// GLOSSARY

SLSA

Supply-chain Levels for Software Artifacts; a framework defining increasing trust levels for the software supply chain. It defines, in layers of progressively tightening levels, the build pipeline's provenance generation, source awareness and hardened-process requirements. It is the ground reference in AI Model Supply-Chain Assurance reporting. Its value is in turning security discussions' vaguest word, the adjective 'secure', into a measurable maturity ladder. The question 'is this build pipeline secure' cannot be answered on its own, because security is not a binary state but a gradation. SLSA makes this grade concrete: the lowest level asks only that provenance be recorded, while higher levels require the build process to be tamper-resistant, process controls such as two-person approval, and proof of source integrity. So the level at which an artefact was produced directly tells how much it can be trusted, and when two suppliers make the same 'secure' claim, it makes the real difference between them visible. Attestation signs the evidence of these levels, and provenance forms its basic input.