Purpose
Ensure model artifacts, inference images, tools, MCP servers, and third-party AI dependencies are authenticated, reviewed, and verifiable—applying SLSA-style integrity to the AI stack.
Engineering philosophy
An AI system is only as trustworthy as the artifacts it loads. Unsigned weights, unverified MCP hosts, and opaque tool catalogs are supply-chain defects, not product features.
Why it matters
Poisoned models, compromised MCP servers, and tampered tool plugins bypass application-layer controls and can exfiltrate data or execute attacker-chosen actions at scale.
Common failures
- Downloading open-weight models from unverified mirrors without checksum or signature verification
- MCP servers installed without source review or pinned versions
- No SBOM/MBOM for inference images and agent runtimes
- Fine-tuned adapters pulled from untrusted registries into production
Mandatory checks
Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.
Production model and container artifacts shall have verified provenance/integrity
- Artifact
- Digest/signature verification logs for last production deploy
- Pass condition
- 100% of production model/container pulls in the sample window verify against expected digest or signature; unverified pulls are blocked
MCP servers and high-impact tools shall be inventoried, version-pinned, and reviewed before production use
- Artifact
- MCP/tool inventory with version pins, owners, and review dates
- Pass condition
- 100% of production MCP servers and high-impact tools have pin + owner + review date ≤ 180 days; 0 unpinned “latest” entries in production
Dependency and image vulnerability scanning gates shall apply to AI runtimes
- Artifact
- Scanner config + CI gate reports for AI runtime images/deps
- Pass condition
- 100% of AI runtime image builds in the last 30 days ran vulnerability scan; critical CVEs (CVSS ≥ 9.0 or org policy equivalent) block promote unless waived with expiry ≤ 14 days
Admission controls shall block unsigned or unapproved AI artifacts
- Artifact
- Admission policy config + deny logs for unsigned/unapproved artifacts
- Pass condition
- PASS if admission is enforced in production deploy paths and the latest probe shows unsigned artifacts are blocked
Recommended checks
Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.
Signed model/container artifacts with verify-on-deploy (SLSA-aligned)
- Artifact
- Admission/verify-on-deploy policy for signed model and container artifacts + last deploy verification log
- Pass condition
- Last production model/container deploy shows signature verification success; unsigned artifact is rejected in a recorded test or canary within 90 days
Machine-readable model bill of materials (MBOM) for production models
- Artifact
- Machine-readable MBOM (or SBOM+model metadata) for each production model pin + retention location
- Pass condition
- 100% of production model pins have an MBOM/SBOM artifact retained ≥90 days and linked from the model registry entry
Evidence required
- Artifact signing/verification configuration
- MCP and tool inventory with review records
- Image/model scan reports for production releases
Severity & risk
- Severity
- critical
- Impact if violated
- Risk level
- high
- Typical residual risk (impact × likelihood)
Engineering best practices
- Prefer private registries for production models and adapters
- Treat MCP hosts as supply-chain surfaces equal to npm/PyPI packages
- Separate build and serving identities; never use developer credentials in prod pulls
- Record provenance in release evidence packs
Automatic validations
- CI verification of artifact digests against expected values
- Admission controller or gateway denials for unsigned artifacts
- SBOM generation and CVE gates on AI images
Manual validations
- Source review for new MCP servers and tool plugins
- Periodic audit of model download sources
Examples
- Inference pods only pull images signed by the org signing key
- An MCP catalog requires peer review and a pinned commit before agents can call it
References
Crosswalks
Secure & Resilient Secure and Resilient
NIST AI Risk Management Framework · aligns-with
Annex A AI system controls (selected themes)
ISO/IEC 42001 · partial
LLM03 Supply Chain
OWASP Top 10 for Large Language Model Applications · supports
CC9 Risk Mitigation
SOC 2 Trust Services Criteria · evidence-for
Security Security
AWS Well-Architected Framework · aligns-with
Level 1 Build process documented
SLSA (Supply-chain Levels for Software Artifacts) · partial
Level 2 Hosted build + signed provenance
SLSA (Supply-chain Levels for Software Artifacts) · aligns-with
Level 3 Hardened builds
SLSA (Supply-chain Levels for Software Artifacts) · partial
Provenance Artifact provenance
SLSA (Supply-chain Levels for Software Artifacts) · supports
Verify-on-deploy Verification before use
SLSA (Supply-chain Levels for Software Artifacts) · supports
Future evolution
Portable MBOM formats and cross-vendor attestation for hosted and self-hosted models.