How to meet it
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · AI Resource Authorization & Classification
Just-in-time access to model weights
Verify that privileged access to model weights, training pipelines, and production AI configuration is granted just in time, with a defined maximum session duration and automatic expiry. Zero Standing Privilege (ZSP) to these resources is encouraged.
OWASP AISVS v1.01, requirement 5.2.6
In plain English
Nobody should hold standing access to model weights, training pipelines or production AI settings. Grant access for a fixed time when it is needed, and let it expire on its own.
What good looks like
- Privileged access is requested, approved and time-limited.
- Sessions expire automatically.
- Access grants are logged and reviewed.
How teams usually do it
- Just-in-time access tools from your cloud provider or a privileged access management product.
Evidence an auditor would accept
- Access request records.
- The list of standing permissions, which should be close to empty.
Common mistakes
- Break-glass accounts that are used every week.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.