Supply Chain Integrity in the Generative AI Era: Evidence-Driven Controls from Source to Deployment

Abstract

Software supply chain integrity has become a critical security concern as cloud-native delivery architectures expand dependency reuse and automation across build and deployment pipelines. Generative artificial intelligence accelerates software production but introduces risks through insecure code patterns while expanding artifact governance requirements to include model weights, prompt templates, and retrieval indexes. This article proposes a four-stage integrity framework spanning source, build, registry, and deployment that integrates secure development practices, artifact integrity controls, deployment-time policy enforcement, and operational response mechanisms. The principal contribution involves treating artificial intelligence artifacts as first-class supply chain objects requiring the same version control, integrity verification, and deployment governance as traditional software components. This addresses a significant gap in conventional container security practices that has become increasingly important due to the expanded attack surface of generative artificial intelligence systems. The framework enables organizations to produce auditable evidence of trust from source code and model artifacts through to running services, supporting both security objectives and compliance requirements in regulated environments.