How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Explainability & Traceability of Code Suggestions
Show the sources behind a suggestion
Verify that developers can pull up the citations (training snippets, retrieved documents, MCP tool outputs) that support a suggestion, and that the citation chain travels with the artifact.
OWASP AISVS v1.01, requirement AC.5.2
In plain English
Let developers see what a suggestion was based on, such as training snippets, retrieved documents or tool output, and keep that record with the change.
What good looks like
- Tools show sources for suggestions where available.
- Source records are stored with the change.
- Missing sources are visible.
How teams usually do it
- Tools with citation features, plus storing citations in PR metadata.
Evidence an auditor would accept
- A PR showing stored citations.
Common mistakes
- Assuming no sources means the suggestion is original.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.