AI Governance Engineer
GitHub

Build provenance (SLSA)

By Updated

A verifiable record, in the SLSA format, of what built an artefact, by what process and from which top-level inputs. Its build levels run from L1, provenance exists, through L2, signed by a hosted build platform, to L3, hardened builds whose provenance is very hard to forge 1. For a model, inputs include the base model's digest and dataset admission records.

Developed in
ch. 05, Pattern: Model Artefact Integrity
Chapters
ch. 05, Patterns
Contrast with
Model signing
Source
1 numbered reference, listed below

Where it is used

One chapter of the Body of Knowledge uses the term. Each link opens the first section that does.

Build provenance (SLSA): mentions per chapter1 mention of the term across 1 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapter05 Patterns: 1 mention05 Patterns1No mentions in the other 22 chaptersSource: the Body of Knowledgev0.5.0
Build provenance (SLSA): mentions per chapter1 mention of the term across 1 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapter000102030405 Patterns: 1 mention1050607081011121314151617181920212223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of Build provenance (SLSA) per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition0No
02 Why Now0No
03 Values & Principles0No
04 The Stack0No
05 Patterns1Yes
06 The Role0No
07 Maturity Model0No
08 Regulatory Map0No
10 Reading List0No
11 AI Defined0No
12 Governance Program0No
13 Risk Management0No
14 Development0No
15 Deployment0No
16 Fairness & XAI0No
17 Incidents0No
18 EU AI Act0No
19 Privacy & AI0No
20 Existing Law0No
21 AI Laws Worldwide0No
22 Principles & Standards0No
23 AI Agents0No

Patterns that use this term

One pattern page uses the term.

Build provenance (SLSA): related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern02 InventoryBuild provenance (SLSA)Related terms (1)Safetensors · RelatedSafetensorsContrast with (1)Model signing · ContrastModel signingPatterns using it (1)Model Artefact Integrity, 3 mentions · Uses the termModel Artefact Integrity
Build provenance (SLSA): related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern02 InventoryRelated terms (1)Safetensors · RelatedSafetensorsPatterns using it (1)Model Artefact Integrity, 3 mentions · Uses the termModel Artefact IntegrityContrast with (1)Model signing · ContrastModel signingBuild provenance(SLSA)
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of Build provenance (SLSA)
FamilyItemRelation
Related termsSafetensorsRelated
Contrast withModel signingContrast
Patterns using itModel Artefact Integrity, 3 mentionsUses the term
  • Safetensors

    A file format for storing a model's tensors safely, as opposed to Python pickle, whose loading can run arbitrary code and which the Python documentation calls…

Sources

  1. [1] SLSA specification v1.2, Build track basics (provenance: what built the artefact, by what process and from which top-level inputs; Build L1 provenance exists, L2 hosted build platform, L3 hardened builds). OpenSSF SLSA project. n.d. (accessed 2026-09-25). https://slsa.dev/spec/v1.2/build-track-basics (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Build provenance (SLSA). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/build-provenance-slsa. CC BY 4.0

BibTeX

@misc{aige2026buildprovenanceslsa,
  author  = {Jorge García Aibar},
  title   = {{Build provenance (SLSA)}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/build-provenance-slsa}
}