Should AI-generated changes carry a portable provenance record?

I’m increasingly unsure whether every AI-agent change should ship with a portable, machine-readable provenance record: model and version, tools used, repository revisions, packages consulted, and the resulting diff. Consider a critical service where an agent updates a dependency, changes the manifest and lockfile, runs tests, and opens a pull request. That context could make review faster, especially alongside changelogs, tests, and dependency-diff checks.

But a “full context” record might also preserve proprietary prompts, internal code snippets, private repository names, or an engineer’s discarded experiments. SLSA and in-toto offer useful ways to attest to source, build steps, materials, and products, but neither makes the change correct or safe—and I’m not aware of a broadly adopted schema demanding every AI influence be captured. I’m leaning toward signed, minimal records with explicit redaction boundaries. Would you require, limit, or reject these records, and why?

I’d separate provenance into two layers. The pull request needs a durable claim about inputs, tools, and outputs; sensitive prompt/context material belongs behind access controls, or not in the record at all. If reviewers need the latter routinely, the design has already confused auditability with surveillance.

The distinction between traceability and trust is the important one. A signed record can establish that a declared process produced a diff. It cannot establish that the dependency update is appropriate, that tests were sufficient, or that the model understood the change.

Portable is doing a lot of work here. Portability makes downstream verification possible, but also makes accidental disclosure easier. I’d want field-level sensitivity labels and a way to prove that omitted context was intentionally omitted, not silently lost.

For the dependency scenario, I mostly want the boring artifacts: old and new versions, lockfile diff, registry source, agent identity, and test commands. The exact prompt that caused a one-line version bump adds little review value and creates a very large retention problem.

The adoption trap is that “record everything” sounds safer to buyers and feels unusable to developers. If attaching provenance doubles the review ceremony, people will route around it. A small required core plus optional evidence seems more credible than a perfect ledger.

I’d prefer the record to travel with the change but keep sensitive evidence local, addressed by hashes or content identifiers. That preserves some continuity without turning every agent session into a permanent export. Verification can then request details when policy actually requires them.

Enterprises will ask for retention, export, and legal discovery controls before they ask whether the schema is elegant. Prompt history may contain customer or trade-secret material. “The agent generated it” should not become a loophole for collecting everything around the developer.

Rejecting provenance entirely seems shortsighted for production changes. I’d record model/version, repository commit, package coordinates, generated diff, and checks run. Keep prompts out by default. If a team needs prompt-level reconstruction, that should be a narrowly justified exception, not the default workflow.

One concern: minimal records can create false comfort. If the agent quietly consults a second repository or external package, the neat record may be incomplete while looking authoritative. I’d rather label provenance as partial than make a clean-looking attestation that implies comprehensive capture.

The discarded experiments matter less for ordinary review than for incident response, but retention changes the social cost. Engineers will stop trying useful approaches if every failed prompt becomes an organizational artifact. Separate operational evidence from personal workspace history.

My vote is require the diff’s ancestry, not the author’s diary. We already struggle to read release notes and dependency changes carefully; adding a giant AI transcript will produce more metadata and less attention. Small records can still be useful records.

The interface will decide whether this feels like accountability or monitoring. Show reviewers the provenance that answers “what changed and from where?” Make private context visibly private, with deliberate sharing rather than a default upload. That boundary is a product decision as much as a security one.