How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI Artifact Origin Validation for Deployment
Verify provenance before deployment
Verify that deployment pipelines check the presence, signature, and integrity of origin and generation metadata on AI-generated artifacts before promotion, using a trusted verifier (Sigstore/cosign, in-toto verification).
OWASP AISVS v1.01, requirement AC.9.2
In plain English
Deployment pipelines check that provenance is present, signed and intact before promoting an AI-generated artifact.
What good looks like
- A trusted verifier checks provenance before promotion.
- Missing or invalid provenance stops promotion.
- Verification is logged.
How teams usually do it
- Sigstore cosign or in-toto verification in deployment.
Evidence an auditor would accept
- Deployment configuration and verification logs.
Common mistakes
- Generating provenance that nothing ever checks.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.