Model & Software Supply Chain

Define third-party AI accountability requirements before vendor engagement. Embed in RFP and contract specifications.

Conduct AI governance due diligence on third-party providers at selection stage. Reject providers failing minimum maturity.

Require third-party providers to submit model cards, validation reports, and security documentation before integration.

Enforce ongoing third-party accountability obligations including incident notification and periodic performance reporting.

Conduct independent performance and compliance monitoring of third-party AI components. Escalate when SLA or compliance obligations are missed.

Allocate every control in a shared-responsibility matrix and flow down regulatory obligations in contract at onboarding. Gate approval on initial assurance artefacts.

Design strict RBAC on training data repositories at design stage. Define approved contributor list and approval workflow.

Apply anomaly detection on the training data ingestion pipeline to identify poisoned or tampered batches.

Define and approve the source allow-list and write-time scanning during build. Prove non-allow-listed and injection-bearing writes are rejected before go-live.

Establish data transfer and storage policy for AI training data. Enforce approved storage locations from point of collection.

Implement DLP controls in the data acquisition environment to prevent unauthorised extraction or transfer of training data.

Enforce data handling policy in the build environment. Require explicit approval for any data transfers outside the environment.

Configure DLP controls in the build environment to block training data from leaving approved boundaries.

Conduct a privacy risk assessment at use case design stage. Determine if a DPIA is required before data acquisition.

Apply S1-defined privacy controls during data acquisition: verify consent, minimise data, anonymise personal data.

Apply anonymisation and masking controls to personal data before use in model training. Validate de-identification effectiveness.

Apply Privacy by Design in model architecture using differential privacy or federated learning where technically feasible.

Publish the privacy notice and confirm consent management is operational before go-live.

Define and sign off a purpose-to-data-source matrix with lawful basis at intake. Make it the approved baseline for runtime enforcement.

Sign zero-retention/no-training terms with each model provider and obtain DPO sign-off on the data flow before enabling any endpoint.

Implement output filters to detect and suppress quasi-identifying attribute combinations in model responses.

Propagate source ACLs and classification labels onto every chunk at ingestion. Reject documents whose entitlements cannot be resolved.

Scan every model response inline with DLP before delivery; redact or block PII, PAN and MNPI matches. Keep the rule set version-controlled.

Classify tools by impact and reversibility at design and define which calls require human approval. Obtain governance sign-off on the thresholds before build.

Bind each agent role to an explicit tool allow-list and validate every call against a strict JSON Schema at the orchestrator. Reject unlisted tools and out-of-bounds arguments before dispatch.

Mint short-lived, task-scoped credentials per tool. Block issuance outside the approved scope register and enforce automatic expiry.

Review DLP hits and blocked-egress events, tune detectors, and recertify the destination allow-list periodically. Route new destinations through security change control.

Conduct ethical design assessment at use case intake before build begins. Require sign-off by ethics or risk committee.

Define prohibited outputs and ethical boundary constraints in the use case design document before build.

Deploy content moderation controls aligned to S1 ethical constraints. Validate filter accuracy before deployment.

Select a foundation model with documented safety fine-tuning (RLHF, Constitutional AI). Verify alignment benchmarks.

Implement adversarial example detection at the inference boundary. Block or flag inputs matching known attack patterns.

Sign and hash-register every model and adapter with a provenance manifest at onboarding. Refuse registry admission for unsigned artifacts.

Sample classifier verdicts and breaker trips on a cadence; retune thresholds and update signatures for confirmed misses.

Define minimum monitoring requirements at design stage calibrated to the use case risk tier.

Configure monitoring hooks in the conversation layer at deployment to capture metrics required by S1 monitoring requirements.

Execute a controlled fine-tuning cycle on refreshed data when staleness is confirmed. Validate before promoting to production.

Define approved use case scope and expected input distribution at design stage. Document as the governance baseline for OOD controls.

Design a scope-enforcement layer in the architecture to isolate the AI system from off-topic or out-of-distribution inputs.

Train PII-bearing models with DP-SGD under a documented epsilon/delta budget. Approve the budget against the enterprise epsilon-ceiling policy before training.

Strip raw logits, quantise confidence scores and block training-record echoes at the inference gateway. Keep the output-filter policy under change control.

Declare all planned training and test data sources at use case intake, with provenance status for each.

Plan the interpretability approach at design stage to ensure source provenance can be traced and disclosed to users.

Document actual provenance for each data source during collection: origins, methods, timestamps, custodian identity.

Apply data quality scoring to all acquired data to document provenance reliability. Flag low-confidence sources for review.

Build and baseline the golden-set suite against the vendor model before go-live. Sign off thresholds with the model risk owner as a release condition.

Re-verify hashes and signatures on every vendor model update before promotion. Reconcile deployed artifacts against the AIBOM on a set cadence.

Conduct a data poisoning threat assessment at design stage. Identify likely attack vectors and assign risk ratings.

Simulate data poisoning attacks (backdoor, label flipping, gradient-based) to assess model resilience before deployment.

