Context Provenance

What it is

A per-span record of where each piece of an assembled context came from and what standing it has: which producer supplied it, which document or message it was taken from, when it was fetched, who authored the underlying material, whether it has been transformed since, and whether anything vouches for it. The record travels with the span through assembly and is kept after the call, so that a sentence in a model's answer can be traced back to the text that licensed it. This concerns the composition of one request; the origin of a stored belief is a memory concern, covered by Memory Provenance.

Why it matters

Two of the hardest operational questions in this kind of system are provenance questions. When an answer contains a claim nobody can find, the only way to distinguish a model invention from a faithful reading of a bad source is to know what was in the context and where it came from. And every trust-dependent control — instruction precedence, injection defence, tenant isolation, retention and deletion — is enforced against a label that something must have attached. Without a per-span record those controls have nothing to read, and the system is left reasoning about a single undifferentiated block of text that it assembled itself and can no longer take apart.

Key decisions

• The granularity of the record. Per document is cheap and tells you little when a document contributed four separate fragments; per span is useful and makes the record comparable in size to the context it describes.
• Which facts are carried. Producer and source identifier are the minimum; retrieval time, author, the version of the underlying item, and a trust class each answer a different later question and each cost storage.
• Whether trust is an inherent property of the producer or computed per span. A producer-level class is simple and wrong for sources that carry both first-party and user-contributed content in the same store.
• What happens to provenance under transformation. Summarising three passages into one sentence produces a span whose provenance is a set, and most implementations quietly record the first element or none.
• Whether the record is exposed to the model, kept alongside it, or both. Putting source labels in the context enables citation and gives an adversary a label to imitate; keeping it outside means the model cannot cite what it used.
• How long the record is retained and under what classification. It names documents, authors and timestamps, so it is itself sensitive and inherits a retention obligation.
• How the record joins to everything else. If the span identifiers in the provenance record do not appear in traces and in the stored response, the record exists and cannot be used.

Failure modes

• Provenance is recorded for retrieved documents only, because that producer had the metadata readily available, and the tool results and remembered facts in the same context have no origin at all.
• The record is attached to the context before compression and never updated, so it describes text that no longer exists and attributes a summariser's sentence to a source document.
• Source labels are placed in the context as plain text, and a retrieved page includes its own fabricated source label, which the model reproduces as an authoritative citation.
• Citations in the answer are generated by the model rather than derived from the record, so they look right, resolve to real documents, and do not correspond to the spans that were present.
• A document is deleted or access to it is revoked, and the provenance records referring to it are retained in a store with no deletion propagation, leaving titles and excerpts behind.
• The record uses the producer's internal identifier, that producer re-indexes, the identifiers change, and every historical record becomes unresolvable.
• Trust class is assigned at the store level while the store contains both curated policy pages and user-submitted comments, so adversarial content inherits a trusted label.
• Provenance is captured and never joined to the response, so the data exists and no investigation can use it without a bespoke query nobody has written.

Related capabilities

• Dynamic Prompt Assembly — the only component that sees every span at the moment it is admitted
• Prompt Injection Defense — consumes the trust class this capability assigns
• Instruction Hierarchy — derives a span's level of authority from its origin
• Context Compression — the transformation most likely to break the link to a source
• Memory Provenance — the equivalent record for a stored belief rather than for a request

Applies: Production readiness · Design questions