How to meet it
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Default-deny access to every AI resource
Verify that every AI resource (datasets, endpoints, vector collections, embedding indices, compute instances) enforces access controls with explicit allow-lists and default-deny policies.
OWASP AISVS v1.01, requirement 5.2.1
In plain English
Every AI resource, including datasets, model endpoints, vector collections and compute, should deny access by default and allow only the identities on an explicit list.
What good looks like
- Policies start from deny-all and grant named identities.
- Vector stores and embedding indexes are covered, which teams often forget.
- Access lists are reviewed regularly.
How teams usually do it
- Cloud IAM policies and resource policies, defined in infrastructure as code.
- Network rules so endpoints are reachable only from known services.
Evidence an auditor would accept
- Policy definitions for each resource type.
- The latest access review.
Common mistakes
- A vector database left open on an internal network because "only our services use it".
- Wildcard permissions granted during a launch and never removed.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.