A signed source is a fact that carries the authority of a named, accountable party: a policy approved by its owner, an instruction from an authenticated counterparty, an entry in your system of record attributable to a person or system. For an AI agent, signed means someone answers for the fact. Most of the operational facts an agent acts on should be signed.
What makes a source signed rather than declared?
Two things: an authenticated channel and accountability for the content. The ledger is accountable for balances. The policy owner is accountable for the policy they approved. A counterparty is accountable for instructions sent through an authenticated link you have agreed to rely on.
Remove either and the fact drops a class. A balance a colleague types into a chat is declared, even if it is right. A policy pasted into a shared folder with no owner is not signed in any meaningful sense. A balance in an email from a stranger is external.
Why does the signed class matter once agents act?
Routine actions rest on signed facts. Sending a payment reminder, closing a resolved case, posting a matched transaction: each needs a fact about the current state of things from a source that answers for it. If the platform can tell signed facts from the rest, it can allow routine work on signed facts and hold the same work when it rests on weaker ones.
Signing also gives the audit trail a name. When a decision is reconstructed, the record shows who or what stood behind each fact.
How is a signed source checked in practice?
Three questions at the moment of use. Did the fact arrive through an authenticated connection? Is this party registered as the authority for this kind of fact? Is it fresh enough for the action? The third is often missed. Yesterday's signed balance is still signed, but it may not support a payment today.
The signer's authority also has limits. An approval signed by a named person counts only if that person holds the right to approve that kind of action. An authenticated approval from the wrong person is a signed fact that authorises nothing.
What does this look like in an example?
A lender's arrears agent decides whether to send a reminder. It reads the arrears balance from the loan system (signed, refreshed that morning) and the reminder rules from the collections policy (signed by the head of collections). It also finds a call note saying the customer promised to pay on Friday (declared). The agent sends the standard reminder, because the signed balance and policy support it, and adds the promise to the case for the next review rather than acting on it.
How is a signed source different from a sealed source?
A sealed source is a record protected so that any change is detectable and checkable against its issuer, such as a certificate with a verifiable seal. A signed source rests on accountability: you know who stands behind it and they answer for it, but the record itself may not be tamper-evident outside the system that holds it. Sealed proves the record is unaltered; signed proves who is responsible for it.
Which terms relate to signed sources?
- Sealed, signed, declared, external: the four classes side by side.
- One source of truth for what agents may do: keeping authority for each kind of record in one place.
- The source provenance register template names the accountable owner for each signed source.
- The governed agentic operating system checks the class at the moment of action.
Questions people ask
Is a signed fact always true?
No. It proves who answers for it. If the ledger holds a wrong balance, the agent receives a signed wrong balance. Signing makes errors traceable to an owner, which is where they get fixed.
Can two signed sources disagree?
Yes, which is why the register should name one authority per kind of fact. If the case system and the ledger disagree on a balance, the ledger wins, and the agent flags the mismatch instead of choosing.