How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Untrusted data can't call tools
Verify that components processing untrusted data are isolated from tool-calling capabilities, ensuring that compromised data processing cannot trigger unauthorized tool invocations.
OWASP AISVS v1.01, requirement 9.3.5
In plain English
Keep the parts that read untrusted content away from the parts that can call tools, so a poisoned document cannot trigger tool calls.
What good looks like
- Untrusted content is processed by a component with no tool access.
- Only structured, validated results pass to the component that calls tools.
- The separation is in the architecture.
How teams usually do it
- A quarantined model that summarises untrusted content into a fixed schema for a privileged planner.
Evidence an auditor would accept
- Architecture diagram and data flow.
Common mistakes
- One agent that reads emails and can also send them.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.