How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Component Isolation and Tool Authorization
Contain tools that break policy
Verify that policy violations trigger automatic containment of affected tools, such as stopping their execution, isolating them, or revoking their permissions.
OWASP AISVS v1.01, requirement 9.3.8
In plain English
When a tool breaks policy, contain it automatically: stop it, isolate it or remove its permissions.
What good looks like
- Policy violations trigger automatic containment.
- Containment is fast and does not wait for a person.
- Someone is alerted to review.
How teams usually do it
- Monitoring rules that call the runtime to stop the tool and revoke its credentials.
Evidence an auditor would accept
- Containment rules and a test record.
Common mistakes
- Alerting only, with the tool still running.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.