In collecting, safeguarding, maintaining and sharing provenance data for every release component (for example through an SBOM or SLSA), the organisation tracks the provenance of a model, its components and its derivatives, including the training libraries, frameworks and pipelines used to build it. It tracks which models were trained on sensitive data (card payment data, protected health records, other personal information) and decides whether access to those models should be limited to people who already hold access to that data. It may also disclose where the training, test, fine-tuning and alignment data came from.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.