{ "format": "agent-article-v0", "article_id": "EA-056", "canonical_url": "/tools/ea-056-ai-asset-inventory-ai-sbom", "page_type": "reference", "claim_ids": [], "evidence_ids": [ "EVD-EA-056-URL-62BBE48F6809", "EVD-EA-056-URL-F909FB4D7C8F", "EVD-EA-056-URL-BFEEC068C3D5", "EVD-EA-056-URL-8EE6BD77C5D0", "EVD-EA-056-URL-FD331A95EE43", "EVD-EA-056-URL-BFC4AE557A9E", "EVD-EA-056-URL-1D8CB22E18B7", "EVD-EA-056-URL-38F4C1CC7366", "EA-056-R11-RESEARCH", "EA-056-R11-WEB-READBACK" ], "unknown_ids": [ "EA-056-UNKNOWN-01", "EA-056-UNKNOWN-CURRENTNESS" ], "operational_object_ids": [], "provider": [], "models": [], "plans": [], "surfaces": [], "regions": [], "current_status": "UNKNOWN", "observation_status": "SPEC_ONLY", "freshness": "UNKNOWN", "last_verified": null, "supersedes": [], "superseded_by": [], "provenance": [ "COMM-054-EA0056", "SRC-EA-056-URL-62BBE48F6809", "SRC-EA-056-URL-F909FB4D7C8F", "SRC-EA-056-URL-BFEEC068C3D5", "SRC-EA-056-URL-8EE6BD77C5D0", "SRC-EA-056-URL-FD331A95EE43", "SRC-EA-056-URL-BFC4AE557A9E", "SRC-EA-056-URL-1D8CB22E18B7", "SRC-EA-056-URL-38F4C1CC7366", "WEBBODY-EA0056-R8-1BE9B2D1" ], "article_sources": [ { "id": "EVD-EA-056-URL-62BBE48F6809", "evidence_class": "RESEARCH", "title": "[Official standard] SPDX Specification 3.0.1 AI Profile / SPDX Project / v3.0.1 stable; accessed 2026-09-14 /", "href": "https://spdx.github.io/spdx-spec/v3.0.1/model/AI/AI/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-62BBE48F6809" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official standard] SPDX Specification 3.0.1 AI Profile / SPDX Project / v3.0.1 stable; accessed 2026-09-14 / https://spdx.github.io/spdx-spec/v3.0.1/model/AI/AI/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-F909FB4D7C8F", "evidence_class": "RESEARCH", "title": "[Official standard] AIPackage / SPDX Specification 3.0.1 / accessed 2026-09-14 /", "href": "https://spdx.github.io/spdx-spec/v3.0.1/model/AI/Classes/AIPackage/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-F909FB4D7C8F" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official standard] AIPackage / SPDX Specification 3.0.1 / accessed 2026-09-14 / https://spdx.github.io/spdx-spec/v3.0.1/model/AI/Classes/AIPackage/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-BFEEC068C3D5", "evidence_class": "RESEARCH", "title": "[Official standard] DatasetPackage / SPDX Specification 3.0.1 / accessed 2026-09-14 /", "href": "https://spdx.github.io/spdx-spec/v3.0.1/model/Dataset/Classes/DatasetPackage/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-BFEEC068C3D5" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official standard] DatasetPackage / SPDX Specification 3.0.1 / accessed 2026-09-14 / https://spdx.github.io/spdx-spec/v3.0.1/model/Dataset/Classes/DatasetPackage/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-8EE6BD77C5D0", "evidence_class": "RESEARCH", "title": "[Official working-group status] Profiles overview / SPDX AI Working Group / updated 2026-03-08; accessed 2026-09-14 /", "href": "https://spdxai.github.io/profiles/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-8EE6BD77C5D0" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official working-group status] Profiles overview / SPDX AI Working Group / updated 2026-03-08; accessed 2026-09-14 / https://spdxai.github.io/profiles/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-FD331A95EE43", "evidence_class": "RESEARCH", "title": "[Official