How to meet it
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Output Format Enforcement
Check outputs against a schema
Verify that the application validates all model outputs against a defined schema and rejects any output that does not match.
OWASP AISVS v1.01, requirement 7.1.1
In plain English
When software reads the model's output, check it against a strict schema and reject anything that does not fit.
What good looks like
- Every machine-read output has a defined schema.
- Outputs are validated before use.
- Invalid output is rejected, with a retry or error.
How teams usually do it
- Structured output features in your model API, plus validation with JSON Schema or a typed parser.
- Allow-listed values for fields that drive actions.
Evidence an auditor would accept
- Schemas and the validation code.
- Tests with malformed output.
Common mistakes
- Using the provider's structured output mode and skipping your own validation.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.