How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Validation of AI-Generated Code
A human reviews all AI-generated code
Verify that AI-generated code always goes through code review by a qualified human engineer. The reviewer must not be the same identity that asked for the AI generation in the first place (separation of duties). And the AI agent itself does not count as the human reviewer.
OWASP AISVS v1.01, requirement AC.4.1
In plain English
A qualified engineer must review all AI-generated code. The reviewer must be someone other than the person who asked the AI to write it, and the AI itself never counts as the reviewer.
What good looks like
- Branch protection requires human review.
- The requester cannot approve their own AI-generated change.
- AI reviewers' approvals do not count towards required approvals.
How teams usually do it
- Branch protection with required reviews and code owners, with bot approvals excluded.
Evidence an auditor would accept
- Branch protection settings.
Common mistakes
- Developers generating code and approving it themselves on a second account.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.