standard/spec] CycloneDX Specification Overview / OWASP Foundation + Ecma International / ECMA-424, published 2025-12-10; accessed 2026-09-14 /", "href": "https://cyclonedx.org/specification/overview/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-FD331A95EE43" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official standard/spec] CycloneDX Specification Overview / OWASP Foundation + Ecma International / ECMA-424, published 2025-12-10; accessed 2026-09-14 / https://cyclonedx.org/specification/overview/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-BFC4AE557A9E", "evidence_class": "RESEARCH", "title": "[Official release/spec] CycloneDX specification release history / OWASP CycloneDX / current v1.7 released 2025-10-21; accessed 2026-09-14 /", "href": "https://github.com/CycloneDX/specification", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-BFC4AE557A9E" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official release/spec] CycloneDX specification release history / OWASP CycloneDX / current v1.7 released 2025-10-21; accessed 2026-09-14 / https://github.com/CycloneDX/specification" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-1D8CB22E18B7", "evidence_class": "RESEARCH", "title": "[Official v1.7 reference] CycloneDX v1.7 Protobuf Reference / OWASP CycloneDX / v1.7; accessed 2026-09-14 /", "href": "https://cyclonedx.org/docs/1.7/proto/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-1D8CB22E18B7" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Official v1.7 reference] CycloneDX v1.7 Protobuf Reference / OWASP CycloneDX / v1.7; accessed 2026-09-14 / https://cyclonedx.org/docs/1.7/proto/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-056-URL-38F4C1CC7366", "evidence_class": "RESEARCH", "title": "[Project definition, lower authority than formal specs] AI Bill of Materials Project / OWASP / current, accessed 2026-09-14 /", "href": "https://owaspaibom.org/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-056-URL-38F4C1CC7366" ], "supporting_locators": [ "EVIDENCE TABLE", "- [Project definition, lower authority than formal specs] AI Bill of Materials Project / OWASP / current, accessed 2026-09-14 / https://owaspaibom.org/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EA-056-R11-RESEARCH", "evidence_class": "RESEARCH", "title": "EA-056 監査済みresearch / canonical revision binding", "supports": [ "1. AI-BOMは構想だけではない。SPDX 3.0.1にはstable AI ProfileとDataset Profileがあり、AIPackage/DatasetPackageとしてmodel/applicationとdataset固有情報を表現できる。SPDX AI WGでは3.1-RC1はWIPであり、future claimとして混同しない。\n2. CycloneDXは2026-09-14時点でv1.7がcurrent release。`machine-learning-model`向けModelCardにintended use、limitations、training parameters、datasets、performance metrics等を記述でき、full-stack BOMの一部としてAI/MLを扱える。\n3. ただし「AI-SBOM標準が存在する」ことと「企業のAI asset inventoryが完全である」ことは別。台帳が求めるmodel、API、prompt、dataset、tool、OSS、MCP等のうち、model/dataset/software/serviceは標準BOMへ比較的自然に写せるが、prompt template/version、hosted modelのopaque revision、agent policy、MCP server/tool schema、provider tenant setting、RAG corpus snapshot、evaluation/guardrail config等は標準の専用first-class primitiveが不足または実装依存になり得る。\n4. 将来のEnterprise AI Coreでは、BOM documentとRuntime Asset Registryを二層化するのが安全。