Before a third-party model reaches production, confirm who published it, what format the weights use, whether it needs custom code, which exact commit you tested, and that someone owns it. Run the first load in isolation, and keep a record of each decision.
The checklist
Origin
- Name the publisher and why you trust them. Check whether commits are signed and Verified.
- Read the license and the stated intended use.
- Note whether it is a fine tune, and of which base model.
Format and code
- Prefer safetensors. If the weights are pickle based, load with restrictions such as weights_only=True in PyTorch.
- List any Python files in the repo. If the model needs trust_remote_code, read them first.
- Check config for entries that point at custom code.
Pinning and integrity
- Pin the full commit hash as the revision. See how to pin a model.
- Record a SHA-256 of each weight file.
Isolation
- Do the first load in a throwaway container with no credentials and a restricted network. Both TensorFlow's and PyTorch's security policies say running an untrusted model is equivalent to running untrusted code.
Records and ownership
- Add it to the artifact register: source, revision, format, hash, approver, date.
- Assign an owner who will review upgrades.
- Decide how you will retire it, and what replaces it.
Why each group matters
| Group | Failure it prevents |
|---|---|
| Origin | Using a model from an account you cannot place |
| Format and code | Running code from a file that looked like data |
| Pinning | Silent changes to files after review |
| Isolation | A bad first load touching your secrets |
| Records | Not knowing where a model came from during an incident |
Make it enforceable
A checklist that lives in a wiki gets skipped. Put the key items into the pull request that adds the model, so a reviewer sees the pinned revision, the format and the reason. A gate that blocks a merge when a new loader is added without a pinned revision turns advice into a rule.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a policy gate holds a pull request until a rule is met, then think about which of the twelve items above could be a rule.
Where Safeguard fits
Safeguard provides policies and gates on pull requests, SBOM and dependency scanning, and compliance evidence automation, which suits the repeatable parts of this list. Run a free scan at gold.safeguard.sh/scan.
Quick check
Do I need all twelve for a small internal prototype?
Not all, but origin, format, pinning and isolation are cheap and cover the biggest risks. Add the rest before it moves toward production.
Who should own a third-party model?
A named person or team, the same as for any dependency, so upgrades and retirement do not fall through the cracks.
Sources
Last reviewed: 19 October 2026.
