Attesta Provenance
The record of how each change was made.
Provenance captures signals from your git host, CI, and AI tooling, writes them to a hash-chained ledger, evaluates policy, and produces evidence packs. It is the flagship of the Attesta family.
What it does
Ledger
PreviewEvery event is hash-chained. Editing history breaks the chain and verification shows where.
Learn moreChange explorer
PreviewBrowse changes with tier, review status, and policy result, then open any change for its full timeline.
Learn morePolicy engine
PreviewWrite rules, simulate them against history, run them in warn mode, then enforce.
Learn moreEvidence packs
PreviewPeriod-scoped exports with verification data that a third party can check.
Learn more
Every claim carries its confidence
Attesta never blends how a fact is known into a single score.
- Attested
Signed event from a gateway, agent hook, or CI action.
- Declared
Git trailer, PR label, or developer self-declaration.
- Inferred
Heuristic estimate. Always labelled, never counted as proof.
Change explorer preview
Interactive, on fictional sample data. Filter, toggle a policy, open a change, verify its ledger.
Policies, tested before they bite
A policy is a small rule over recorded events. Replay it against history to see what it would have flagged, run it in warn mode, and enforce it only when the flags are understood.
# Illustrative — interface subject to change
- id: payments-human-review
mode: warn
when:
ai_assisted: true
paths: ["payments/**"]
require:
review: humanEvidence packs
A pack contains provenance records, policy results, and ledger verification data for a period. The recipient can recompute the chain without trusting us.
- Period
- Sample quarter
- Changes in scope
- 12 (sample)
- Policy failures
- 3, each linked to a change
- Ledger
- Verified · 60 events · 0 breaks
Roles
| Role | Can | Status |
|---|---|---|
| Admin | Manage workspace, repositories, policies, and keys. | Preview |
| Engineering lead | View coverage, inventory, and changes for their teams. | Preview |
| Security and compliance | Author policies, export evidence packs. | Preview |
| Auditor | Read-only, time-boxed access to scoped evidence. | Planned |
Data handling, in short
Provenance is designed to work from metadata and hashes. It does not need your source code.
See the full table on the Platform page and the security roadmap.