The AI factory lifecycle

Six stages, four kinds of asset

Each stage has a gate. Nothing reaches the next stage without clearing it, and every gate writes to the same record.

1. Stage 1

   Source

   Record where everything comes from. Nothing is trusted for its origin.

   Models

   Pulled from Hugging Face, NVIDIA NGC, an OCI registry, your own training runs or an air-gapped mirror into an isolated intake zone.

   Data

   Documents, datasets and runtime uploads tagged with tenant, source and uploader before anything else happens.

   Agents

   Agent packages, skills and MCP servers received as untrusted software, whoever wrote them.

   Prompts and APIs

   Callers identified: user, tenant, service or agent, with the session attached.

2. Stage 2

   Ingest

   Check the contents before anything is unpacked, indexed or run.

   Models

   Malware, unsafe serialization and CVEs scanned; an ML-BOM built of weights, datasets, licences and dependencies.

   Data

   Malware detonated in a sandbox, PII redacted or rejected, and every chunk traced to a source.

   Agents

   Static analysis, dependency and secret scanning, and skills inspected for hidden instructions.

   Prompts and APIs

   Content encrypted in transit under your keys; authorization checked before inspection.

3. Stage 3

   Test

   Attack it before anyone else does.

   Red teaming

   Models

   Adversarial suites for injection, jailbreak, encoding and leakage run before approval.

   Data

   Retrieval tested for poisoned or unverified content and cross-tenant leakage.

   Agents

   Tool abuse and goal-hijack scenarios run against the agent in its sandbox.

   Prompts and APIs

   Guardrail thresholds tuned against the findings; new findings become new rules.

4. Stage 4

   Release

   One hard boundary between candidate and production.

   Models

   Signed, registered with lineage, and promoted only by a policy that sees signature, scan and ML-BOM.

   Data

   Signed and encrypted, then written to the index only through the vector gate.

   Agents

   Registered with version, SBOM, skill and MCP inventory, then given a workload identity and a policy.

   Prompts and APIs

   Runtime policy bound per model class, so it follows the model wherever it serves.

5. Stage 5

   Run

   Every call is a decision, in both directions.

   Models

   Served with guardrails attached at creation; a model can't be served without its runtime policy.

   Data

   Queries encrypted and matched against encrypted vectors; results decrypted only for the entitled user.

   Agents

   Sandboxed, with every tool, model and data access mediated and checked against identity.

   Prompts and APIs

   Injection and jailbreak checks in, PII and secret filters out, rate limits and budgets throughout.

6. Stage 6

   Observe

   Keep the record, watch for drift, close the loop.

   Models

   Drift tracked against a reference window, alongside latency and policy violations.

   Data

   Every PII action, provenance check and gate decision kept in the record.

   Agents

   Traces of every action feed the same incident chain as every other band.

   Prompts and APIs

   Blocks and findings forwarded to your SIEM and worked in your SOC.

Which band does the work

The lifecycle is the same four bands seen in time order.