How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Autonomous Agent Change Control Constraints
Separate people or systems at each stage
Verify that separation of duties holds across the stages of an AI-generated change. Each stage (generation, review, approval, deployment) is performed by a distinct principal, whether human or system.
OWASP AISVS v1.01, requirement AC.8.4
In plain English
Each stage of an AI-generated change, generation, review, approval and deployment, must be carried out by a different person or system.
What good looks like
- Each stage has a distinct principal.
- Tooling enforces the separation.
- Exceptions are recorded.
How teams usually do it
- Separate identities per stage and checks in the pipeline.
Evidence an auditor would accept
- Pipeline design and identity mapping.
Common mistakes
- One service account that generates and deploys.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.