AI-Assisted Secure Coding (Appendix C) · AI-Generated Infrastructure & Pipeline Artifacts
Label AI-generated infrastructure files
Verify that AI-generated or AI-modified artifacts are clearly labeled and tracked as such. Artifact classes in scope include infrastructure-as-code (Terraform, CloudFormation, Pulumi, Bicep), CI/CD workflow files (GitHub Actions, GitLab CI, Jenkinsfile, Argo Workflows, Tekton), container and orchestration manifests (Dockerfile, Kubernetes, Helm), and security policy artifacts (IAM, OPA/Rego, NetworkPolicy, admission controllers).
OWASP AISVS v1.01, requirement AC.7.1
In plain English
Label and track infrastructure and pipeline files that AI generated or changed. The scope is infrastructure-as-code (Terraform, CloudFormation, Pulumi, Bicep), CI/CD workflow files, container and Kubernetes manifests, and security policy files such as IAM and network policy. A mistake in these reaches a whole environment at once.
What good looks like
- AI involvement is recorded for changes to these file types.
- The label is visible to reviewers in the pull request.
- The record survives later edits and can be queried.
- The file classes in scope are defined by path or pattern.
How teams usually do it
- Commit trailers or PR labels set automatically by the tool or by a bot that detects agent-authored commits.
- Path rules that flag PRs touching in-scope files for labelling.
- A report listing AI-attributed infrastructure changes over time.
Suggested evidence
- Sample PRs with labels.
- The path patterns in scope.
- A query result listing AI-attributed infrastructure changes.
Common mistakes
- Labelling application code and leaving infrastructure changes unlabelled.
- Depending on developers to remember to add the label.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.