How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI Artifact Origin Validation for Deployment
Reject artifacts with missing provenance
Verify that artifacts are rejected at deployment and quarantined for review when they are missing required origin and generation information, signed by untrusted keys, or produced by an unapproved AI system or environment.
OWASP AISVS v1.01, requirement AC.9.3
In plain English
Reject and quarantine artifacts at deployment when provenance is missing, signed by an untrusted key or produced by an unapproved AI system.
What good looks like
- Each failure case leads to rejection.
- Rejected artifacts are quarantined for review.
- Approved AI systems and keys are listed.
How teams usually do it
- Admission policies in your deployment platform.
Evidence an auditor would accept
- Policy configuration and a rejected example.
Common mistakes
- Logging a warning and deploying anyway.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.