[Theme] Traceability in a secure software development chain making use of AI Agent

Theme Name

The complete traceability of AI Agents involved in secure software development chain and their action, as well as the measurement of the reproducibility of their action is necessary to support security assessment and certification of the resulting software.

Proposer(s)

Alban FERAUD - IN Groupe - alban.feraud@ingroupe.com

Summary

Secure software development chain may more and more involve AI Agents to (1) update requirement(s), (2) update specification, (3) update software, (4) update test(s), (5) carry out tests, (6) update documentation and evidences etc.. following a request from an operator (e.g. using a prompt)
In order to ensure trust in the output software, a complete traceability of the AI Agent of their actions shall be ensured, spanning from the request from the operator (e.g. prompt) to the generated software. In addition in some cases where a high level of security is required, the reproducibility of outcome should be ascertained

Scope / Open Questions

As part of this theme, the following aspects could be further analysed:
• relevant factor to be recorded all along the secure software development chain to ensure traceability (prompt, AI Agent model, AI Agent version, connected tools model, connected tools version, etc…);
• assessment and measurement of the reproducibility of the output;
• Evidences to be recorded for traceability and security assessment purposes;

Related Work

To be identified

Related Themes

https://github.com/FG-TIDA/themes/issues/35 - Supply Chain (for the trecability aspect, not for the assessment and measurement of the reproducibility of the output)

To be identified

Discussion