AI-Assisted Secure Coding (Appendix C) · Explainability & Traceability of Code Suggestions
Show the sources behind a suggestion
Verify that developers can pull up the citations (training snippets, retrieved documents, MCP tool outputs) that support a suggestion, and that the citation chain travels with the artifact.
OWASP AISVS v1.01, requirement AC.5.2
In plain English
Developers should be able to see what an AI suggestion was based on: matching training snippets, retrieved documents or MCP tool output. That record should stay with the change. It matters for licence compliance, and for tracing a bad suggestion back to a poisoned source. This is a Level 3 control.
What good looks like
- The tool can show the sources behind a suggestion, where it has them.
- Citation records are stored with the change, for example in PR metadata or the audit trail.
- A suggestion with no available sources is shown as such.
- Reviewers can see the citations.
How teams usually do it
- Tools with code-referencing or citation features, which flag suggestions that match public code and show the licence.
- Recording retrieved documents and tool outputs from the session log against the PR.
- Blocking or flagging suggestions that match public code under licences you cannot accept.
Suggested evidence
- A PR showing its stored citations.
- Tool settings for code referencing.
Common mistakes
- Assuming that no listed sources means the suggestion is original.
- Citations visible in the IDE at the time and stored nowhere.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.