AI-Assisted Secure Coding (Appendix C) · Explainability & Traceability of Code Suggestions
Log prompts and responses for replay
Verify that prompt-and-response pairs are logged with stable correlation identifiers, so that an investigator can later replay the whole chain: prompt → response → commit → build → deployment.
OWASP AISVS v1.01, requirement AC.5.1
In plain English
Log each prompt and response with a stable identifier, and carry that identifier through to the commit, the build and the deployment. When something goes wrong in production, an investigator can then walk the chain back to the prompt that started it.
What good looks like
- Prompt-and-response pairs are logged with stable correlation IDs.
- Commits made from an AI session carry the session or request ID.
- Build and deployment records link to the commit, so the whole chain can be followed.
- Someone has traced a real change end to end to prove that it works.
How teams usually do it
- Commit trailers that record the tool and session ID, added automatically by the assistant or a commit hook.
- Central collection of AI session logs through the vendor's audit log API or your own gateway.
- Build provenance (see AC.9.1) that links build and deployment to the commit.
Suggested evidence
- A worked example tracing one change from prompt to deployment.
- Logging configuration and a sample commit with its trailer.
Common mistakes
- Logs that exist and cannot be matched to commits.
- Session logs kept only on developers' laptops.
- IDs that change when a session is resumed.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.