How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Explainability & Traceability of Code Suggestions
Log prompts and responses for replay
Verify that prompt-and-response pairs are logged with stable correlation identifiers, so that an investigator can later replay the whole chain: prompt → response → commit → build → deployment.
OWASP AISVS v1.01, requirement AC.5.1
In plain English
Log prompts and responses with IDs that link them to the commit, build and deployment, so an investigator can follow the chain from prompt to production.
What good looks like
- Prompt and response pairs are logged with stable IDs.
- Commits reference those IDs.
- The chain to build and deployment can be followed.
How teams usually do it
- Commit trailers with the session ID, joined with CI and deployment records.
Evidence an auditor would accept
- A worked example tracing one change.
Common mistakes
- Logs that exist but cannot be matched to commits.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.