--- a/lxd/devlxd_instances.go
+++ b/lxd/devlxd_instances.go
@@ -14,7 +14,7 @@ import (
    "github.com/canonical/lxd/shared/entity"
 )

-type devLXDDeviceAccessValidator func(device map[string]string) bool
+type devLXDDeviceAccessValidator func(device map[string]string) error

@@ -136,7 +137,8 @@ func devLXDInstancePatchHandler(d *Daemon, r *http.Request) response.Response {

    // Evaluate instance device changes and derive instance configuration with appropriate device ownership.
    deviceChecker := newDevLXDDeviceAccessValidator(inst)
-   devices, config, err := generateDevLXDInstanceDevices(targetInst, reqInst, requestor.Username, deviceChecker)
+   deviceResourceOwnershipChecker := newDevLXDDeviceResourceOwnershipValidator(r.Context(), d, projectName)
+   devices, config, err := generateDevLXDInstanceDevices(targetInst, reqInst, requestor.Username, deviceChecker, deviceResourceOwnershipChecker)
    if err != nil {
        return response.DevLXDErrorResponse(err)
    }
@@ -175,12 +177,17 @@ func devLXDInstancePatchHandler(d *Daemon, r *http.Request) response.Response {
-func generateDevLXDInstanceDevices(inst api.Instance, req api.DevLXDInstancePut, identityID string, isDeviceAccessible devLXDDeviceAccessValidator) (devices map[string]map[string]string, config map[string]string, err error) {
+func generateDevLXDInstanceDevices(inst api.Instance, req api.DevLXDInstancePut, identityID string, isDeviceAccessible devLXDDeviceAccessValidator, isDeviceResourceOwned devLXDDeviceAccessValidator) (devices map[string]map[string]string, config map[string]string, err error) {
+   if isDeviceAccessible == nil {
+       return nil, nil, api.StatusErrorf(http.StatusInternalServerError, "Missing device access validator")
+   }
+   if isDeviceResourceOwned == nil {
+       return nil, nil, api.StatusErrorf(http.StatusInternalServerError, "Missing device resource ownership validator")
+   }
...
+           // Ensure the resource the device references is owned by devLXD identity.
+           err = isDeviceResourceOwned(device)
+           if err != nil {
+               return nil, nil, err
+           }
...
+// newDevLXDDeviceResourceOwnershipValidator returns a device validator function that checks
+// whether the resource backing a device is owned by the devLXD identity making the request.
+func newDevLXDDeviceResourceOwnershipValidator(ctx context.Context, d *Daemon, projectName string) devLXDDeviceAccessValidator {
+   return func(device map[string]string) error {
+       poolName := device["pool"]
+       volName := device["source"]
+
+       if poolName == "" || volName == "" {
+           return api.StatusErrorf(http.StatusBadRequest, "Invalid device configuration: Missing pool or volume name")
+       }
+
+       url := api.NewURL().Path("1.0", "storage-pools", poolName, "volumes", "custom", volName).Project(projectName)
+       req, err := lxd.NewRequestWithContext(ctx, http.MethodGet, url.String(), nil, "")
+       if err != nil {
+           return api.StatusErrorf(http.StatusInternalServerError, "Failed creating request: %w", err)
+       }
+
+       req.SetPathValue("type", "custom")
+       req.SetPathValue("poolName", poolName)
+       req.SetPathValue("volumeName", volName)
+
+       err = addStoragePoolVolumeDetailsToRequestContext(d.State(), req)
+       if err != nil {
+           return err
+       }
+
+       // Retrieve volume to ensure the volume exists and is owned by the devLXD identity.
+       _, _, err = devLXDStoragePoolVolumeGet(req.Context(), d, "", projectName, poolName, volName, "custom")
+       if err != nil {
+           return err
+       }
+
+       return nil
+   }
+}