AI Supply Chain / AI BOM / Provenance Architecture 解读

面向对象: AI Platform PM / Enterprise Architect / Senior BA / Model Risk Lead / Security Architect / Vendor Risk Lead。 核心问题: AI supply chain 不是普通软件依赖清单。金融零售 AI 系统还依赖模型、供应商、数据集、RAG 语料、prompt、工具、MCP server、eval set、人审供应商、telemetry store、开源包、license、版本、签名和变更证据。 学习目标: 建立 AI Bill of Materials and Provenance Architecture, 能回答“某个 AI 输出由哪些组件、数据、工具、人和供应商共同产生, 这些组件是否可信、可替换、可审计、可退出”。

---

Source Anchors

一句话:

AI BOM is the component-level traceability layer for AI systems: model, data, prompt, tool, eval, human operation, telemetry and vendor components must be versioned, provenanced, signed, monitored and exit-ready.

---

1. Thesis

传统 SBOM 关注 software package、version、supplier 和漏洞响应。AI supply chain 需要更宽的 BOM:

AI BOM 不是 vendor risk 的替代品。Vendor risk 回答“这个供应商是否可用、合规、可靠”。AI BOM 回答“这个 AI workflow 的每个组件是什么, 从哪里来, 谁批准, 哪个版本, 有什么权利限制, 被什么输出使用, 变更或漏洞出现时如何定位影响范围”。

---

2. Why It Matters In Financial Retail

金融零售 AI 系统通常进入客户服务、信贷、催收、欺诈、AML、投诉、财富、营销和员工 Copilot。Supply chain failure 会产生五类后果:

SR 26-2 代表模型风险管理的当前监管锚点, 但 AI BOM 不能只等同 formal model inventory:

• 一个 GenAI workflow 可能只有一个 formal model, 但有数十个可改变行为的组件。
• RAG 语料、prompt、工具权限、eval set、人审标准和 telemetry pipeline 都能改变结果。
• 没有 component-level provenance, 模型验证只能验证“系统某一时刻的表现”, 不能追踪“哪个组件导致变化”。

---

3. Core Concepts

---

4. AI BOM Component Taxonomy

---

5. Architecture Diagram

AI Product / Workflow
  -> AI BOM Registry
       -> model, prompt, RAG, tool, MCP, eval, human review, telemetry, package, license
  -> Provenance Event Log
       -> ingest, sign, approve, deploy, invoke, evaluate, incident, retire
  -> Impact Graph
       -> component -> workflow -> output -> customer/case -> control evidence
  -> Response Engine
       -> vulnerability/change notice -> impact query -> owner task -> regression -> release/rollback

Key design principle:

Every component that can change model behavior, data exposure, legal rights, audit evidence, cost or exit path belongs in the AI BOM.

---

6. Provenance Architecture

Minimum provenance events:

AI BOM should connect with model inventory, vendor inventory, data catalog, package registry, CMDB, prompt registry, RAG source registry, eval store and incident system. It should not live as a spreadsheet detached from runtime traces.

---

7. Financial Retail Case: Card Dispute Copilot

Use case: employee Copilot helps explain credit card disputes, annual fees and provisional credits.

Impact query example:

SELECT workflow_id, output_id, customer_case_id, trace_id
FROM ai_component_usage
WHERE component_id = 'rag-corpus-card-fee-policy-2026q2'
  AND component_version = 'v17'
  AND generated_at >= '2026-06-01';

This query turns a corpus issue into scoped response instead of broad panic.

---

8. PM / BA / Architect Checklist

---

9. Code-Lite Experiment

Create a small JSON AI BOM for one workflow, then run three response queries manually.

{"workflow_id":"card-dispute-copilot","release":"2026.06.30","components":[
  {"id":"model-primary","class":"model","version":"2026-06","risk_tier":"high"},
  {"id":"prompt-dispute-sop","class":"prompt","version":"v9","signature":"sha256:8f91"},
  {"id":"rag-fee-policy","class":"rag_corpus","version":"2026q2-v17","owner":"policy-ops"},
  {"id":"tool-transaction-summary","class":"tool","version":"v4","permission":"read_minimized_summary"},
  {"id":"eval-dispute-golden","class":"eval_dataset","version":"2026q2-v3","sensitivity":"synthetic_plus_masked"}]}

Queries:

1. Which components touch customer data?
2. Which components have licenses or data rights restrictions?
3. If rag-fee-policy is stale, which workflows, eval sets and outputs are affected?

Expected learning: AI BOM becomes useful only when it supports response queries, not just inventory display.

---

10. Interview Questions

Q1: How is AI BOM different from SBOM?

SBOM tracks software components and dependencies. AI BOM includes software but adds models, datasets, RAG corpora, prompts, tools, MCP servers, eval datasets, human review vendors, telemetry stores, licenses, provenance, signatures and runtime usage.

Q2: How is AI BOM different from vendor risk?

Vendor risk assesses supplier lifecycle, contract and oversight. AI BOM is component-level traceability: which component version influenced which workflow and what to do when that component changes.

Q3: Why is SR 26-2 not enough by itself?

SR 26-2 anchors current model risk expectations, but a formal model inventory alone can miss RAG corpora, prompts, tools, connectors, eval sets and human operations. AI BOM complements model inventory with broader system provenance.

11. Common Pitfalls