What Attesta records, checks, and produces.

Each provenance event stores the hash of the previous one. Editing or removing any record breaks every hash after it, and verification pinpoints where.

Attesta labels how each claim is known. Attested comes from signed events, Declared from human statements, Inferred from heuristics. Inferred is never counted as proof.

Any tool or developer that leaves a trailer or label produces Declared provenance, with no agent or proxy required.

A workflow step submits a signed event describing the change, the checks that ran, and the tools reported. Signed events are Attested.

Write a policy, replay it against past changes to see what it would have flagged, then move it from warn to enforce.

The inventory is built from recorded events, not from a survey. It shows tool, model, repository, and the tier of the evidence behind each entry.

Coverage views separate human review, automated-only checks, and no review, filtered by tool, path, and team.

A pack contains provenance records, policy results, and ledger verification data for a chosen period, so a third party can check it independently.

Invite an auditor to a scoped, read-only view of evidence for a period, with access logged in the ledger itself.

A REST API for event ingest and queries, plus webhooks for policy results and new evidence. Scoped keys and CI workload identity for authentication.

Drafts are grounded in your recorded events, and each claim links to the evidence behind it. A person reviews every answer before it is sent.