AI-Assisted Secure Coding (Appendix C) · AI-Generated Infrastructure & Pipeline Artifacts
Label AI-generated infrastructure files
Verify that AI-generated or AI-modified artifacts are clearly labeled and tracked as such. Artifact classes in scope include infrastructure-as-code (Terraform, CloudFormation, Pulumi, Bicep), CI/CD workflow files (GitHub Actions, GitLab CI, Jenkinsfile, Argo Workflows, Tekton), container and orchestration manifests (Dockerfile, Kubernetes, Helm), and security policy artifacts (IAM, OPA/Rego, NetworkPolicy, admission controllers).
OWASP AISVS v1.01, requirement AC.7.1
In plain English
Label and track AI-generated or AI-modified infrastructure files, such as Terraform, workflow files, Kubernetes manifests and IAM policies.
What good looks like
- AI involvement is recorded for these files.
- Labels are visible in PRs.
- Tracking survives later edits.
How teams usually do it
- PR labels and commit trailers set by the tool or the developer.
Evidence an auditor would accept
- Sample PRs with labels.
Common mistakes
- Labelling application code but not infrastructure changes.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.