AI-Assisted Secure Coding (Appendix C) · Generation Audit Trail Completeness and Validation
Record the required provenance fields
Verify that AI-generated artifacts carry the required origin and generation fields: model identity and version, tool or agent identity, generation context, prompt hash, human involvement, session identifiers, and correlation IDs.
OWASP AISVS v1.01, requirement AC.10.1
In plain English
Every AI-generated artifact should carry a fixed set of origin fields: the model and its version, the tool or agent, the generation context, a hash of the prompt, the humans involved, session identifiers and correlation IDs. These are what make an audit trail usable. If one is missing, the chain breaks at that point.
What good looks like
- The required fields are defined in a schema.
- The tooling and pipeline fill them in automatically.
- A record with a missing field is detected.
- A prompt hash is stored in place of the prompt, so the metadata does not leak the prompt's content.
How teams usually do it
- A metadata schema populated by the AI tool (commit trailers, session export) and completed in CI.
- Carrying the fields in a standard container: an in-toto attestation predicate or AI BOM properties.
- A CI check that validates the record against the schema.
Suggested evidence
- The schema.
- Sample records with every field present.
- The validation step.
Common mistakes
- Relying on developers to fill in fields by hand.
- Recording "AI-assisted: yes" and none of the detail.
- Storing the full prompt text in metadata that is widely readable.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.