---
type: GlossaryTerm
id: https://w3id.org/lmodel/slsa/knowledge/glossary/slsa-level
genre: reference
title: SLSA level
description: A rung within a SLSA track, such as Build L2 or Source L3; higher levels give better guarantees against supply chain threats at a higher cost to implement. The schema names them in its four level enums, such as SlsaBuildLevel.
resource: src/slsa/schema/spec/about.md
sources:
  - resource: src/slsa/schema/spec/build-track-basics.md
    title: the Build track level table
  - resource: src/slsa/schema/spec/source-requirements.md
    title: the Source track level table
  - resource: src/slsa/schema/spec/dependency-track.md
    title: the Dependency track level table
  - resource: src/slsa/schema/spec/build-env-track-basics.md
    title: the Build Environment track overview
  - resource: src/slsa/schema/slsa_core.yaml
    title: SlsaBuildLevel
  - resource: src/slsa/schema/slsa_source.yaml
    title: SlsaSourceLevel
  - resource: src/slsa/schema/slsa_dependency.yaml
    title: SlsaDependencyLevel
  - resource: src/slsa/schema/slsa_build_environment.yaml
    title: SlsaBuildEnvironmentLevel
definedBy:
  - https://w3id.org/lmodel/slsa/knowledge/references/slsa-specification
generated:
  by: process:ktl-librarian
  at: "2026-10-27T12:57:54Z"
status: draft
verified:
  - by: process:ktl-librarian
    at: "2026-10-30T23:13:40Z"
---

# SLSA level

A level is a step within one [track](slsa-track.md). The specification copy's `about.md` says that within each track, ascending levels indicate increasingly hardened security practices. Higher levels give better guarantees against supply chain threats but cost more to implement. Lower levels are easier to adopt but give only modest guarantees.

The specification copy defines these levels:

- **Build L0 to L3** (`build-track-basics.md`): L0 has no requirements. L1 needs provenance showing how the package was built. L2 needs signed provenance generated by a hosted build platform. L3 needs a hardened build platform.
- **Source L1 to L4** (`source-requirements.md`): L1 uses a version control system. L2 preserves change history and generates source provenance. L3 enforces organizational technical controls. L4 requires code review. A revision for which the source control system issues no verification summary attestation has Source Level 0.
- **Dependency L0 to L4** (`dependency-track.md`): The levels run from no requirements, through an inventory of dependencies and triaged known vulnerabilities, to dependencies consumed from sources under the producer's control, and proactive defence against upstream attacks.
- **BuildEnv L0 to L3** (`build-env-track-basics.md`): L0 has no requirements. L1 needs signed build image provenance. L2 needs an attested build environment instantiation. L3 needs a hardware-attested build environment.

The schema encodes the levels as enum values in four enums: `SlsaBuildLevel`, `SlsaSourceLevel`, `SlsaDependencyLevel` and `SlsaBuildEnvironmentLevel`. For example, `SlsaBuildLevel` runs from `SLSA_BUILD_LEVEL_0` to `SLSA_BUILD_LEVEL_3`, and `SlsaBuildEnvironmentLevel` from `SLSA_BUILD_ENV_LEVEL_0` to `SLSA_BUILD_ENV_LEVEL_3`.