OWASP's 2025 list for LLM applications includes misinformation and unbounded consumption alongside injection and output handling. (Source: OWASP GenAI Security Project, 2025-03-12 · verified 2026-09-21) The item most teams skip is the quiet one: LM-05, model or prompt change runs the regression set. Without it, a provider upgrade is an untested release.
What a golden set is
A fixed list of inputs, each with a recorded expectation about the output. Not the exact text, which changes run to run, but properties: contains these facts, does not contain these, stays under this length, returns valid JSON with these keys, refuses this request, calls this tool and not that one.
Sixty cases is a good start; the synthetic sample report shows a Growth team going from 60 to a planned 100. They come from real usage (anonymised), from the failure cases you already know about, and from the injection probes in LM-02.
The baseline
Run the set once on the current model and prompt. Record, per case, which properties held. That is the baseline. It is committed next to the set.
The diff
On every change to the model, the prompt, the temperature, the retrieval or the tools, run the set again and diff against the baseline. Cases that held and now fail are regressions and go in the verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it). Cases that failed and now hold are improvements and update the baseline after review.
The Veracode benchmark showed security behaviour varies by model and did not improve uniformly with newer releases. (Source: Veracode, 2025-11-18 · verified 2026-09-21; denominator: 80 coding tasks in the Veracode benchmark, best-performing model) Product behaviour varies the same way; the golden set (a fixed list of model inputs with recorded expectations, re-run on every model or prompt change) is how you measure it for your product instead of trusting the changelog.
The pass criterion
The golden set runs on the change, the diff is reviewed and signed before release, and regressions are listed in the verdict. Note what it does not say: it does not require zero regressions. Some are accepted, with the reason recorded. It requires that someone looked.
Where it runs
In CI (the pipeline that builds and tests every change before it can be merged or deployed), as a job triggered by changes to the prompt files, the model configuration or the tool definitions. Spend on the run is bounded by LM-01's cap. Output goes into the release record like any other item.
The LLM category has all six items. The adding an LLM feature page is the week-one sequence for a team shipping its first one.