AI-Assisted Secure Coding (Appendix C) · AI Artifact Origin Validation for Deployment
Verify provenance before deployment
Verify that deployment pipelines check the presence, signature, and integrity of origin and generation metadata on AI-generated artifacts before promotion, using a trusted verifier (Sigstore/cosign, in-toto verification).
OWASP AISVS v1.01, requirement AC.9.2
In plain English
Before promoting an AI-generated artifact, the deployment pipeline should check that its provenance is present, properly signed and intact, using a trusted verifier. Provenance that nothing checks is paperwork. This is a Level 3 control.
What good looks like
- A trusted verifier checks presence, signature and integrity of the metadata before promotion.
- The check confirms the signer is an expected identity.
- Missing or invalid provenance stops the promotion.
- Verification results are logged.
How teams usually do it
- Sigstore cosign or in-toto verification in the deployment pipeline, with the expected signer identity and builder pinned in policy.
- A Kubernetes admission controller (for example Kyverno or the Sigstore policy controller) so the cluster refuses unverified images.
- The slsa-verifier tool or the platform's attestation verification command.
Suggested evidence
- Deployment configuration and policy.
- Verification logs.
- A test showing an artifact without provenance is refused.
Common mistakes
- Generating provenance that nothing checks.
- Verifying that a signature exists without checking who signed.
- Verification in a pipeline step that can be skipped by editing the workflow.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.