When I first wrote about post-quantum readiness in AI infrastructure, the artifact plane appeared as one of three surfaces under pressure, named, defined, and then largely left to the reader to develop. That was intentional. The argument I needed to make at the time was about cryptographic exposure across all three planes, not a deep treatment of any one. But the artifact plane deserves its own examination, because the failure modes there are distinct, the institutional responses have lagged the furthest, and the stakes are higher than most teams have modeled.
What the Artifact Plane Actually Contains
The three-planes framework I introduced in the post-quantum piece maps the surfaces where pressure accumulates differently in AI systems. Control planes govern coordination and trust. Data planes move information at throughput. Artifact planes are where the outputs of investment, the things you built, live, move, and accumulate exposure over time.
AI systems invert the typical artifact lifecycle. The artifacts that matter most, training corpora, fine-tuned weights, embeddings, human feedback datasets, are long-lived by design, and they appreciate rather than depreciate. A corpus that took two years to assemble and annotate does not expire when the first model trained on it ships. Weights fine-tuned on proprietary customer interaction data carry that sensitivity for as long as they exist. And these things do not sit still: they move between training clusters and registries, out to inference endpoints and regional replicas, through CI/CD, into partner integrations and audit systems. Every one of those movements is an exposure event, and most organizations have never modeled a single one.
Provenance Is the Security Primitive the Artifact Plane Requires
Each plane has a primitive its security rests on. On the control plane it is identity: who is this actor and what may they do. On the data plane it is confidentiality and integrity in motion. The artifact plane runs on provenance, which is a harder thing to hold: what produced this, what has happened to it since, what assumptions did it come with, and do those assumptions still hold.
Provenance is the chain of custody and the chain of causality, and it answers a different question than access control does. Not “who can read this model” but “what training data produced these weights, under what conditions, with what preprocessing, validated by whom, updated when” — and whether the artifact has been modified since anyone signed it.
When a company I worked for acquired a forensic SaaS platform built around cloud-scale packet storage and security analytics, I was one of the engineers handed the integration work. The due diligence had been thorough. The product did what it claimed. What the evaluation had not surfaced was the deployment model leadership intended: not SaaS, but hardware appliance. The architect who assessed the product was never told. The platform worked because cloud storage was elastic. On fixed hardware, the full-fidelity capture the product was designed for was not achievable. By the time the constraint was understood, the acquisition had closed, the engineers had relocated, and the marching orders had been issued. The artifact, in this case the product itself and every assumption baked into its architecture, had been evaluated against a deployment context that never existed. So provenance is not only a question of what produced a thing. It is a question of what the thing assumes, whether anyone ever said so out loud, and whether the environment receiving it was built to honor those assumptions.
That failure predates AI infrastructure by years. The artifact plane did not invent the failure mode; it multiplied it. There are more artifacts carrying unstated assumptions, they spread across more systems, and they stay in production longer than anything that came before them.
The Lifecycle Surface Nobody Manages
Most artifact governance frameworks address the creation event. A model is trained, evaluated, signed, registered. The pipeline that produces it has been reviewed. The evaluation benchmarks have been passed. From a compliance standpoint, the artifact is approved.
The creation event is the smallest part of the lifecycle surface.
After creation, a model enters a distribution phase: replicated to inference endpoints, cached at regional PoPs, pulled into partner integrations, forked into fine-tuning pipelines. Each copy is a new node on the provenance graph carrying its own exposure surface, and most organizations have no inventory of those nodes. They know where the canonical version lives. Past that, visibility into derived and cached copies thins out fast, and there is usually no way to propagate a revocation to them at all.
This is not a hypothetical gap. In federated learning and multi-party training contexts, model weights and gradient updates cross organizational boundaries, traverse networks with varying security postures, and land in environments the originating organization cannot audit. The artifact’s lifecycle has escaped the creating organization’s control plane. The cryptographic assumptions protecting it in transit are what the three-planes section of the post-quantum piece addressed directly. The governance assumptions about where it ends up, what it carries, and what happens to it after transfer are a separate and largely unaddressed problem.
