04 from AI-BOM at Admission — The Cluster Refused a Signed Model for Its Licence
Admit a model by its AI-BOM, not by its signature
Models arrive as files from a model hub, with the licence written in a card meant for people, and the usual admission policy asks only where the image came from and who signed it. This procedure makes the cluster read what the model is before it mounts it.
Every step below runs daily on a public reference architecture, with planted pods that must be refused for the right reason.
- 1
Give every model one lock line
Its name, the publisher's file pinned at a forty-character revision, the file's SHA-256, its licence as SPDX ids and the image digest. The ML engineer who owns the model choice writes it; legal reviews the licence before it merges.
- 2
Write the AI-BOM from that line, the same bill every time
A CycloneDX 1.6 bill with one machine-learning-model component, no timestamp, and a serial number derived from the file's hash. An SPDX expression such as A OR B is concluded to ids here, where the site's list is known, never at admission.
- 3
Validate every bill on every push
cyclonedx-cli validate --input-version v1_6 --fail-on-errors, pinned by digest, with a planted invalid bill that proves the check can fail. - 4
Attest the bill with the key admission already trusts
cosign attest --type cyclonedxwith the operator's key, the same key that signs the image. - 5
Read the bill before the model mounts
A Kyverno ImageValidatingPolicy that names image volumes itself (
spec.volumes[].image.reference), because Kyverno 1.19 does not check them unless a policy asks. It verifies the attestation before reading it, and refuses unless every model in the bill declares only allowed ids, with no expression. - 6
Plant a refusal for every rule and run them daily
A signed model that must be admitted; then unsigned, signed by a stranger, no bill, a disallowed licence, by tag, from another registry, an allowed id beside a non-commercial one, an expression, and a second model with no licence. Each must be refused by its own message.
One row per model
| Field | Example: granite-4.0-1b | Owner |
|---|---|---|
| The publisher's file, pinned | ibm-granite/granite-4.0-1b-GGUF at b27c2fe3f211b7f44e80fa620177aea371099aaa | ML engineer |
| SHA-256 of the file | 22ec0f9cc99a90185312de3c882c84e7bd6789bdd050389844380a01a831d7f1 | ML engineer |
| Licence, as SPDX ids | Apache-2.0 | Legal, in the pull request |
| Image digest | Checked against the lock line on every build | Platform team |
| Bill attested | With the operator's key, the one that signs the image | Operator |
| Licences the site allows | Apache-2.0, MIT; a change is a one-line pull request legal approves | Security lead |
What shows it works
Each is a public run or commit.
- Run 39157806610, 18 October 2026: seven pods, one admitted and six planted, each refused by the rule it breaks; model-unlicensed refused for its licence alone.
- Run 39184384413, 19 October 2026: every model's AI-BOM validated against CycloneDX 1.6.
- Commit 9f6b1d9, released in v1.6.0 on 21 October 2026: every licence of every model is checked, and an expression is refused at admission.
- Scheduled run 43224131644, 12 November 2026: eleven model pods, among them Apache-2.0 beside CC-BY-NC-4.0 and a second model with no licence, each decided as planted.
The bill records what the operator declares; it does not inspect the weights. A wrong licence typed into the lock line is a signed wrong licence. The runs are on kind, on CPU, on one node, and signatures are checked by key with no transparency log.
A rule that accepts any one licence vouches for none of them.
The long version is the post AI-BOM at Admission. Kyverno, ImageValidatingPolicy; the issue to extract image volumes by default, open, last updated 4 November 2026. CycloneDX, version 1.6, 9 April 2024.