Law · SLSA v1.0
SLSA v1.0 for legal AI workflows
SLSA v1.0 in legal AI workflows: what compliance requires, who asks for evidence, and the records to keep.
01 / The rule
What SLSA v1.0 requires
Software producers and build platform operators that want to show build integrity, and consumers verifying artifacts.
- 01Build L1: follow a consistent build process and generate and distribute provenance describing platform, process and top-level inputs.
- 02Build L2: run builds on a hosted build platform that signs the provenance.
- 03Build L3: use a hardened platform that isolates runs and keeps signing secrets from user-defined build steps.
- 04Consumers verify provenance against expected builder, source and parameters before use.
02 / In this sector
In a legal AI workflow
Build provenance can apply to model training or packaging pipelines that produce AI artifacts, but SLSA does not address models or data specifically.
General counsel and litigation support.
FRE 702 · ABA Model Rules.
03 / Records
Records to keep
- 01Signed SLSA provenance attestations per artifact
- 02Build platform SLSA level documentation
- 03Verification summary attestations (VSAs) or verifier logs
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
OpenSSF SLSA project
OpenSSF SLSA project
OpenSSF SLSA project
OpenSSF SLSA project
RELATED
Related: SLSA v1.0: the full guide · SLSA v1.0 for defense · SLSA v1.0 for medicine · SLSA v1.0 for education