How to meet it
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Source Attribution & Citation Integrity
Cite the source documents
Verify that responses generated using retrieval-augmented generation (RAG) include attribution to the source documents.
OWASP AISVS v1.01, requirement 7.4.1
In plain English
When answers come from searched documents, show which documents they came from.
What good looks like
- Every answer based on retrieval lists its sources.
- Sources link to the document or section.
- Users can tell when an answer has no source.
How teams usually do it
- Returning source identifiers with each retrieved chunk and displaying them.
Evidence an auditor would accept
- Screenshots or samples showing citations.
Common mistakes
- Showing sources only in debug mode.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.