BOMはmachine-readable supply-chain snapshot、Registryはowner、business purpose、environment、endpoint/tenant、approval state、data classification、deployment status、last-seen、runtime dependency、decommission state等を継続管理する。\n5. 最小dependency graph候補: AI application/agent → provider/model/deployment → prompt/template → tool/MCP/API → software/runtime/container → retrieval/vector store → dataset/corpus → evaluator/guardrail/policy。各nodeにstable local IDを与え、外部標準identifier/hash/PURL等が存在する場合は併記する。\n6. InventoryはEA-057 Shadow AI discoveryの受け皿でもある。discoveryで見つかったassetを即「承認済み」とせず、discovered/declared/verified/approved/retired等のstateを分離する。" ], "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。", "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET", "source_or_experiment_ids": [ "COMM-054-EA0056" ], "supporting_locators": [ "COMM-054-EA0056", "EA-056-R5-LEGACY-MIGRATION-20261008-R1", "content/staging/EA-056.md" ], "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。", "provenance_status": "AUDIT_PASS_CANONICAL_BINDING" }, { "id": "EA-056-R11-WEB-READBACK", "evidence_class": "IMPL", "title": "EA-056 Web body identity / canonical readback", "supports": [ "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。" ], "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。", "checked_at": null, "origin_class": "IMPLEMENTATION_READBACK", "source_or_experiment_ids": [ "WEBBODY-EA0056-R8-1BE9B2D1" ], "supporting_locators": [ "WEBBODY-EA0056-R8-1BE9B2D1", "content/staging/EA-056.md", "EA-056-R5-LEGACY-MIGRATION-20261008-R1" ], "scope": "R9/R10 canonical readback後のProduction生成時body identity。", "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH" } ], "research_sections": [ { "heading": "WHY_THIS_MATTERS_TO_UPDATE", "text": "Enterprise AIでは、通常のsoftware SBOMだけではmodel、dataset、prompt、provider API、agent/tool、MCP server、guardrail、embedding/reranker、vector store等の依存を十分に把握できない。脆弱性・ライセンス・モデル廃止・dataset provenance・shadow AI・incident blast radiusを追跡するには、AI固有BOM標準と実運用inventoryの差を整理する必要がある。" }, { "heading": "SCOPE_ROUTING", "text": "Enterprise AI Core / governance / security / supply chain / interoperability / implementation / non-LLM component。SPDX/CycloneDXは標準・serialization、組織inventoryはorganization overlayとして分離。" }, { "heading": "CLAIM_OR_RESEARCH_QUESTION", "text": "1. 2026-09-14時点でAI/ML assetを機械可読に記述できる標準は何か。\n2. Model/dataset以外にprompt、tool、API、MCP、agent workflow等をどこまで標準BOMだけで表現できるか。\n3. 「AI-BOMがある」と「組織内AI assetを網羅できている」を分離するには何を追加管理すべきか。" }, { "heading": "EVIDENCE TABLE", "text": "- [Official standard] SPDX Specification 3.0.1 AI Profile / SPDX Project / v3.0.1 stable; accessed 2026-09-14 / https://spdx.github.io/spdx-spec/v3.0.1/model/AI/AI/ / locator: AI Profile standardizes documentation/sharing of AI software packages; AIPackage model / VERIFIED_SPEC / support.\n- [Official standard] AIPackage / SPDX Specification 3.0.1 / accessed 2026-09-14 / https://spdx.github.io/spdx-spec/v3.0.1/model/AI/Classes/AIPackage/ / locator: AI application or trained AI model metadata / VERIFIED_SPEC / support.\n- [Official standard] DatasetPackage / SPDX Specification 3.0.1 / accessed 2026-09-14 / https://spdx.github.io/spdx-spec/v3.0.1/model/Dataset/Classes/DatasetPackage/ / locator: training/testing dataset metadata including collection, preprocessing, confidentiality, sensitive personal information, intended use / VERIFIED_SPEC / support.