- How to verify software provenance: npm, GitHub, Sigstore and SLSA Check the signed attestation against a builder you trust, then confirm its digest matches your file. The exact commands for npm, GitHub, cosign and slsa-verifier.
- Pre-execution validation for AI agent tool calls Check an agent's tool call after the model proposes it and before it runs: schema, policy, then human approval. And record the refusals, or you cannot prove them later.
- Provenance verification: four kinds, and how each one is checked Provenance verification means checking a signed claim about where something came from or what happened to it. Content, build, data and execution provenance, side by side.
- How to produce tamper-proof evidence of AI agent actions for customers and auditors Record each action where it is dispatched, commit the events to a signed Merkle root, record refusals too, and hand over a verifier that runs without your servers.
- What is verifiable execution provenance for AI agents? A portable record of what an AI agent did, in what order, under what authority, that a stranger can check. Where it sits beside C2PA, MCP, A2A and agent identity.
- What makes an implementation Provetrail-conformant? An implementation is Provetrail-conformant at a level if it accepts every valid record in that level's public vectors and rejects every tampered or malformed one, in any language.
- Signed vs proven: what a runtime record can and can't prove A signature proves who emitted a record and that nobody altered it. Whether the work behind it was real is a separate question. Where the line falls for agent records.
- How to verify an AI agent's execution record Rebuild the record's Merkle root, check the signature against a published key, confirm each outcome is bound to evidence. The integrity check runs client-side, in any language.