Facts lose their origin quickly. They get summarised, copied into a case note, passed from one agent to another, cached, combined. At each step the question of where they came from gets harder to answer. Provenance has to travel with every fact, attached to it at every step, because the source decides what the fact may authorise.
Why does a fact's source decide what it can do?
The same statement can be decisive or worthless depending on who made it. "The customer's new account number is X" from an authenticated change in the banking app can update a payee. The same sentence in an unsolicited email cannot. The words are identical. The authority is not.
So a fact without a source is a fact without a known level of authority. An agent holding it cannot know whether it may act on it, and nor can the platform checking the agent's action. The provenance class attached to a fact, whether sealed, signed, declared or external, is what carries that authority forward.
Where does provenance get lost?
Provenance is usually known at the point a fact enters the firm. The email gateway knows the message came from outside. The core system knows a record was written by an authorised user. The trouble starts afterwards, as the fact moves.
| Step in the fact's path | How provenance gets lost | What it causes |
|---|---|---|
| Summarisation | The agent condenses a document into a note and the note carries no source | A later step treats the note as the firm's own record |
| Copying into a case | A detail from an email is pasted into a structured field | The field looks like system data, not an external claim |
| Hand-off between agents | One agent passes a conclusion to another without its basis | The second agent acts on a conclusion it cannot evaluate |
| Caching | A value fetched from a source is stored and reused | A stale or reclassified value is used as if current |
| Combination | Several facts are merged into one recommendation | The weakest input is hidden inside a confident output |
Each of these is ordinary, sensible work. Summaries save time. Hand-offs are how multi-agent systems function. The failure is not the step; it is that the source did not come along.
What does laundering look like in practice?
Take an illustrative case. A complaints agent reads a customer's email that says a branch member of staff promised a fee refund. It writes a case summary: "Customer was promised a refund of the 30 fee." A second agent, handling refunds, reads the case summary, sees an apparent commitment, and issues the refund.
Nothing in the chain was malicious. But the claim began as external, an unverified account of what was said, and ended as a firm-sounding fact in an internal record. The source was laundered by the summary. If the summary had carried "source: customer email, external", the refunds agent would have treated it as a claim to verify, and the platform would have held any refund resting on it.
This pattern, an external claim becoming an internal fact through ordinary processing, is the most common way provenance failures turn into wrong actions. It is also why bank agents need provenance on every instruction, not only on the first one in a chain.
What rules keep provenance attached?
Three rules cover most of the risk.
- Stamp at entry. Every fact is stamped with its class by the system that brought it in, before any agent sees it. The guide on how to stamp the sources an AI agent uses with provenance covers how.
- Derived facts inherit the weakest class. A summary, conclusion or combination carries the class of its weakest load-bearing input. A summary of an external email is external, however neatly written.
- Provenance crosses every boundary. When a fact moves between agents, systems or stores, its class and source reference go with it. A fact that arrives without them is treated as external.
The third rule is the safety net. It means the cost of losing provenance falls on the action, which gets held, rather than on the customer, who gets the wrong outcome.
How does the platform know where a fact came from?
The model cannot be relied on to track this. It reads text and has no dependable way to tell an external claim from a sealed record when both are presented as plain words. Provenance has to be tracked by the system around the model, as structured data attached to each fact, not as a sentence in the prompt saying "this came from an email". The mechanics are explained in how an agentic operating system knows where a fact came from.
Keeping a source provenance register is the organisational side of the same work: a list of every source agents may use, its class, and who owns it.
Where Pryme fits
The Pryme Context Protocol stamps every fact reaching an agent with its provenance class at entry, and the class travels with the fact through summaries, hand-offs and combinations. The minimum chain reads it at the moment of action. An external claim cannot authorise a payment, however many steps it has passed through. See the governed agentic operating system, explained.
What should change in your own estate?
Trace one consequential action back to its inputs. For each fact it relied on, ask whether you can tell where it originally came from, and whether that origin was visible at the moment the action was taken. Where the answer is no, find the step that dropped it, whether a summary, a copy, a hand-off or a cache, and make provenance a required field there.
Questions people ask
Does every summary have to be marked with a source?
Every summary that could inform an action should be. A summary used only to brief a person can be lighter, but it is simpler to mark all of them than to guess which ones will later be reused.
What if a fact has several sources of different classes?
Record them all, and let the strongest independent source decide the class only if it alone supports the fact. If the fact depends on the weaker source, the weaker class applies.
Can provenance be added after the fact?
Sometimes, by tracing the fact back to its origin, but this is slow and often impossible once copies have spread. Stamping at entry is far cheaper than reconstruction.