AI-Assisted Secure Coding (Appendix C) · AI-Assisted Secure-Coding Workflow
Cover every development phase
Verify that the workflow covers every SSDLC phase from design and implementation through code review, testing, deployment, and post-deployment monitoring, and names the security gates that stay mandatory whether AI was involved or not.
OWASP AISVS v1.01, requirement AC.1.2
In plain English
Your AI workflow should cover every stage of development: design, coding, review, testing, deployment and monitoring after release. It should also name the security checks that stay mandatory at each stage, whether or not AI was involved. AI speeds up writing code. It does not make any of the checks unnecessary.
What good looks like
- The workflow says how AI may be used at each stage from design to post-deployment monitoring.
- The mandatory security gates are named for each stage, for example threat modelling, human code review, security scanning and release approval.
- The document states that AI involvement never removes or weakens a gate.
- The gates are enforced by tooling where possible.
How teams usually do it
- Add an AI section to each stage of your existing secure development lifecycle documents. A separate AI policy tends to drift from the main one.
- Map the workflow to a recognised baseline, such as the NIST Secure Software Development Framework and its generative AI profile (SP 800-218A).
- Enforce the gates through branch protection and pipeline checks.
Suggested evidence
- The updated lifecycle document.
- Branch protection and pipeline settings showing the gates apply to all changes.
Common mistakes
- Treating AI-written code as quicker to merge because "the AI already checked it".
- Covering coding and review and ignoring design, deployment and monitoring.
- Gates that exist on paper and can be skipped by anyone with admin rights.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.