Verify a signed attestation and content hash on every dataset shard at ingestion. Reject unsigned or hash-mismatched data before it reaches the training pipeline.

Gate every model promotion on backdoor-trigger probes and a behavioral diff against the approved baseline. Block release on significant regressions or trigger-pattern anomalies.

Monitor production for anomalous data transfers in real time. Alert on any transfer outside approved data flow boundaries.

Tag personal data with subject identifiers at ingestion and maintain an artefact inventory map of every store it reaches. Keep lineage current so erasure can propagate.

Seed registered canary records into the fine-tuning corpus during data preparation. Control the seed manifest so canaries stay traceable and tamper-proof.

Define per-agent behavioural baselines and detection rules during build. Validate against simulated misuse and sign off thresholds before release.

Build signed, append-only tool-call logging into the orchestrator against a defined audit schema. Block release until completeness and tamper-evidence tests pass.

Prioritise value-misalignment test scenarios in validation. Block deployment if prohibited outputs are produced.

Run adaptive multi-turn jailbreak fuzzing against every release candidate. Gate release on attack-success rate within threshold and re-test each fixed bypass.

Assemble the golden probe set and baseline pass rates before first release. Obtain risk-owner approval of coverage and thresholds.

Construct synthetic evaluation datasets during build to serve as the ongoing monitoring baseline.

Build monitoring infrastructure during build: performance metrics collection, alerting thresholds, dashboards.

Penetration test the model inference API to identify exploitable access control weaknesses and rate limiting bypass vectors.

Attack each candidate model with membership-, attribute-, and inversion-inference harnesses before promotion. Block release when attack advantage exceeds the agreed ceiling.

Configure per-principal budgets and probing-detection rules on the gateway before exposure. Verify enforcement with synthetic attack traffic.

Design all vendor model access behind a gateway with pinned versions, a second-vendor fallback, and a documented exit plan. Gate architecture sign-off on no single-sourcing.

Verify every third-party model artifact against its AIBOM hashes and signatures before load. Fail the build on any unverified artifact.

Review independent vendor assurance on cadence, log gaps, and track remediation. Keep the shared-responsibility matrix current so every control has an owner.

Penetration test the training data pipeline to identify injection points and access control weaknesses.

Scan every ingestion batch with spectral-signature and clustering detectors before training. Quarantine flagged clusters for human review against documented thresholds.

Monitor for privacy incidents in production including personal data appearing in outputs. Notify regulators within required timeframes.

Tag every memory and vector record with subject-id and retention class; partition stores per tenant/user. Prove the erasure and isolation paths in testing before release.

Test de-identification approach against known re-identification attacks (quasi-identifier linkage, singling-out). Remediate if risk is high.

Conduct periodic data leakage audits including training data memorisation testing. Escalate confirmed leakage incidents to PDPA notification process.

Implement tamper-evident capture of prompts, outputs, and version state during build. Verify a full incident timeline can be reconstructed before go-live.

Run agent tool calls in a network-restricted sandbox behind a deny-by-default egress allow-list. Require security approval for any destination added.

Build sandbox profiles per tool class and run escape and egress tests before release. Treat any containment failure as a blocking defect.

Label tool and external content as tainted and propagate the label through the agent context. Block privileged calls whose parameters derive from tainted outputs and prove it with injection tests before release.

Build credential revocation and dispatch blocking out-of-band of the agent loop. Gate release on an end-to-end kill test meeting the latency target.

Require idempotency keys, dry-run, and rollback on every state-changing tool. Gate onboarding on duplicate-call and rollback tests passing.

Red-team tool-misuse and privilege-escalation paths before release. Gate deployment on remediation or signed risk acceptance of all findings.

Permit outbound tool calls only to allow-listed destinations and DLP-scan arguments and payloads. Block or quarantine calls carrying sensitive data to disallowed sinks.

Enforce hard per-task ceilings on tool calls, spend, and data volume with a circuit breaker that halts the run. Fail closed when any ceiling is hit.

Baseline normal tool-call behaviour per agent and alert on rate, sequence, or argument anomalies. Auto-throttle or quarantine on high-confidence deviations.

Score every prompt and response with an inline safety classifier; trip a circuit breaker on sessions with sustained anomalous scores. Keep thresholds under change control.

Re-run the jailbreak fuzzing harness on a recurring cadence with newly observed attack techniques added. Escalate threshold breaches for remediation.

Implement a reinforcement learning feedback loop to continuously incorporate production signals and reduce staleness risk.

Implement OOD detection in the input filtering layer. Reject or escalate inputs outside the S1-defined scope.

Configure HITL triggers for outputs in input domains that diverge from the training distribution. Log all out-of-scope interventions.

Define the minimum response surface and test it with membership/attribute-inference probes pre-release. Block promotion if any probe recovers raw confidence signals.

Meter inference traffic per principal and flag probing signatures with behavioural analytics. Throttle, step-up, or suspend flagged sessions.