AI-Assisted Secure Coding (Appendix C) · Compromise Containment & Automated Remediation
Trace affected artifacts during incidents
Verify that build provenance and AI BOM records are used during incident response to identify every downstream artifact produced under the suspect AI agent or the compromised pipeline run, so that recall, rebuild, or quarantine can be targeted.
OWASP AISVS v1.01, requirement AC.14.4
In plain English
During an incident, use build provenance and AI BOM records to find every artifact produced under the suspect agent or the compromised pipeline run. You can then recall, rebuild or quarantine exactly what is affected, without guessing or rebuilding everything.
What good looks like
- Provenance and AI BOM records can be searched by agent identity, model, pipeline run and time window.
- The search is a written step in the incident playbook.
- It has been rehearsed, and results come back in minutes.
- The results link to where each artifact is deployed.
How teams usually do it
- A searchable store of attestations and BOM records, for example the registry's attestation API, a transparency log index or a dedicated metadata store such as GUAC.
- Saved queries for the common questions: everything built by this run, everything touched by this agent since a given date.
Suggested evidence
- A worked example query and its results.
- The playbook step.
- A rehearsal record.
Common mistakes
- Provenance that is stored and cannot be searched quickly.
- Finding the artifacts and having no record of where they were deployed.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.