howtosecure.ai
Implementation guide OWASP AISVS v1.01

AI-Assisted Secure Coding (Appendix C) · AI-Assisted Secure-Coding Workflow

Write down how AI coding tools may be used

AISVS AC.1.1 Level 1

Verify that a written workflow says when AI tools may generate, refactor, or review code. The workflow names the approved tools, the prohibited use cases, and the data classifications that are allowed as input.

OWASP AISVS v1.01, requirement AC.1.1

In plain English

Write down when developers may use AI tools to write, change or review code. Name the approved tools, say what they must not be used for, and say which classes of data may go into them. Without this, every developer makes up their own rules, and some paste customer data into a personal chatbot account.

What good looks like

  • Approved tools are listed by name, with the plan or tier (for example the enterprise plan with training on your data switched off).
  • Prohibited uses are stated in concrete terms.
  • The data classifications allowed as input are stated per tool.
  • The document has an owner and a review date, and developers can find it.

How teams usually do it

  • A short engineering policy page linked from onboarding and from repository READMEs.
  • Technical backing: managed IDE settings, an allow-list of assistant extensions, and network blocks on unapproved AI services.
  • A simple route for requesting a new tool, so people do not go round the policy.

Suggested evidence

  • The policy, with its review date.
  • Evidence developers have seen it, such as onboarding records.
  • The configuration that enforces the approved tool list.

Common mistakes

  • A policy so vague ("use AI responsibly") that nobody can tell whether they are following it.
  • Listing approved tools and saying nothing about what data can go into them.
  • Approving a product by name when the free and enterprise tiers handle your data very differently.

Related requirements

AC.1.2 Cover every development phase · AC.3.1 No secrets in prompts

Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.

Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.