\n- [Official working-group status] Profiles overview / SPDX AI Working Group / updated 2026-03-08; accessed 2026-09-14 / https://spdxai.github.io/profiles/ / locator: SPDX 3.0 AI/Dataset profiles are stable; 3.1-RC1 is work-in-progress / VERIFIED_SPEC / context+limit.\n- [Official standard/spec] CycloneDX Specification Overview / OWASP Foundation + Ecma International / ECMA-424, published 2025-12-10; accessed 2026-09-14 / https://cyclonedx.org/specification/overview/ / locator: BOM object model covers components and lifecycle/system transparency / VERIFIED_SPEC / support.\n- [Official release/spec] CycloneDX specification release history / OWASP CycloneDX / current v1.7 released 2025-10-21; accessed 2026-09-14 / https://github.com/CycloneDX/specification / locator: v1.7 current release and AI/ML-BOM support / VERIFIED_SPEC + OSS_PRACTICE / support.\n- [Official v1.7 reference] CycloneDX v1.7 Protobuf Reference / OWASP CycloneDX / v1.7; accessed 2026-09-14 / https://cyclonedx.org/docs/1.7/proto/ / locator: ModelCard for machine-learning-model, intended uses/limitations, training parameters, datasets, performance metrics; lifecycle/operations inventory concepts / VERIFIED_SPEC / support.\n- [Project definition, lower authority than formal specs] AI Bill of Materials Project / OWASP / current, accessed 2026-09-14 / https://owaspaibom.org/ / locator: AIBOM described as machine-readable inventory including models, datasets, agents, tools, guardrails, runtime elements and provenance/rights/integrity/evaluation / SOURCE_REPORT / context." }, { "heading": "FINDINGS", "text": "1. AI-BOMは構想だけではない。SPDX 3.0.1にはstable AI ProfileとDataset Profileがあり、AIPackage/DatasetPackageとしてmodel/applicationとdataset固有情報を表現できる。SPDX AI WGでは3.1-RC1はWIPであり、future claimとして混同しない。\n2. CycloneDXは2026-09-14時点でv1.7がcurrent release。`machine-learning-model`向けModelCardにintended use、limitations、training parameters、datasets、performance metrics等を記述でき、full-stack BOMの一部としてAI/MLを扱える。\n3. ただし「AI-SBOM標準が存在する」ことと「企業のAI asset inventoryが完全である」ことは別。台帳が求めるmodel、API、prompt、dataset、tool、OSS、MCP等のうち、model/dataset/software/serviceは標準BOMへ比較的自然に写せるが、prompt template/version、hosted modelのopaque revision、agent policy、MCP server/tool schema、provider tenant setting、RAG corpus snapshot、evaluation/guardrail config等は標準の専用first-class primitiveが不足または実装依存になり得る。\n4. 将来のEnterprise AI Coreでは、BOM documentとRuntime Asset Registryを二層化するのが安全。BOMはmachine-readable supply-chain snapshot、Registryはowner、business purpose、environment、endpoint/tenant、approval state、data classification、deployment status、last-seen、runtime dependency、decommission state等を継続管理する。\n5. 最小dependency graph候補: AI application/agent → provider/model/deployment → prompt/template → tool/MCP/API → software/runtime/container → retrieval/vector store → dataset/corpus → evaluator/guardrail/policy。各nodeにstable local IDを与え、外部標準identifier/hash/PURL等が存在する場合は併記する。\n6. InventoryはEA-057 Shadow AI discoveryの受け皿でもある。discoveryで見つかったassetを即「承認済み」とせず、discovered/declared/verified/approved/retired等のstateを分離する。" }, { "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE", "text": "- SPDX/CycloneDXが表現可能でも、自動生成toolが全AI dependencyを検出できるとは限らない。特にprompt、browser/desktop agent、dynamic MCP/tool discovery、provider-side model routing、runtime-generated codeは静的scanから漏れる。\n- SaaS/hosted modelではweight hash、training dataset、exact backend revisionが非公開の場合がある。UNKNOWNを推測で埋めない。\n- `model name`だけではasset identityとして弱い。