Enterprise platform team builds a support assistant from registry-pulled open-source components
- Organization
- Meridian Logistics Group
- Vendor / dependency
- RouteHelp (internally built assistant from open-source components)
- Industry
- Generic business
- Headline dimension
- 7.4 Open source components in the pipeline
Description
What the agents read
Meridian Logistics Group, a 35,000-employee freight and logistics company, runs RouteHelp, a customer-support knowledge assistant built by its internal platform team from open-source components: an embedding model downloaded from a public model hub, a tokenizer and orchestration framework installed from a public package registry, and a self-hosted vector database. Everything runs in Meridian's own cloud account and no commercial AI vendor is involved; the company adopted the stack deliberately to avoid vendor exposure.
Dependencies are pinned by version but not by hash, the deployment pipeline pulls updates weekly, and no one reviews model-card or package changes before they reach production. A compromised or maliciously updated package, model file or tokenizer would execute with access to the support knowledge base and 40 million customer shipment records, and its outputs would flow straight to customer-service agents in twelve countries. The company can swap any component for an alternative in days, has no contractual counterparty to give it notice, and is not subject to sector regulation beyond general data-protection law.
Expert reading by hazard class
For comparison after a live run; never sent to the pipeline
| Class | Carried by | Score | Rating |
|---|---|---|---|
| 1 Whose AI brain is this, really? | 1.2 Model weight custody / control | 0.8 | LOW |
| 2 What are we feeding it? | 2.2 Internal documents ingested for RAG | 1.2 | LOW |
| 3 What does it create from our data: and where does THAT go? | 3.1 Embeddings | 0.8 | LOW |
| 4 Who's deciding what the AI sees and does? | 4.2 Orchestration / agent framework | 6.1 | MEDIUM |
| 5 Which humans are actually looking at our stuff? | 5.3 Support / debugging access | 0.5 | LOW |
| 6 Who's holding the steering wheel? | 6.4 Configuration and policy management | 3.2 | LOW |
| 7 How many companies are really in this chain: and did we agree to it? | 7.4 Open source components in the pipeline | 6.1 | MEDIUM |
Findings
Expert 'what we found' per class, with the vector each score is computed from
- LOW0.8
1 Whose AI brain is this, really?
1.2 Model weight custody / controlThe generation and embedding models are open-weight files that Meridian holds and runs itself. Nobody can revoke them, and the platform team chooses when to update. A future model release could change licence terms, but the current files are Meridian's to keep.
Meridian owns the brains outright; the only thing that can change them is Meridian.
SOV:1.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:M/IR:H/AR:M/R:A/V:D · Low
- LOW1.2
2 What are we feeding it?
2.2 Internal documents ingested for RAGAgent questions and the support knowledge base, which includes shipment records, stay inside Meridian's cloud account. The assistant reads but takes no actions on other systems. The exposure is not where the data goes but what code runs next to it.
Nothing leaves; the question is what has been let in.
SOV:1.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:M/IR:H/AR:M/R:A/V:D · Low
- LOW0.8
3 What does it create from our data: and where does THAT go?
3.1 EmbeddingsEmbeddings of the knowledge base are generated and stored in Meridian's own vector database. They are as reversible as anyone else's, but the only party that can reach them is Meridian. Outputs and feedback are logged to Meridian's own systems under its retention rules.
The derived data exists but never leaves the company's control.
SOV:1.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:M/IR:H/AR:M/R:A/V:D · Low
- MEDIUM6.1
4 Who's deciding what the AI sees and does?
4.2 Orchestration / agent frameworkThe orchestration framework and its plugins come from a public registry and are updated weekly by the pipeline without review. A malicious or compromised release of the framework decides what the assistant retrieves, how it prompts the model and what it returns to agents. Meridian would learn of a compromise the way everyone else does: from the news.
Meridian runs the pipeline but did not write it, and lets it update itself.
SOV:1.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/R:A/V:D · Medium
- LOW0.5
5 Which humans are actually looking at our stuff?
5.3 Support / debugging accessThere is no vendor, so no vendor staff read anything. Only Meridian's own platform engineers can access logs, under the company's normal access controls.
No outside humans at all.
SOV:1.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:M/IR:H/AR:M/R:A/V:D · Low
- LOW3.2
6 Who's holding the steering wheel?
6.4 Configuration and policy managementConfiguration lives in Meridian's own repository behind its identity system. But the deployment pipeline has standing permission to pull and apply new package and model versions weekly, so a change made upstream by a stranger reaches production through Meridian's own automation with no human in the loop.
