Proposal for a runtime AI Assertion Record / chain-of-reliance extension to ML-BOM

[tbarrett002-boop]

Opening a discussion on whether CycloneDX / ML-BOM should support a runtime chain-of-reliance record that links static AI artifact documentation to specific AI-supported decisions.

The starting distinction is simple: ML-BOM is the manifest. AACIF is the runtime chain-of-reliance record. ML-BOM and related bill-of-materials artifacts can identify important facts about the model artifact, datasets, dependencies, provenance, architecture, and evaluation. That upstream manifest is necessary. But consequential AI risk often materializes after the manifest ends: during retrieval, inference, tool use, integration, human review, workflow transformation, action, and later audit or recovery.

AACIF (the AI Assertion and Chain Integrity Framework) proposes a structured AI Assertion Record that carries the evidentiary basis of an AI-supported judgment through those downstream layers. It is organized around seven assertions — temporal state, knowledge state, population, measurement, language/perspective, translation, and chain integrity — applied across a twelve-layer chain from deployment envelope through audit/recovery. The intent is to preserve, at runtime, what the system knew, what it relied on, what uncertainty it carried, how a score or output was translated into action, and whether the record survived each system handoff.

I am not asking CycloneDX to adopt AACIF in full. The narrower technical question is whether CycloneDX, ML-BOM, CDXA, or related work should support a runtime AI Assertion Record or chain-of-reliance extension. Possible areas for discussion:

Mapping AACIF fields to existing CycloneDX / ML-BOM structures;
Identifying fields not currently covered by ML-BOM because they arise at runtime;
Defining a decision-chain extension for retrieval, inference, human review, action, and audit;
Creating a sample JSON schema for AACIF records;
Testing AACIF against one high-consequence AI workflow;
Determining whether this belongs as an extension, profile, attestation pattern, or separate companion specification.

AACIF's contribution is not to replace ML-BOM. It is to define the record for the half of the chain that starts after the AI manifest is relied upon.

Happy to share the AACIF Formal Submission Brief for review, with the full working paper as background on request.

thom barrett
Living Life Press / AACIF Working Group
tbarrett002@gmail.com