Glossary
Provenance
Provenance is a chain of custody for digital things: a build artifact, a policy decision, a piece of evidence submitted to an audit. Establishing provenance means being able to answer, verifiably rather than by assertion, where something originated and what has touched it since — which source produced it, which process transformed it, and whether it has been altered along the way.
Cryptographic provenance typically relies on signing at each step: the origin signs what it produced, and each subsequent stage signs its own transformation, so the full chain can be verified without needing to trust every party in it equally. Without this, provenance collapses into a claim — 'this came from a trusted source' — that a reviewer has no independent way to check.