This is the official k8s-aibom property namespace and name taxonomy for CycloneDX, registered in the CycloneDX Property Taxonomy and administered by the k8s-aibom maintainers. It follows that repository’s grammar: a top-level namespace, colon-separated sub-namespaces, and a name.
The key words “MUST”, “SHOULD” and “MAY” are to be interpreted as described in RFC 2119.
Status and transition
k8s-aibom documents through v1.6 emit these facts under dotted names (aibom.workload.kind, runtime.name, signature.status, …) that predate the namespace registration. From v1.7 the controller emits the colon-delimited names in this document. The rename changes document bytes for identical inputs and ships in the same release as the other CycloneDX-alignment changes (pkg:oci purls, metadata.lifecycles), so downstream consumers see one byte-shape transition. The mapping is given in the last section; within a release, documents remain byte-deterministic.
Design principle, inherited from the project: every property is a fact observed from the Kubernetes API or declared by the workload owner, never a judgment. Confidence and evidence travel with each fact so an auditor can trace it back without cluster access.
Sub-namespaces
Namespace
Description
Property of
k8s-aibom:workload
Identity of the Kubernetes workload the document describes
metadata.component
k8s-aibom:controller
The emitting controller
metadata.properties
k8s-aibom:scrape
Provenance of each scrape that contributed
metadata.properties
k8s-aibom:evidence
Where in the Kubernetes object a fact was read
components, services
k8s-aibom:runtime
Attributed serving/agent/training runtime
application components
k8s-aibom:identity
How a model identity claim was obtained
machine-learning-model components
k8s-aibom:image / k8s-aibom:container
Container image reference and container identity
container components
k8s-aibom:volume
Model storage mounted into a container
data components
k8s-aibom:dataset
A volume a training or evaluation job reads as a dataset
data components
k8s-aibom:dependency
A remote model API the workload calls
machine-learning-model components
k8s-aibom:security:signing
Model signature claim and verification outcome, relative to the project’s published verification process
machine-learning-model components
k8s-aibom:rollup
Workloads absorbed into this document under the ownership roll-up
Name of the i-th scraper that contributed (inference.spec, inference.dynamo, …). Zero-based index; MAY occur once per scraper.
k8s-aibom:scrape:<i>:scraperVersion
That scraper’s version.
k8s-aibom:scrape:<i>:method
How it read the object (spec).
k8s-aibom:scrape:<i>:timestamp
RFC 3339 scrape time.
k8s-aibom:confidence and k8s-aibom:evidence
Property
Description
k8s-aibom:confidence
On metadata.properties: aggregate confidence of the document. On a component: confidence of that fact. Values: declared (written by the workload owner), inferred (derived by heuristic), verified (declared and cryptographically verified), unresolved.
Volume name, mount path and backing source kind for a model-storage mount.
k8s-aibom:dataset:path
Mount path of a volume a training or evaluation job reads as a dataset (a mount named dataset or training-data, or one at /data).
k8s-aibom:dependency:type
remote-api on a model component that stands for an external model API (openai-api, anthropic-api, …), found from an API-key environment variable.
k8s-aibom:model:revision
Model revision when the source API declares one.
k8s-aibom:security:signing
These properties are meaningful relative to the verification process documented in docs/security-model.md and Design 002; documents link that process via an externalReference. They are never properties of a model in isolation.
Property
Description
k8s-aibom:security:signing:status
claimed (a signature reference exists but was not verified), verified. Absent when the workload declares no signature reference; readers treat absence as unsigned.
k8s-aibom:security:signing:outcome
Verification outcome, distinguishing a signature valid against an operator trust root with a signer-identity constraint from one that is merely well-formed.
k8s-aibom:security:signing:identity
Verified signer identity.
k8s-aibom:security:signing:rekorEntry
Transparency-log entry reference.
k8s-aibom:security:signing:reason
Why verification did not succeed, when it did not.
k8s-aibom:security:signing:subjectNameMismatch
true when the signed subject name differs from the declared identity.
k8s-aibom:rollup
Property
Description
k8s-aibom:rollup:owned:<i>
Kind/name of a tracked workload absorbed into this document because the subject owns it (Design 005). Sorted; MAY occur once per absorbed workload.
Facts that the CycloneDX core model expresses natively are not and will not be properties: as-deployed context is metadata.lifecycles (phase: operations), image identity is the component purl, and hashes are component.hashes.