Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Code decides access, never the model
Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.
OWASP AISVS v1.01, requirement 9.5.3
In plain English
Access decisions must be made by code or a policy engine, never by the model. A model can be persuaded, confused or tricked. Whatever it is told to protect, someone will find a way to talk it out of.
What good looks like
- No access check depends on the model's judgement or on instructions in a prompt.
- Authorisation happens in code before data is fetched or a tool runs.
- The model never receives data the current user may not see, so it has nothing to withhold.
- Identity comes from the authenticated session. Claims made in the conversation carry no weight.
How teams usually do it
- Policy checks in the tool gateway and in the downstream services.
- Retrieval filtered by the user's permissions before anything reaches the prompt (see 5.2.2).
- A review of the system prompt for sentences that sound like access rules. Each one should be backed by a control in code.
Suggested evidence
- Code showing where access checks happen.
- Tests where the user claims to be an administrator in chat and gains nothing.
Common mistakes
- A system prompt saying "only show salaries to HR" as the only control.
- Fetching everything and asking the model to filter.
- Letting the model state the user's role when it calls a tool.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.