How to meet it
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Output Format Enforcement
Limit how long outputs can run
Verify that model-generated output is bounded by length limits and termination controls.
OWASP AISVS v1.01, requirement 7.1.2
In plain English
Cap how long a response can be and make sure generation stops, so a runaway or manipulated model cannot produce endless output.
What good looks like
- A maximum output length is set for each use case.
- Stop conditions are defined.
- Truncated or stopped output is handled safely by the application.
How teams usually do it
- Max token settings on every model call.
- Timeouts on streaming responses.
Evidence an auditor would accept
- Model call configuration.
Common mistakes
- Leaving max tokens unset, which leaves cost and output length open.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.