Provenance checking is a defensive control that verifies where content came from before an application treats it as trusted input. In cyber security, “source” matters because data from a trusted system, a signed artifact, or a known user should not be handled the same way as content fetched from the public web, an email attachment, or an embedded script.
This is especially important in AI assistants and browser-based workflows, where untrusted pages can try to influence model behavior through prompt injection. A provenance check helps answer basic questions: Was this text fetched from a remote page? Was it modified in transit? Was it generated by the model, decrypted at runtime, or supplied by the user? Defenders use this control to keep attacker-controlled content from being promoted into instructions, tool calls, or other privileged actions. Provenance checking is most effective when paired with strict tool scoping, content isolation, and allowlists for trusted sources.