AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
A policy engine authorises bot actions
Verify that any privileged action a bot can take (approving a PR, merging, labeling, dismissing reviews, posting comments outside its sandbox, invoking external tools) goes through a separate, audited authorization path. That path is adjudicated by a policy engine, not by the LLM.
OWASP AISVS v1.01, requirement AC.11.5
In plain English
Any privileged action a bot can take should go through a separate, audited authorisation path, and a policy engine should make the decision. Privileged actions include approving a PR, merging, labelling, dismissing reviews, commenting outside its sandbox and calling external tools. The language model proposes. Code decides.
What good looks like
- Privileged actions are routed through an authorisation service, and the bot does not perform them directly.
- A policy engine decides, using rules the model cannot influence.
- The bot's own token cannot perform the privileged actions.
- Every decision is logged.
How teams usually do it
- A small service between the bot and the repository API that receives structured action requests and applies policy (for example Open Policy Agent or Cedar) before acting with its own credential.
- Rules that take account of context: who opened the PR, whether it is from a fork, which paths it touches.
- Remembering that labels can trigger workflows, so labelling counts as privileged.
Suggested evidence
- Policy rules.
- Decision logs.
- Token permissions showing the bot cannot act directly.
Common mistakes
- Giving the bot's token write access and trusting the model to behave.
- Putting the authorisation rules in the system prompt.
- Forgetting labels and comments that trigger other automation.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.