AI-Assisted Secure Coding (Appendix C) · AI-Generated Infrastructure & Pipeline Artifacts
Detect drift from signed baselines
Verify that drift detection compares deployed infrastructure and live workflow configurations against signed, AI-attributed baselines, and alerts on any unauthorized modification.
OWASP AISVS v1.01, requirement AC.7.5
In plain English
Compare what is deployed and what your pipelines are configured to do against signed baselines that record AI involvement, and alert on any change nobody authorised. Review protects the route through the repository. Drift detection catches changes that went round it. This is a Level 3 control.
What good looks like
- Baselines for infrastructure and workflow configuration are signed and include AI attribution.
- Drift detection runs on a schedule against live infrastructure and live pipeline settings.
- Unauthorised drift raises an alert that someone investigates.
- The baseline is updated only through the approved change process.
How teams usually do it
- Infrastructure drift detection (for example scheduled terraform plan, driftctl-style tools or cloud configuration services).
- Regular audits of repository and pipeline settings through the platform API, compared with a signed, stored copy.
- Signing baselines with the same tooling used for release artifacts.
Suggested evidence
- Signed baselines.
- Drift reports.
- An investigated drift alert.
Common mistakes
- Drift detection that covers cloud resources and ignores CI/CD settings.
- Re-baselining automatically after drift, which approves whatever happened.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.