Related Big Reads: The fragile foundation beneath the $7 trillion AI bet; The dependency nobody vetted: how AI tooling became a supply chain vulnerability
Related assets: Agentic blast radius; Proof before power
Supply chain risk is not new.
In April, the scale and variety of those dependencies became harder to ignore. Massive capital flows, accelerated development pipelines, open-source packages, agentic workflows, and infrastructure concentration were turning provenance from a technical hygiene concern into an executive control question.
The issue is simple:
If an organisation cannot prove where a component came from, how it changed, and whether it was verified before use, every downstream control inherits uncertainty.
This is a high-level toolkit for establishing that control conversation. It helps leaders and engineering teams identify the evidence they should expect before trusting a component. It does not prescribe a complete implementation, vendor configuration, or incident-response playbook. Those can be developed separately where the risk or use case justifies the additional depth.
When to apply this toolkit
Use this toolkit when:
- onboarding open-source dependencies into production pipelines
- responding to a supply-chain compromise disclosure
- auditing CI/CD security before a major architecture change
- reviewing AI agent skills, packages, or extension ecosystems
- engineering teams are prioritising deployment velocity over provenance
High-level approach
Inventory dependencies
Generate a full software bill of materials for production and CI pipelines. Include transitive dependencies, not only direct imports.
Use hash-locked artefacts
Generate lockfiles with cryptographic hashes for package managers in use. Treat lockfiles as controlled artefacts under source control.
Enforce verification at build time
Configure builds to fail by default if downloaded package hashes deviate from expected values. Prevent dynamic code fetching during build where possible.
Monitor registry and advisory signals
Subscribe to security advisories for package registries in use. Alert when a package already ingested receives a security flag.
Restrict override authority
Limit who can change lockfiles or override hash-verification failures. Treat bypass permissions as privileged access events.
Path to maturity
These levels describe increasing confidence, and an organisation can be advanced in one part of the supply chain and still be at baseline in another.
Baseline
At this level, lockfiles record the expected versions and cryptographic hashes of dependencies, and builds fail when a downloaded artefact does not match those expectations. The control is present, but visibility may still be limited to individual projects or pipelines.
Managed
At this level, the organisation can see what entered each build. A software bill of materials is generated for every build. It records the components and versions present in the resulting software, including relevant transitive dependencies. Anomaly alerting is active, so teams can investigate unexpected changes or newly reported risks rather than relying on manual discovery.
Advanced
At this level, the organisation controls more of the path between a public source and a production build. Packages are cached in an internal registry, verified before admission, and then reused from that controlled location. This reduces exposure to changing public registries and makes the approved source of a dependency easier to identify.
Optimised
At this level, the build system produces signed provenance attestations for each artefact. These records connect the artefact to its source, dependencies, build process, and relevant approvals. Audit evidence exists per artefact, allowing the organisation to demonstrate not only what was built, but how it was built and under whose authority.
The executive test
Ask your engineering lead:
Can you prove which dependencies entered the build, who approved exceptions, and what would happen if a trusted package became hostile tomorrow?
If your answer is no, you are borrowing trust from the supply chain without enough proof.
