How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Separate untrusted tool output from the agent
Verify that there is architectural separation between processing of untrusted tool outputs and agent operations.
OWASP AISVS v1.01, requirement 9.3.6
In plain English
Treat tool output as untrusted and process it separately from the agent's decision-making.
What good looks like
- Tool output is marked as untrusted data in the agent's context.
- It cannot change the agent's instructions or permissions.
- It passes through validation before use.
How teams usually do it
- Separate processing steps for tool output, with delimiting and validation.
Evidence an auditor would accept
- Design showing how tool output is handled.
Common mistakes
- Appending tool output to the prompt as if it were trusted text.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.