Resource
An AI-BOM is an AI bill of materials: a structured record of the models, training data, prompts, agents, tools, and generated artifacts that contribute to a software system. It makes AI provenance reviewable so release decisions can be explained and defended.
| Element | Why it matters | Evidence question |
|---|---|---|
| Model | Defines the AI system that produced output | Which model version was used? |
| Prompt / instruction | Influences the output and risk profile | What prompt or context was provided? |
| Training / fine-tuning data | Affects bias, leakage, and behavior | What data influenced the model? |
| Agent / tool | Shows how output was generated or applied | Which agent or tool produced the change? |
| Generated artifact | The code, test, or config that shipped | What was changed and where is it recorded? |
| Reviewer attestation | Human or independent verification | Was the output reviewed before release? |
An AI-BOM is an AI bill of materials: a structured record of the AI models, training data, prompts, agents, tools, and generated artifacts that contribute to a software system. It helps teams understand provenance and reproduce the basis for AI-generated decisions.
An SBOM lists software components and dependencies. An AI-BOM adds AI-specific elements such as models, datasets, prompts, agent configurations, and generated outputs. Both are evidence inputs; neither alone proves a release decision is justified.
When AI-generated code or decisions are part of a release, reviewers need to know what models, prompts, and agents were involved. An AI-BOM provides the provenance record that makes those decisions explainable later.
GoSentrix does not generate AI-BOMs, but it can consume AI-BOM and provenance signals as evidence. It evaluates whether the recorded AI lineage and review evidence satisfy customer-defined policy for a release decision.
Capture the origin and review evidence for AI-generated code.
Governance for AI-generated code, coding agents, and autonomous workflows.
Govern Model Context Protocol servers and the agents that access them.
The public operating doctrine for release-evidence verification.
GoSentrix evaluates AI-BOM and provenance signals against versioned policy so AI-generated changes can be explained and defended.
