AI-Assisted Secure Coding (Appendix C) · Explainability & Traceability of Code Suggestions
Store AI records in tamper-evident storage
Verify that explainability reports, AI-event logs, and citation records are kept in tamper-evident storage (append-only, WORM, or an immutable log store) and are referenced during security reviews.
OWASP AISVS v1.01, requirement AC.5.3
In plain English
Keep AI event logs, explainability reports and citation records in storage where tampering would show, and use them in security reviews. Evidence that the audited system could have rewritten is worth little. This is a Level 3 control.
What good looks like
- The records are kept in append-only, write-once (WORM) or otherwise immutable storage.
- The AI tools and agents cannot modify or delete them.
- Security reviews and incident investigations refer to them.
- Retention periods are defined.
How teams usually do it
- Object storage with a retention lock, for example S3 Object Lock in compliance mode or Azure immutable blob storage.
- An immutable log or ledger service, or hash-chaining the records and publishing the chain head elsewhere.
- A security review checklist that includes pulling these records.
Suggested evidence
- Storage settings.
- A security review or incident report that used the records.
Common mistakes
- Logs on a server the AI tooling can also write to.
- Immutable storage that nobody ever reads.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.