07 · Provenance & Sensitivity — ARCANA Governance

~/arcana/governance/provenance.md

PROVENANCE & SENSITIVITY

Where data came from — and how secret it is

[ TRUSTED ORIGIN ][ HOSTILE ORIGIN ]

[ SYSTEM_POLICY ]Trusted system policy content

[ USER_INSTRUCTION ]Direct user instruction

[ ACTIVE_CONTRACT ]Current objective / criterion state

[ TRUSTED_LOCAL_SOURCE ]Approved local source

[ UNTRUSTED_LOCAL_SOURCE ]Repository/local source without trust

[ REMOTE_CONTENT ]Web / network-originated content

[ TOOL_OUTPUT ]Tool-derived content

[ MODEL_OUTPUT ]Model-generated content

[ SUBAGENT_OUTPUT ]Delegated agent result

[ MCP_DESCRIPTION ]Untrusted MCP schema/description content

[ SENSITIVITY ORDERING — THE STAIRCASE ]

[ PUBLIC ]lowest

[ INTERNAL ]above public

[ PRIVATE ]above internal

[ SECRET ]never exposed without brokered policy

Field lineage, not just labels. Content can be laundered across model transformations, so Arcana tracks the origin of consequential fields — executable, arguments, path, host, message body, secret identifier, MCP arguments, delegated task text. UNKNOWN lineage on HIGH or CRITICAL actions fails closed. Encoded SECRET data remains SECRET.

/governance/provenance.md

# 07 · Provenance & Sensitivity

> Where data came from — and how secret it is.

## Overview

Two questions decide what data may influence an action and where it may go:
**where did this come from?** (provenance) and **how damaging is exposure?**
(sensitivity). Arcana answers both for every piece of content and every
consequential request field.

## Provenance labels (trusted → hostile)

| Label | Meaning | Typical source |
|---|---|---|
| SYSTEM_POLICY | Trusted system policy content | Kernel, signed policy |
| USER_INSTRUCTION | Direct user instruction | Your typed prompt |
| ACTIVE_CONTRACT | Current objective / criterion state | Contract machinery |
| TRUSTED_LOCAL_SOURCE | Approved local source | Trusted workspace files |
| UNTRUSTED_LOCAL_SOURCE | Repository/local source without trust | Random repo files |
| REMOTE_CONTENT | Web / network-originated content | Fetched pages, API responses |
| TOOL_OUTPUT | Tool-derived content | Shell output, file diffs |
| MODEL_OUTPUT | Model-generated content | Assistant messages |
| SUBAGENT_OUTPUT | Delegated agent result | Subagent transcripts |
| MCP_DESCRIPTION | Untrusted MCP schema/description content | Third-party MCP servers |

Prompt-injection defense falls out directly: a remote page instructing the
model to "run rm -rf" produces arguments whose lineage traces to
REMOTE_CONTENT/MODEL_OUTPUT — and provenance policy on consequential fields
fails that request closed.

## Sensitivity ordering

```text
PUBLIC < INTERNAL < PRIVATE < SECRET
```

- SECRET may never be exposed to the model or to any external destination
  without explicit brokered policy.
- Encoding does not downgrade: base64'd SECRET data is still SECRET.
- Derived data inherits the union of its inputs' sensitivities.

## Field lineage — beyond labels

Labeling whole documents is insufficient because content gets laundered
across model transformations. Arcana therefore tracks the **origin of
consequential request fields**: executable, arguments, path, host, message
body, secret identifier, MCP arguments, delegated task text.

Rules:

1. **UNKNOWN lineage on HIGH or CRITICAL actions fails closed.**
2. Encoded SECRET remains SECRET.
3. Declassification is an explicit, audited policy operation — never a side
   effect of summarization.

## Related

- Previous: [Delegation & Attenuation](/governance/delegation.md)
- Next: [Scoped Approvals & Routing](/governance/approvals.md)