Skip to main content
Agents are missing metadata fields such as name, library, supplier, or manufacturer. Note: This rule is analogous to ID-1a: Missing Model Metadata, with parallel governance and security implications. The same metadata completeness requirements apply, but they are evaluated at the agent level rather than the model level.

​
How to resolve

AI-SPM discovers AI assets via automated static code analysis and generates a comprehensive Software Bill of Materials (AI-SBOM). This issue occurs when required metadata, such as name, library, supplier, or manufacturer cannot be extracted or validated.
  • Manage access permissions: Verify the scanner has read access to all relevant repositories, submodules, dependency files, and private registries. Confirm IAM roles, tokens, and storage permissions grant the required access.
  • Verify required metadata: Ensure models are explicitly declared with a clear name, library, supplier, and a pinned, immutable version where possible (avoid floating tags such as latest or unversioned references). Also, review the repository for unsupported file formats or corrupted artifacts that may block metadata extraction.

​
Risk

Governance/Compliance Missing agent metadata violates foundational requirements across multiple AI governance standards:
  • NIST AI RMF (GOV-1, GOV-3): requires clear documentation of provenance, ownership, and dependencies to ensure accountability and transparency.
  • ISO/IEC 42001 (AI Management System): mandates complete and accurate technical documentation for all AI assets.
  • ISO/IEC 23894 (Risk Management): calls for reliable metadata to assess system-level risks, dependencies, and lifecycle controls.
  • EU AI Act (Technical Documentation Articles 9–13): requires detailed technical documentation for AI systems—including origin, supplier, and technical characteristics—as part of mandatory documentation.
Across these standards, the expectation is consistent: agents must include complete metadata to establish provenance, trace responsibility, and support regulatory audits and lifecycle management. Security Missing agent metadata—such as name, library, supplier, or manufacturer—makes it difficult to confirm the agent’s origin, trustworthiness, and update path. This creates gaps that attackers can exploit through unauthorized modifications or supply-chain substitution, and it slows down incident response because the agent cannot be reliably tied to a trusted source or maintainer.

​
Explanation

Agent metadata encodes provenance, ownership, and accountability. Fields like name, library, supplier, and manufacturer establish traceability across the agent’s lifecycle. Missing metadata creates ambiguity around:
  • who created or maintains the agent
  • what library or framework it relies on
  • whether the agent originates from a trusted provider
  • who is responsible for updates, patches, and incident response
This reduces transparency, weakens governance controls, and makes it harder to detect or investigate configuration or supply-chain risks. High-quality metadata is foundational to system cards, operational documentation, and technical records recommended by OpenAI, Anthropic, and required under EU AI Act guidance.

​
Specifications

Trigger The agent is missing any of the following:
  • name is empty
  • library is empty and agent is non-Managed
  • supplier is empty
  • manufacturer is empty
Severity
  • LOW — Missing name
  • MEDIUM — Missing library (non-Managed)
  • HIGH - Missing supplier/manufacturer
Applies to: Agent