How to meet it
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Source Attribution & Citation Integrity
Trace each claim to its source
Verify that claims in a RAG response can be traced to the retrieved chunk.
OWASP AISVS v1.01, requirement 7.4.3
In plain English
Make each claim in an answer traceable to the specific retrieved passage that supports it.
What good looks like
- Each claim links to the chunk that supports it.
- Unsupported claims are flagged.
- Users can view the supporting passage.
How teams usually do it
- Prompting for claim-level references and checking each against the cited chunk.
- Automated groundedness checks.
Evidence an auditor would accept
- Samples showing claim-level links.
- Groundedness check results.
Common mistakes
- Citing a 50-page document for a single sentence.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.