How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI-Assisted Secure-Coding Workflow
Write down how AI coding tools may be used
Verify that a written workflow says when AI tools may generate, refactor, or review code. The workflow names the approved tools, the prohibited use cases, and the data classifications that are allowed as input.
OWASP AISVS v1.01, requirement AC.1.1
In plain English
Write down when developers may use AI tools to write, change or review code: which tools are approved, what they must not be used for, and which data may be put into them.
What good looks like
- Approved tools are listed by name and version or plan.
- Prohibited uses are stated, for example generating cryptographic code without review.
- Allowed data classifications for prompts are stated.
How teams usually do it
- A short engineering policy page linked from onboarding and the repository README.
- Technical controls, such as blocking unapproved assistant extensions, to back it up.
Evidence an auditor would accept
- The policy, with its review date.
- Evidence developers have seen it, such as onboarding records.
Common mistakes
- A policy so vague ("use AI responsibly") that nobody can tell if they are following it.
- Listing approved tools but saying nothing about what data can go into them.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.