An SBOM for your AI: taking inventory of every model, dataset and prompt in a repo

A security reviewer sent me a questionnaire last quarter with a question I could not answer from memory: list every third-party model, dataset, and embedding source your service depends on, with its l