// GLOSSARY

Provenance (Source Origin)

Recording in a verifiable way where, how and from which source every component comes across the model artefact, dataset, code, dependencies, build/CI and deployment chain. It is not a single 'where did the model come from' question but a provenance chain covering data, dependencies, build steps, the registry and the deployment pipeline. Its necessity arises from how modern software is built: a system is no longer written from scratch but assembled from inherited libraries, pre-trained models and external datasets; so the source of a risk is often not in the code an organization wrote but in a component it took over. If origin is unknown, trust in a component is an assumption, not evidence; when a vulnerability is disclosed, even the question 'were we affected' cannot be answered. Attestation signs this provenance to make it portable and verifiable, and SLSA frames the maturity level at which the provenance was produced. Together with the component list (SBOM/ML-BOM) it forms the evidential ground of supply-chain trust.