provider、endpoint/deployment、region、API revision、observed model ID、effective date等を併記できる設計が必要。\n- BOMはpoint-in-time snapshotになりやすい。runtime routing/fallbackやdynamic agent dependencyを反映しないまま陳腐化するfailure envelopeがある。\n- OWASP AIBOM projectの広い定義をSPDX/CycloneDXの必須schema項目と同一視しない。" }, { "heading": "AVAILABILITY_GATES", "text": "- SPDX 3.0.1 AI/Dataset Profileはstable spec。SPDX 3.1-RC1はWIPでありcurrent stableとして扱わない。\n- CycloneDX v1.7は現行releaseだが、生成・ingestion toolingがv1.7のAI/ML fieldsを完全対応するかは製品ごとに再確認が必要。\n- Provider-hosted model/dataset provenanceの開示可能範囲はprovider・契約・region・modelごとに異なる。" }, { "heading": "IMPLEMENTATION_STATE", "text": "Standards available, enterprise completeness not solved。SPDX 3.0.1とCycloneDX 1.7にAI/ML表現が存在するため「AI-BOMは未標準化」とは書けない。一方、prompt/MCP/tool/policy/provider-runtimeを含むEnterprise AI operational inventoryの完全な共通schemaは今回確認できず、Core拡張が必要。" }, { "heading": "BENCHMARK_OR_EVAL", "text": "Inventory completenessの普遍benchmarkは今回確認できずUNKNOWN。後続Work用TEST_PROFILE（未実施・PROPOSAL）: 既知fixtureとしてmodel/API/prompt/dataset/tool/MCP/OSS/RAG/evaluator/guardrailを配置し、各scanner/registry方式についてasset recall、dependency-edge recall、version fidelity、unknown-field率、stale detection time、false merge率を測定する。BOM schema conformanceとdiscovery completenessを別metricにする。" }, { "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY", "text": "Security: asset inventory自体が攻撃者に有用なarchitecture mapとなるためleast privilege、export control、tamper evidenceが必要。\nPrivacy: dataset metadataやprompt/corpus名称だけでもsensitive business informationを露出し得る。inventoryにraw dataを複製せずreference/hash/classification中心とする。\nAudit: BOM serial/version、generation tool、generated-at、source-of-truth、approver、change reasonを保持。Runtime discovery由来かdeclared由来かoriginも保持する。\nCost: full continuous discoveryはlog/API/CMDB連携コストを伴うためcritical asset優先度を設定可能。ただし未観測assetを「存在しない」と扱わない。\nOperability: BOM生成をCI/CD・model promotionへ接続し、runtime registryはdeployment/change/decommissionと同期する方向が実用的。" }, { "heading": "SAFE_WORDING_FOR_FUTURE_BOOK", "text": "「AI Asset Inventoryでは、SPDXやCycloneDXのAI/ML対応BOMを供給網の機械可読スナップショットとして利用できる。ただし、それだけで企業内のAI利用を完全に棚卸しできるわけではない。prompt、外部API、MCP/tool、RAG corpus、provider-side deploymentなど、実行時に変化する依存をRuntime Asset Registryで補完し、UNKNOWNを明示したまま継続更新する必要がある。」" }, { "heading": "UPDATE_WORK_HANDOFF", "text": "EA-055 Forensicsではrun provenanceをasset IDへ接続し、incident時に「どのversion/dependencyが使われたか」を逆引きできるようにする。EA-057 Shadow AI発見編ではdiscovery sourceをinventoryへ流入させるが、approval stateを分ける。将来provider mappingではmodel/deployment ID、API revision、region、retirement/deprecation情報の取得可能性を再確認する。" }, { "heading": "OPEN_UNKNOWN / STOP_CONDITION", "text": "OPEN: prompt/MCP/agent-policyの標準化されたBOM表現、主要toolingのCycloneDX 1.7/SPDX 3.0.1 AI profile実装成熟度、hosted model exact revision/provenanceのprovider別取得性、cross-format mapping fidelity。STOP: 主要BOM標準と主要provider inventory APIのmappingが確定し、runtime registryの共通最小schemaを定義できた時点で再採集。\n\n---" }, { "heading": "CURRENTNESS_AUDIT", "text": "SPDX 3.0.1 AI/Dataset profiles remain stable while SPDX 3.1-RC1 is work in progress. CycloneDX normative specification line is 1.7 and current published GitHub release is 1.7.1; tracked 1.7.2 maintenance is not treated as a newer published release." } ], "human_url": "/tools/ea-056-ai-asset-inventory-ai-sbom", "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-056-ai-asset-inventory-ai-sbom", "json_url": "/agent/article.json?path=%2Ftools%2Fea-056-ai-asset-inventory-ai-sbom" }