After distribution comes the longest phase: production operation. Artifacts accumulate operational history. They interact with live data, produce outputs that feed downstream systems, and carry an implicit claim that their behavior is still acceptable given current conditions. That claim degrades quietly. Datasets drift from the distributions they were collected under, models trained on historical data meet input patterns nobody anticipated, and embeddings built against an older semantic space get queried with content from a different era. None of this trips an alert. It shows up as degradation and inconsistency, and as the kind of gradual behavioral shift that gets attributed to everything except the aging artifact.
The retirement event is where lifecycle management fails most visibly, because for most organizations it does not exist. Artifacts are superseded rather than retired. The old model stops receiving traffic when the new one is deployed, but the weights remain in the registry indefinitely. The training corpus is archived. The intermediate checkpoints persist in object storage because storage is cheap and deletion feels risky. What accumulates is a growing inventory of artifacts whose security assumptions are no longer being evaluated, whose access controls may not have been revisited since the team that created them changed, and whose exposure surface continues to grow.
The Post-Quantum Update
When I published Post-Quantum Readiness in AI Infrastructure, I focused on AI assets specifically, model weights, training corpora, embeddings, as the primary argument for why harvest-now-decrypt-later is a present risk rather than a future one. That framing was accurate but narrow.
The artifact plane extends well beyond AI assets. Firmware images, certificate chains, signed software releases, regulatory audit records, embedded database snapshots sitting across a product install base: all of these are long-lived artifacts whose security rests in part on how strong the cryptography around them turns out to be. The AI version of the argument lands hardest because the assets are worth the most and are piling up the fastest, but the problem is the same anywhere an artifact outlives the cryptographic assumptions it was created under. Post-quantum readiness is an artifact lifecycle problem that AI infrastructure happened to make urgent.
What Mature Artifact Governance Looks Like
None of the practices are exotic, and most of the components already exist. What is missing is the composition and the discipline to keep it running.
Signing at creation is table stakes and largely understood. Every artifact that enters a registry should have a cryptographic signature establishing what produced it and when. Frameworks like Sigstore and SLSA provide the plumbing; the gap is organizational rather than technical. Most teams that have not done this find that the blocker is not tooling but policy: no one owns the requirement.
Inventory that persists beyond deployment is less common. Organizations that do this well maintain a running manifest of where artifacts exist across environments, including cached, forked, and partner-held copies. The manifest is not maintained manually, it is generated from the pipeline events that create each distribution node. Revocation is only meaningful if the inventory is accurate, and manual inventory degrades immediately.
Provenance verification at inference time is rare, and the failure mode when it is absent is not always dramatic. A storage component we shipped at line rate achieved its throughput target by disabling fsync. The artifact passed every benchmark. It passed integration testing. Nothing in the verification chain could have detected what it carried, because the guarantee it violated was not a correctness property but a durability contract, invisible until a client’s power went out. The failures that followed were intermittent, took months to diagnose across a dispersed install base, and had nothing in the artifact to inspect. An inference endpoint should be able to answer, given the model currently loaded: what is its lineage, when was it last evaluated, against what benchmark, and is it the version that was approved. Most endpoints answer none of these. The operational value of being able to answer them is highest precisely when something unexpected is happening and the answer is not in the artifact itself.
Retirement as a first-class operation, rather than gradual decay into irrelevance, is almost entirely absent from how organizations manage artifacts today. A retired artifact should have its access controls explicitly revoked, its copies inventoried and disposition recorded, and its provenance chain preserved for audit purposes. The cost of doing this is low. The cost of not doing it, assets accumulating in environments that are no longer being governed, is paid during incidents and regulatory reviews.
Why This Has Lagged
The honest answer is incentive structure. Training a model and shipping it generates visible organizational progress. Governing its lifecycle, tracking where it went, checking its provenance at inference time, and retiring it when its time comes generate nothing that appears on a roadmap. All of it looks like overhead right up until it stops looking like overhead.
Security practice around a new infrastructure surface always arrives late, and the artifact plane is early in that arc. The incidents that will make this gap obvious have not happened yet, or have not become public. Meanwhile the exposure builds at exactly the rate models are trained, distributed, and left running.
Building artifact governance before you need it is cheap. Building it during an incident means doing it badly, under time pressure, while someone senior asks hourly for an update.
