Provenance class is the label attached to every fact an AI agent uses, saying where the fact came from and how much it can support. There are four classes: sealed, signed, declared and external. The class decides which actions a fact may justify, so a forged email cannot carry the same weight as a ledger record.
What are the four provenance classes?
| Class | Where it comes from | What is proven | Example |
|---|---|---|---|
| Sealed | An issuer, with a seal that makes any change detectable | Who issued it, and that it is unaltered | A statement issued with a verifiable seal |
| Signed | A named, accountable party or system of record | Who answers for it | A policy approved by its owner; a ledger balance |
| Declared | An identified person, with no independent proof | Who said it, not whether it is true | Income typed by an applicant |
| External | Outside the channels the business controls or verified | Nothing about origin | An inbound email, a web page |
The order matters. When two facts conflict, the stronger class wins unless a person decides otherwise. The guide to sealed, signed, declared and external sources works through the combinations.
Why does a fact need a class at all?
A language model reads a forged invoice and a real one in the same way. It has no internal sense of where text came from. If provenance is left to the model's judgement, the model can be talked into treating anything as fact, which is what prompt injection exploits.
A class stamped at the boundary, before the model sees the text, gives the platform something it can check at the moment of action. "This payment rests on an external claim" is a rule a machine can enforce. "This seems legitimate" is not.
How is a provenance class applied in practice?
At the point a fact enters the system. Each source in the agent's brief is registered with its class, so everything arriving from that source is stamped automatically. Facts then keep their class as they move through retrieval, reasoning and drafting, which is why provenance must travel with every fact rather than being attached to the final answer.
For example, a claims agent at an insurer assembles a settlement recommendation from a medical report issued with a verifiable seal (sealed), the claims system record (signed), the claimant's description of the loss (declared) and a repair quote emailed by a garage (external). The recommendation shows each figure with its class. The payment step checks that the settlement amount rests on sealed or signed facts, and holds it for a person if it does not.
The mechanics of stamping each source are covered in how to stamp the sources an AI agent uses with provenance.
How is a provenance class different from a data classification?
Data classification labels information by sensitivity: public, internal, confidential, restricted. It decides who may see the data. Provenance class labels information by origin and proof. It decides what the data may justify. A fact can be confidential and external at once, such as a leaked document, or public and sealed, such as a published fee schedule. You need both labels, and neither substitutes for the other.
Which terms relate to provenance class?
- A signed source is the class most operational records fall into.
- The source provenance register template records each source and its class in one place.
- The governed agentic operating system checks the class as one of the bounds on every action.
Questions people ask
Who decides the class of a source?
The business owner of the source, reviewed by compliance, at the time the source is registered. The class is a deliberate decision recorded in the register, not something the agent infers.
Can a fact's class go down?
Yes. If an issuer revokes a sealed record, facts drawn from it lose that class. If a policy loses its owner, or an authenticated feed is found to be compromised, its facts can be reclassified until the issue is resolved.