AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
Extra review for security-critical files
Verify that security-critical files require an elevated review threshold when AI generated or modified them: two-person review, security-team sign-off, or stricter. Security-critical files here include authentication, authorization, and cryptography code; IAM policy; CI/CD workflow definitions; deployment manifests; and sandbox or network policy artifacts.
OWASP AISVS v1.01, requirement AC.4.4
In plain English
When AI writes or changes security-critical files, require a higher level of review: two people, security team sign-off, or stricter. Those files are authentication, authorisation and cryptography code, IAM policy, CI/CD workflow definitions, deployment manifests and sandbox or network policy. A subtle mistake there has the widest effect.
What good looks like
- Security-critical paths are listed, covering every category in the requirement.
- Changes to them need the higher review level, enforced by tooling.
- The rule applies however the change was made, since AI involvement is not always declared.
- The path list is reviewed as the codebase changes.
How teams usually do it
- CODEOWNERS entries for the security-critical paths that require the security team, plus a two-approval rule on those paths.
- Including CI workflow directories, deployment manifests and policy-as-code folders in the list.
- Protecting the CODEOWNERS file itself.
Suggested evidence
- The CODEOWNERS file and branch protection rules.
- A sample change to a critical path with its approvals.
Common mistakes
- A list of critical paths that leaves out CI workflow files.
- Applying the rule only to PRs labelled as AI-generated.
- A security team so overloaded that sign-off becomes a formality.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.