Skip to content
GoSentrix

Glossary

AI-BOM

A bill of materials for AI-assisted software work, recording models, agents, prompts, tool calls, and generated changes.

Definition

An AI-BOM is a bill of materials for AI-assisted software work. It records models, agents, prompts, tool calls, and generated changes that influenced an artifact.

It gives reviewers and auditors provenance for code produced or modified through agentic workflows.

Why it matters

It gives reviewers and auditors provenance for code produced or modified through agentic workflows. Without an AI-BOM, reconstructing how AI-generated code was produced is impossible.

Example

An AI-BOM for a commit might record: model GPT-4o, agent GitHub Copilot, prompt context summary, tool calls to a MCP server, and the generated diff.

Related terms

  • AI-generated code governance — The set of controls that ensure AI-generated code is reviewable, attributable, and verified before release.
  • Agent-neutral governance — Security controls that evaluate evidence consistently regardless of which AI agent or tool produced the change.
  • Proof artifact — A record that can be independently examined to support or refute a claim about a software release.

See also