How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent and Orchestrator Identity
Protect saved agent state from tampering
Verify that agent state persisted between invocations is integrity-protected.
OWASP AISVS v1.01, requirement 9.4.4
In plain English
Protect any state an agent saves between runs from tampering, so it cannot be altered to change the agent's next run.
What good looks like
- Saved state is signed or stored with integrity checks.
- State is verified when loaded.
- Failures stop the run.
How teams usually do it
- Signing state with a service key and verifying on load.
Evidence an auditor would accept
- State handling code and tests.
Common mistakes
- Saving state to a location other systems can write to.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.