Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Request & Response Logging
Log what retrieval returned
Verify that RAG pipeline retrieval events are logged, including the query, documents retrieved, and knowledge source.
OWASP AISVS v1.01, requirement 12.1.4
In plain English
Log each retrieval: the query, which documents came back and which knowledge source they came from. When an answer is wrong or leaks something, the first question is what the model was shown.
What good looks like
- Each retrieval event records the query, the IDs of the documents or chunks returned, their scores and the knowledge source.
- The event links to the model call that used the results.
- The user identity and the filters applied are recorded.
- Retrieval logs follow the same retention and access rules as other AI logs.
How teams usually do it
- Logging inside the retrieval service, using the shared schema from 12.1.3.
- One trace ID that follows the request through retrieval, generation and tool calls.
- Logging document IDs and versions, not full text, to limit duplication of sensitive content.
Suggested evidence
- Sample retrieval log entries.
- A trace that links one answer back to the chunks behind it.
Common mistakes
- Logging the answer and nothing about what it was based on.
- Logging document IDs without versions, so you cannot tell what the document said at the time.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.