How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Generation Audit Trail Completeness and Validation
Record the required provenance fields
Verify that AI-generated artifacts carry the required origin and generation fields: model identity and version, tool or agent identity, generation context, prompt hash, human involvement, session identifiers, and correlation IDs.
OWASP AISVS v1.01, requirement AC.10.1
In plain English
AI-generated artifacts should carry the required provenance fields: model and version, tool or agent, generation context, prompt hash, human involvement, session IDs and correlation IDs.
What good looks like
- Required fields are defined.
- They are filled in automatically.
- Missing fields are detected.
How teams usually do it
- A metadata schema populated by the AI tooling and CI.
Evidence an auditor would accept
- The schema and sample records.
Common mistakes
- Relying on developers to fill in fields by hand.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.