Grafeas is an API specification designed for managing metadata about software resources including container images, virtual machine images, JAR files, and scripts. The tool provides a standardized approach to audit and govern software supply chains by enabling build, auditing, and compliance tools to store, query, and retrieve comprehensive metadata on various software components. Grafeas organizes metadata information into two main components: notes and occurrences. This structure allows third-party metadata providers to create and manage metadata on behalf of multiple customers while maintaining clear separation of concerns. The system supports fine-grained access control mechanisms for different types of metadata, ensuring appropriate permissions and security boundaries are maintained across different metadata categories and user roles.