How to meet it
OWASP AISVS v1.01
Access Control & Identity for AI Components & Users · Multi-Tenant Isolation
Tenants can't affect each other's models
Verify that shared model serving infrastructure prevents one tenant's fine-tuning, inference, or embedding operations from influencing or observing another tenant's operations.
OWASP AISVS v1.01, requirement 5.3.1
In plain English
If several customers share your model serving, one customer's fine-tuning, prompts or embeddings must not affect or reveal anything about another's.
What good looks like
- Fine-tunes, caches and vector data are separated per tenant.
- Requests carry a tenant identity that every layer enforces.
- Tests try to read or influence other tenants.
How teams usually do it
- Tenant identifiers enforced in storage keys, caches and indexes.
- Separate adapters per tenant with no shared writable state.
Evidence an auditor would accept
- Isolation design and cross-tenant test results.
Common mistakes
- A shared prompt cache keyed only on prompt text, which can return one tenant's response to another.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.