How to meet it
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Keep authorisation decisions outside the agent
Verify that the policy decision point for agent authorization is isolated from the agent's execution environment.
OWASP AISVS v1.01, requirement 5.2.5
In plain English
The component that decides what an agent may do must run outside the agent, so a compromised or manipulated agent cannot change its own permissions.
What good looks like
- Authorisation decisions are made by a separate service or process.
- The agent cannot change policies or the policy engine's configuration.
- Every tool call is checked against that service.
How teams usually do it
- A policy engine such as Open Policy Agent or Cedar, running as its own service.
- Tool gateways that call the policy engine before executing.
Evidence an auditor would accept
- Architecture showing the policy engine's separation.
- Access rights showing the agent cannot write policies.
Common mistakes
- Authorisation checks written into the agent's own code, which the agent's environment can alter.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.