Monitoring, Logging & Anomaly Detection · Request & Response Logging
Use a structured log format
Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.
OWASP AISVS v1.01, requirement 12.1.3
In plain English
Use one structured format for logging model calls across all teams and providers. It should include at least the model identifier, input and output token counts, the provider and the type of operation. A shared format is what makes it possible to query, alert and compare.
What good looks like
- Every team and service uses the same schema.
- The required fields are always present: model identifier, input tokens, output tokens, provider name and operation type.
- The schema is documented and versioned.
- Entries are machine-readable (for example JSON), never free text.
How teams usually do it
- Adopt the OpenTelemetry semantic conventions for generative AI (the gen_ai.* attributes), or base your own schema on them.
- Instrument through a shared library or gateway so teams get the schema without extra work.
- Validate log entries against the schema in CI or at ingestion.
Suggested evidence
- The schema.
- Sample entries from several services.
- A query that works across all of them.
Common mistakes
- Free-text log lines that cannot be queried.
- Field names that differ by provider, so each model needs its own dashboard.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.