AI-Assisted Secure Coding (Appendix C) · Generation Audit Trail Completeness and Validation
Reject unverifiable provenance before merge
Verify that artifacts with incomplete, inconsistent, or unverifiable origin and generation metadata are rejected before merge or deployment, and that the rejection event is logged so trends can be tracked. Rejection happens on the verifier side, against the attestation or proof model defined in SLSA and the verification criteria in ISO/IEC 42001.
OWASP AISVS v1.01, requirement AC.10.3
In plain English
Reject artifacts with incomplete, inconsistent or unverifiable provenance before merge or deployment, and log each rejection so trends can be tracked.
What good looks like
- Rejection happens in the verifier, before merge or deployment.
- Each rejection is logged.
- Rejection trends are reviewed.
How teams usually do it
- Verifier-side enforcement as described in SLSA.
Evidence an auditor would accept
- Rejection logs and trend reports.
Common mistakes
- Rejections nobody reviews, so the same gaps keep occurring.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.