Register every source, give each one a provenance class, and stamp each fact with that class, the source, and the time it was read as it enters the agent's context. Derived facts inherit the weakest class of their inputs. Bounds then read the stamp: some actions need sealed or signed facts, and an external claim can never authorise a payment.
What is a provenance stamp, and who owns it?
A provenance stamp is a small record attached to a fact: where it came from, how far it can be trusted, and when it was read. Four classes cover most sources. Sealed facts come from an issuer and can be checked cryptographically, such as a tamper-evident certificate. Signed facts come from a known, authenticated party, such as an entry in your own system of record. Declared facts are what someone told you, such as an income figure typed into an application form. External facts are claims from outside, such as an email, a web page or a document of unknown origin. The term is defined in more detail in what a provenance class means for AI agents.
Data owners own the class assigned to each source. The integration team owns the stamping. Process owners decide which classes each capability may act on.
How do you stamp sources, step by step?
- Person, data owners: list every source the agent may use. Systems of record, document stores, inbound channels, third-party feeds. The source provenance register template gives a ready structure. Evidence: a versioned register.
- Person, data owners: assign a class to each source. Classify by how the fact can be checked, not by how reliable the source feels. Your core ledger is signed; a customer's uploaded bank statement is declared until verified; a forwarded email is external. Evidence: class and reason per source in the register.
- Integration team: stamp at intake. Every connector attaches source identifier, class, retrieval time and a fingerprint of the content to each fact before it reaches the agent. Evidence: stamped facts in the context log.
- Integration team: refuse unstamped facts. A fact with no stamp is treated as external. Evidence: downgrade entries.
- Platform: carry the stamp through processing. When the agent summarises or combines facts, the result takes the weakest class of its inputs. A total built from a signed ledger and a declared figure is declared. Evidence: derived facts listing their inputs.
- Process owner: set class requirements per capability. Drafting a reply may use declared facts. Releasing a payment needs signed or sealed facts for the payee and amount. Evidence: class rules in the capability's bounds.
- Platform, at each action: checks the classes of the facts relied on. Evidence: the verdict lists the facts used and their classes; a refusal names the source bound.
- Agent, depth 2 and above: cites stamped facts in its output. Anyone reading a draft can see what each statement rests on.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Register sources | Nothing | none | Data owners list sources |
| Assign classes | Nothing | none | Data owners classify and give reasons |
| Stamp at intake | Receives stamped facts | 1 | Integration team maintains connectors |
| Combine | Derives facts at the weakest class | 1 or 2 | Nothing |
| Act | Proposes an action citing facts | per capability | Approver where the class is too weak |
| Review | Nothing | none | Data owners review the register |
Which controls matter, and what evidence do they leave?
Class by verification, not reputation. A large, respected counterparty's email is still external. Evidence: register reasons.
Weakest-class inheritance. Without it, a declared figure gains authority each time it is summarised. Evidence: derived-fact lineage.
Stamps that travel. A stamp dropped at the first transformation is no stamp at all. The case for this is made in why provenance must travel with every fact. Evidence: stamps visible at the point of action, not only at intake.
Fingerprints. If a document changes after it was read, its fingerprint will not match. Evidence: fingerprint per fact.
Promotion only by verification. A declared income figure can become signed when it is matched against a verified source, and the stamp records that match. Evidence: promotion entries naming the check.
What should you measure?
- Unstamped facts reaching agents. Target zero.
- Refusals on the source bound, by capability. A spike often follows a new inbound channel nobody classified.
- Share of decisions resting on declared or external facts, tracked as a count per capability and reviewed for trend.
- Promotions: how many declared facts are verified before use, and how long that takes.
- Register age: sources not reviewed since the last certification.
Where does it usually go wrong?
Classification by convenience. A team marks its own spreadsheet as signed because it is internal. Internal is not the same as authenticated.
Retrieval strips metadata. The document store returns text chunks without their source. The agent sees facts with no origin.
The agent's own output is fed back as a source. A summary the agent wrote yesterday becomes "a document" today, now apparently independent. Mark agent output as derived, with its inputs.
Stamps are kept but not used. Provenance is recorded for audit but no bound reads it, so an external claim still drives an action.
The customer never sees the basis. Showing sources to people outside the business has its own trade-offs, discussed in whether an AI agent should show its sources.
Where Pryme fits
The Pryme Context Protocol stamps every fact reaching an agent with its source and class: sealed, signed, declared or external. Sources are one of the five bounds checked at the moment of action, so a capability that needs signed facts is refused when it has only declared ones, and an external claim cannot authorise a payment. The governed agentic operating system guide covers the rest of the model.
Questions people ask
Does stamping slow the agent down?
Barely. A stamp is a few fields attached at intake. The cost is in classifying sources properly at the start, which is a one-off piece of work per source.
Can one source carry more than one class?
Yes. A document store might hold signed internal policies and external uploads side by side. Classify at the level of the collection or the document, not the whole store.
What happens to old facts when a source is reclassified?
New reads take the new class. Facts already used keep the class they had at the time, so the record shows what the agent relied on when it acted.