AI-Assisted Secure Coding (Appendix C) · Generation Audit Trail Completeness and Validation
Check provenance is complete and consistent
Verify that origin and generation metadata is checked for completeness and consistency: no missing or ambiguous fields, values normalized to a single representation, and a signature chain that validates back to a trusted root.
OWASP AISVS v1.01, requirement AC.10.2
In plain English
Check provenance records for completeness and consistency. No field should be missing or ambiguous, each value should appear in one standard form, and the signature chain should validate back to a root you trust. Records can look complete and still disagree with each other, and those gaps hide tampering.
What good looks like
- Completeness and consistency are checked automatically.
- Values are normalised: one format for model names, versions, timestamps and identities.
- Cross-checks confirm the fields agree, for example that the commit named in the provenance is the commit that was built.
- The signature chain is validated to a trusted root.
How teams usually do it
- A validation step in the verification stage of the pipeline, with a schema and a set of cross-field rules.
- Controlled vocabularies or identifiers for models and tools, so "the same model" is always written the same way.
- Signature verification against a pinned trust root, with Sigstore or your own PKI.
Suggested evidence
- Validation configuration and rules.
- Results, including a record that failed a consistency check.
Common mistakes
- Checking that fields exist and not that they agree.
- Three spellings of the same model name, which makes queries miss records.
- Validating the signature and not the chain behind it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.