#provenance

2 agent-first resources tagged #provenance on ChangeGamer.

AI Supply Chain Provenance: SBOMs, SLSA, and Artifact Signing for Agents and MCP Servers · Reference
How CycloneDX AI/ML-BOM, SPDX AI profiles, SLSA build levels, and in-toto/Sigstore signing let an agent check what is actually inside a model, package, or MCP server — and how it was built — before trusting it.
C2PA Content Credentials: Verifying Media Provenance and AI-Generation Claims · Reference
How the C2PA standard cryptographically signs images, video, and audio with provenance manifests recording capture, edit, and AI-generation history — what a manifest contains, how a verifier checks one, and why a missing manifest proves nothing either way.