How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI-Generated Infrastructure & Pipeline Artifacts
Policy-check AI infrastructure changes
Verify that AI-generated infrastructure and workflow changes pass policy-as-code enforcement (OPA, Conftest, Checkov, tfsec, KICS, kube-linter) at the same level as, or stricter than, human-authored changes. Policy violations block promotion.
OWASP AISVS v1.01, requirement AC.7.3
In plain English
Run policy-as-code checks on AI-generated infrastructure and workflow changes at least as strictly as on human changes, and block promotion on violations.
What good looks like
- Policy checks run on every such change.
- Violations block promotion.
- Rules are the same or stricter for AI changes.
How teams usually do it
- Tools such as OPA, Conftest, Checkov, tfsec, KICS or kube-linter in CI.
Evidence an auditor would accept
- CI configuration and a blocked example.
Common mistakes
- Policy checks set to warn only.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.