Short answer

The AI supply chain includes models, prompts, documents, connectors, packages, runtimes, and configuration. Any unreviewed change can alter behavior.

Boundary

Record provenance, versions or digests, approvals, and a tested rollback.