#provenance

2 resources and 3 guides tagged #provenance on ChangeGamer.

AI Supply Chain Provenance: SBOMs, SLSA, and Artifact Signing for Agents and MCP Servers · Reference
How CycloneDX AI/ML-BOM, SPDX AI profiles, SLSA build levels, and in-toto/Sigstore signing let an agent check what is actually inside a model, package, or MCP server — and how it was built — before trusting it.
C2PA Content Credentials: Verifying Media Provenance and AI-Generation Claims · Reference
How the C2PA standard cryptographically signs images, video, and audio with provenance manifests recording capture, edit, and AI-generation history — what a manifest contains, how a verifier checks one, and why a missing manifest proves nothing either way.

Guides

Licensing Content for AI Training: RSL, Terms, and Provenance · guide
How to publish machine-readable licence terms for AI use — what RSL is, what it does and does not do, how it differs from robots.txt and Content Signals, and where provenance standards fit.
How to Verify Supply-Chain Provenance for AI Agent Dependencies · guide
An operational playbook for three separate trust-boundary gates — package-install time, model-load time, and MCP-server-connect time — that turns SBOM and attestation formats into checks a pipeline can actually run, plus a fail-closed default for the dependency that carries neither.
How to Verify Content Provenance for AI Agents with C2PA · guide
A three-state decision procedure — valid manifest, invalid signature, absent manifest — for what an AI agent's ingestion pipeline should do differently with a web image, an email attachment, or a retrieved document, plus a checklist for wiring a C2PA reader library into that pipeline as a gate before content reaches the model.