How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Code decides access, never the model
Verify that all access control decisions are enforced by application logic or a policy engine, never by the AI model itself.
OWASP AISVS v1.01, requirement 9.5.3
In plain English
Access decisions must be made by code or a policy engine. The model can be talked into anything, so it never decides who may do what.
What good looks like
- No access check relies on the model's judgement.
- Authorisation happens in code before tools run.
- Prompts do not contain access rules the system relies on.
How teams usually do it
- Policy checks in the tool gateway and in downstream services.
Evidence an auditor would accept
- Code showing where access checks happen.
Common mistakes
- A system prompt that says "only show managers' salaries to HR" as the only control.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.