Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent and Orchestrator Identity
Protect saved agent state from tampering
Verify that agent state persisted between invocations is integrity-protected.
OWASP AISVS v1.01, requirement 9.4.4
In plain English
Agents often save state between runs: plans, checkpoints, conversation history. Protect that state from tampering. Anyone who can edit it can change what the agent does next without touching the agent. This is a Level 3 control.
What good looks like
- Saved state is signed or stored with an integrity check.
- The state is verified when loaded, before the agent uses it.
- A failed check stops the run and raises an alert.
- Only the agent runtime can write to the state store.
How teams usually do it
- Sign or HMAC the serialised state with a key held by the runtime service, outside the model's reach, and verify on load.
- Use a safe serialisation format such as JSON. Never unpickle saved state.
- Storage with versioning and narrow write permissions.
Suggested evidence
- State handling code.
- A test showing altered state is rejected.
- Access policy on the state store.
Common mistakes
- Saving state where other systems or users can write.
- Checkpoints stored as pickle files, which adds code execution to the tampering risk.
- Verifying integrity and ignoring replay of an old, valid state.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.