The AgentProv Provenance Model

The outermost link is the secret itself. An agent run inherits API keys, cloud tokens, and session cookies from whoever launched it, and every later layer assumes that inheritance was intended. When a credential is broader than the task, longer lived than the run, or readable by anything the agent loads, the rest of the chain is already compromised.

Credential provenance asks where a key came from, which run it was minted for, and whether this run should be holding it at all. Failures here look like secrets read from environment files by a helper tool, keys exfiltrated through a coding assistant, or stolen model API keys resold for inference.

An agent acts on text, and text has no signature. A request typed by the operator, a sentence in a retrieved web page, and a comment planted in a pull request all arrive in the same context window. Instruction provenance is the record of which principal authored the intent behind an action.

When that record is missing, the agent becomes a confused deputy: it holds the operator's authority but follows whoever wrote the most persuasive text. Prompt injection, self-propagating injection between agents, and social engineering aimed at the model rather than the human all break this link.

Agents choose tools by reading their descriptions. The description, the schema, and the code behind them can each come from a different author and can change after the tool was first approved. Tool provenance binds what the agent was told a tool does to what it actually executes.

Failures here include poisoned tool descriptions that carry hidden instructions, servers that change behavior after installation, and tooling built to slip past the scanners meant to vet it. MCP made this layer visible because it turned tool descriptions into a shared, third-party supply.

Agents install packages, pull images, and run code they or another model just wrote. Each artifact has an origin: a registry, a maintainer, a build, a prompt. Code provenance is the chain from that origin to the bytes that run on the developer's machine or in production.

The failures are familiar from software supply chain security, with new entry points. A model hallucinates a package name and an attacker registers it. A trusted AI platform hosts a malicious artifact. A compromised dependency harvests the credentials that the next stage of the cascade will use.

Agent tooling reads configuration from the workspace: rules files, MCP server lists, hooks, and settings that can launch processes. Opening a repository is enough to run them. Config provenance asks who authored each of those files and whether the person opening the project ever agreed to execute it.

When configuration is treated as data instead of code, a cloned repository or a merged pull request becomes an execution primitive. The same layer covers agents that run generated code with no sandbox at all, because in both cases execution happens without a trusted author behind it.

Multi-tenant platforms and multi-agent systems share caches, filesystems, memory, and queues. Identity provenance attaches every action and every stored artifact to the agent, run, and tenant that produced it, so that one run cannot read, write, or act as another.

Failures here are isolation failures: data that crosses tenants, agents that escape their sandbox, and actions authorized at the session level when they should have been authorized one by one. Without a per-run identity there is nothing for an action-level policy to check.

Humans approve things: a tool version, a pinned dependency, a pull request, a security finding. Approval provenance binds that decision to the exact artifact that was reviewed, so that what runs later is provably what was approved and not a look-alike or a silent update.

This link breaks when pins can drift, when approval prompts misdescribe the action, or when the evidence a reviewer relied on was itself fabricated, such as an AI-generated vulnerability report or advisory with no basis in fact.

The innermost link is the sink. Every exfiltration ends with data leaving through a channel: a URL the agent fetches, an image it renders, an email it sends, a webhook an integration calls. Destination provenance asks who chose that destination and whether that principal was allowed to.

Failures here include agents with no allowlist for outbound requests, server-side request forgery in inference and tooling stacks, and integrations granted far more reach than the task needed. Many incidents begin at an inner layer and only become a breach at this one.