Meridian holds the steering wheel, but has wired it to accept turns from the internet once a week.
SOV:1.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:P/CR:M/IR:H/AR:M/R:A/V:D · Low
- MEDIUM6.1
7 How many companies are really in this chain: and did we agree to it?
7.4 Open source components in the pipelineNo commercial vendor is in the chain, but the maintainers of the embedding model, the tokenizer, the framework and every one of their dependencies are. Any of them, or anyone who compromises their accounts, can ship code that Meridian will run against 40 million shipment records within a week, and there is no contract, notice obligation or accountability anywhere in that chain. MITRE ATLAS records real incidents of exactly this pattern.
Meridian avoided every vendor and inherited every maintainer; the chain is long, anonymous, and owes Meridian nothing.
SOV:1.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:A/CR:M/IR:H/AR:M/S:N/AU:Y/R:A/V:D/RE:L · Medium
What the organization should do next
- Pin every package and model file by hash, not version, and require a reviewed change for each update; stop the weekly auto-pull.
- Mirror the registry and model hub internally and scan components before promotion, so production only pulls from a Meridian-controlled source.
- Add the assistant and its open-source components to the software bill of materials and the AI inventory, with named owners.
- Give the platform team a tested procedure to roll back or swap any component within a day, since fast exit is this stack's main advantage.
Questionnaire answers
22 of 22 answered · these seed the metric priors
Show all 22 answers
| OP-CR | How damaging would unauthorized disclosure of the data this AI dependency handles be for your organization?Moderate: internal business data |
| OP-IR | How damaging would an undetected change in this dependency's behaviour or outputs be?Severe: outputs drive automated actions, regulated decisions or safety-relevant processes |
| OP-AR | How long could your organization operate acceptably without this AI capability?Days: material business disruption |
| CL-CATEGORY | Which taxonomy category best describes the dependency you are assessing?Subprocessor and supply chain: downstream subprocessors, silent AI features, infrastructure providers, open source |
| D-AV | Where does this dependency run, and who can reach it?Operated by a subprocessor of the vendor (a further hop from your contract) |
| D-AC | What would the vendor, a subprocessor, or a legal authority have to overcome to access the data or change the service?Nothing beyond its standard terms of service or routine legal process |
| D-AT | Can the vendor exercise this control at any time, or only when something specific happens?Only upon a specific event: sanctions designation, litigation hold, security incident, product decision |
| D-PR | Who is in a position to exercise this control?Any party already in the subprocessor chain |
| D-UI | Does the exposure require any action by your organization?Ordinary use of the service is enough to trigger it |
| D-VC | At this dependency itself, how much confidentiality could be lost?Partial: limited or indirect exposure (metadata, fragments, aggregates) |
| D-VI | At this dependency itself, how much could its behaviour or outputs be altered without your knowledge?Full: behaviour can be changed silently and materially |
| D-VA | At this dependency itself, could the capability be withdrawn or degraded by the exercising party?Partial: degraded service or temporary loss |
| D-SC | Beyond this dependency, how much confidentiality could be lost at other systems or parties?Partial |
| D-SI | Beyond this dependency, could downstream systems or decisions be altered?Full: downstream systems act on altered outputs without detection |
| D-SA | Beyond this dependency, what would stop working, and could anyone be harmed?Some downstream workloads degrade |
| D-E | Has this kind of control actually been exercised against organizations like yours?Yes, documented real-world cases against comparable organizations |
| D-R | If the vendor relationship ended tomorrow, could you reconstitute this capability elsewhere?Yes, with no loss: exported weights, portable data, standard interfaces |
| D-V | How many of your AI workloads depend on this component?One narrow workload |
| D-S | Would a loss of control here, on its own, trigger a reportable regulatory violation?No |
| D-AU | Could the loss event happen to all of the vendor's customers at once, with no case-by-case decision?Yes |
| D-RE | How much effort would it take to exit this dependency or otherwise mitigate the exposure?Trivial: swap-out or a contractual fix |
| D-U | How does the vendor notify you of sovereignty-relevant changes (model versions, subprocessors, hosting, terms)?Unknown |
Notes: Expert reviewed. Primary vector derived from the questionnaire answers; category vectors and findings confirmed on review. The 'exercising party' framing is strained here, as the rubric's limitations section anticipates: the counterparties are anonymous maintainers, not a vendor.