Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Request & Response Logging
Log safety and policy decisions
Verify that safety filtering and policy decisions are logged with sufficient detail to support audit, debugging, and forensic analysis of content moderation systems.
OWASP AISVS v1.01, requirement 12.1.2
In plain English
Log every safety filter and policy decision in enough detail to audit it, debug it and investigate incidents. When a user asks why they were blocked, or an attacker gets through, the decision log is how you find out.
What good looks like
- Each decision records what was checked, by which filter and version, the category, the score, the threshold and the outcome.
- Allowed decisions are logged as well as blocks, at least as a sample.
- Each entry links to the request and session.
- Logs are kept for the period your policy sets, with access restricted.
How teams usually do it
- Structured logging from the filtering layer to the central log store.
- A reference to or hash of the checked content where storing the content itself would be too sensitive.
- Dashboards of block rates by category and filter version.
Suggested evidence
- Sample log entries for blocked and allowed content.
- A worked example: one blocked request traced from the user's report to the decision.
Common mistakes
- Logging "blocked" with no reason.
- Logging blocks only, so you can never study what the filter let through.
- Not recording the filter version, so behaviour changes cannot be explained.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.