The Attestor Provenance architecture defines the information and lineage that must remain traceable across Attestations, eligible governed inputs, evaluation, and resulting Trust Statements.
Provenance allows Attestor to show not merely what conclusion it produced, but where the material basis came from, how that basis entered the process, and how the conclusion remains connected to it over time.
An Attestation must preserve enough provenance to identify where its assertion originated, who or what stands behind it, how it entered Attestor, and which governed references materially support it. Provenance remains distinct from the assertion itself.
Every material input used in evaluation must remain traceable to its source or derivation path. Attestor must preserve source identity, source identifier where available, provenance mode, relevant state or time, and the relationship between the input and the evaluation.
Attestor must preserve the governed basis of an evaluation: which Attestation was evaluated, which eligible inputs were considered, which rules or methodology governed the assessment, and enough process context to make the resulting conclusion reviewable.
A Trust Statement must remain traceable to the Attestation, eligible governed inputs, evaluation basis, and Attestor process that produced it. Publication or later lifecycle change must not sever that provenance chain.
direct provenance applies when Attestor receives or resolves an input directly from the authoritative or originating source context being referenced. Direct provenance describes the path of acquisition; it does not make the content automatically sufficient or correct.
referenced provenance applies when an Attestor object identifies and relies upon an existing governed source through an explicit reference rather than reproducing or taking ownership of that source object.
derived provenance applies when an input, assertion, or evaluation element is produced from one or more prior governed inputs. The derivation path must remain traceable enough to identify the material sources and transformation or reasoning context.
Corrections, supersession, withdrawal, retirement, version changes, and publication changes must preserve historical provenance. A current object may change state, but Attestor should remain able to show the governed basis and lineage of prior states where required.
Canonical structured representations now preserve material provenance context in production, while Schemas and Validation govern applicable machine requirements. Every material provenance relationship must preserve enough context to identify and interpret its origin and use. Not every field applies identically to every source, but omission must not make the lineage materially ambiguous.
The Controlled Values architecture establishes three provenance modes. Their governed use is now represented in canonical Attestor objects and exercised in production, while Schemas and Validation govern applicable serialization and validation requirements.
Evaluation must not become a provenance break. The Trust Statement should remain connected backward through the Attestor evaluation to the Attestation and material eligible inputs considered. Where an input is excluded, conflicting, superseded, or otherwise materially affects interpretation, the evaluation record must preserve enough context for that treatment to be reviewable.
Because governed source objects may change after evaluation, Attestor must preserve enough provenance to distinguish the source state evaluated from a later source state. A current source representation must not silently replace the historical basis on which an earlier Trust Statement was produced.
Provenance identifies lineage; Authority identifies who legitimately stands behind an assertion, source object, process, or conclusion. The two reinforce accountability but are not interchangeable. A well-documented provenance path does not create authority that the source did not possess.
Traceable provenance is necessary to evaluate whether many inputs are eligible, but provenance alone does not make an input admissible. Eligibility determines whether a governed input may enter a particular evaluation based on purpose, scope, authority context, source state, relationship, and applicable rules.
The first controlled production operation preserved an end-to-end provenance chain from governed source objects through Eligibility, ATT-2026-0001, the Evaluation Basis, Rule-Constrained Evaluation, and TRST-2026-0001. Publication and final-state validation preserved that lineage rather than replacing it.
The operation also demonstrated that provenance and relationship meaning remain distinct. References to source objects preserved their source identity and authority; the Trust Statement's derived-from relationship to the Attestation preserved Attestor lineage without implying that every referenced source independently supported the final conclusion.
A complete provenance chain demonstrates traceability, not correctness. Attestor may know exactly where an assertion came from and still determine that the assertion is partially supported, not supported, contradicted, or indeterminate under the applicable evaluation rules.
The Provenance architecture is established and has been exercised in production. The first controlled production operation demonstrated traceable lineage across governed source objects, Eligibility, the canonical Attestation, Evaluation Basis, Rule-Constrained Evaluation, the canonical Trust Statement, lifecycle activation, Publication, and final-state validation.
Production proof establishes traceability of the first governed operation; it does not establish universal correctness, future eligibility, future support, or source authority beyond the bounds of the referenced source. Every future operation must preserve its own provenance chain.
Back to Attestor →