names and paths are assigned or constrained by the service. Path traversal and crafted names cannot land in another run's space.
- The isolation policy (per run, per task or per tenant) is written down.
- Tests try to read, list and overwrite another run's data and fail.
How teams usually do it
- A per-run or per-tenant prefix enforced by storage policy and tied to the credential, for example IAM conditions on bucket prefixes.
- Short-lived credentials scoped to the run's own prefix or workspace.
- A fresh scratch volume per run, destroyed afterwards.
Suggested evidence
- Service policies.
- Cross-run and cross-tenant test results.
Common mistakes
- Letting the agent pick file paths in a shared bucket.
- Predictable object names, such as "output.json", that the next run reads without checking who wrote it.
- A shared temp directory across runs.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.