What it is
An AI-BOM lists the foundation models, fine-tunes, embeddings, data sources, and plugins an agent relies on, similar to a software bill of materials for code dependencies. It gives teams traceability into how an agent actually produces outputs.
Why it matters
Regulators, security teams, and customers increasingly ask 'what's inside your AI?' An AI-BOM lets mid-market IT teams answer quickly and pass vendor risk reviews.
Key components
- model inventory
- data lineage
- dependency tracking
- audit trail
How it connects
Agent governance records — which models, prompts, and data sources each Agentforce agent uses — are the raw material for an AI-BOM.
Good to know
Treat AI-BOM as a living document — update it every time you swap a model or add a new grounding source.
Related terms
Agent Governance
The policies, controls, and monitoring systems that ensure AI agents operate safely, compliantly, and within business-approved boundaries.
Guardrails
The boundaries you set on AI agents to control what they can discuss, what actions they can take, and when they must escalate to a human.
Threat Modeling (AI Agents)
A structured way to identify what could go wrong with an AI agent before it does — mapping attackers, attack surfaces, and impacts so you can build defenses in.
AI Red Teaming
Deliberately attacking your own AI agent with tricky prompts and jailbreaks to find weak spots before customers or attackers do.
