How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI Artifact Origin Validation for Deployment
Sign provenance for AI-generated artifacts
Verify that AI-generated artifacts carry signed origin and generation metadata (in-toto or SLSA provenance attestations, AI BOM entries) identifying the AI system that produced them, the generation context, the humans involved, and the associated audit records.
OWASP AISVS v1.01, requirement AC.9.1
In plain English
Attach signed provenance to AI-generated artifacts, saying which AI system produced them, in what context, which people were involved and where the audit records are.
What good looks like
- Artifacts carry signed in-toto or SLSA provenance or AI BOM entries.
- The provenance names the AI system and the humans involved.
- Signing happens in the build pipeline.
How teams usually do it
- SLSA provenance generators extended with AI fields.
Evidence an auditor would accept
- Sample provenance for a build.
Common mistakes
- Provenance that names the build system but not the AI involvement.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.