How to meet it
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Re-check permissions in long sessions
Verify that long-running agent sessions re-evaluate current backend authorization policy on every privileged action.
OWASP AISVS v1.01, requirement 9.5.6
In plain English
In long-running agent sessions, check current permissions again before every privileged action, since access may have been removed since the session started.
What good looks like
- Privileged actions trigger a fresh authorisation check.
- Revoked access takes effect within the session.
- Checks use the backend's current policy.
How teams usually do it
- Calling the policy engine on each privileged action, with no caching of decisions.
Evidence an auditor would accept
- Test where access is removed mid-session.
Common mistakes
- Checking permissions once at session start.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.