The AI Software Supply Chain
A shared model gateway holds provider keys, sees every prompt and sits in front of every AI application, which makes it one of the most trusted components in the estate and one of the least scrutinised. This nine-part series treats AI infrastructure as software supply chain: why the gateway changes the blast radius, how to pin versions without freezing, a containment sequence for a compromised dependency, the evidence that answers 'were we exposed?', skills and MCP servers as executable dependencies, an AI bill of materials, containment as architecture, upgrade records and judging open-source risk on evidence. One fictional Stellenbosch software company carries the examples, and its figures are illustrative.
9 articles
- Part 1Your AI gateway is part of the software supply chainA shared model gateway holds provider keys, sees every prompt and sits in front of every AI application. That makes it one of the most trusted components in the estate, and one of the least scrutinised. Part 1 explains why AI infrastructure belongs inside software supply-chain security, not beside it.9 min read
- Part 2Pin the version before you pin your hopes on the platformA shared AI component that resolves 'latest' at install time will eventually install something nobody chose. Part 2 explains what pinning actually means for gateways, models and agent tooling, why it is not the same as freezing, and the upgrade path that keeps a pinned platform current.6 min read
- Part 3What to do when an AI dependency is compromisedAn advisory names a malicious release of a package your AI stack depends on. The first hour decides whether you contain it or chase it. Part 3 sets out a vendor-neutral containment sequence, why the order matters, and how to decide how far the rotation has to reach.6 min read
- Part 4The container will not start. Can you still prove it was safe?A job that installed a malicious package crashed before it served a request. It is tempting to call that lucky and close the ticket. Part 4 explains why absence of execution is not evidence of safety, and which records actually answer the question.6 min read
- Part 5Agent skills and MCP servers are executable dependenciesDevelopers install skills and MCP servers to make coding agents more capable, usually from public repositories and with whatever access they ask for. Part 5 explains why these belong in the same supply-chain discipline as packages, and a review gate that stays light for low-risk items.6 min read
- Part 6An AI bill of materials must include more than packagesA software bill of materials lists the packages inside an application. An AI system's behaviour also depends on models, prompts, policies, tool servers, datasets, evaluation sets and external services. Part 6 sets out what an AI bill of materials should record and why the 'touches' column matters most.6 min read
- Part 7Containment is an architecture featureYou cannot guarantee that a bad release never reaches your AI gateway. You can decide, in advance, how little it could do when it does. Part 7 sets out the containment controls that bound a compromise: scoped identities, short-lived secrets, an egress allow-list, per-application keys and a kill switch.6 min read
- Part 8Upgrade evidence belongs in the architecture recordUpgrades to AI infrastructure are architecture decisions that rarely get recorded as such. Part 8 sets out a short upgrade record, eight fields long, that answers what changed, why, on what evidence and how to go back, and explains why it pays for itself at the next incident.6 min read
- Part 9Open source does not mean low risk or high riskAfter a public supply-chain incident, someone always proposes replacing open-source AI components with a vendor product, and someone else says open source is safer because anyone can read it. Both are stereotypes. Part 9 replaces them with evidence questions and shows how those signals should set controls, not replace them.6 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala