Trust Provenance (DAG)

Trust Provenance provides cryptographic traceability: how a device was onboarded, which policies were applied, and how each security decision links to prior verified states. This reduces “who changed what” ambiguity during incidents and audits.

• Each identity/device state transition is recorded as an event with signed metadata.
• Events form a DAG: new events reference previous verified events (tamper-evident lineage).
• Anchoring to an immutable ledger provides timestamping and non-repudiation.
• Policy decisions include evidence pointers (signals used, risk score, enforcement action).

1. 1
   Use provenance during investigations

   : trace the exact sequence leading to a denial/quarantine.
2. 2
   Prove compliance

   : show auditors immutable evidence that controls were enforced at time-of-event.
3. 3
   Validate onboarding

   for new OT/IoT fleets: ensure each device has a hardware-bound identity.
4. 4
   Detect tampering

   : flag breaks in lineage, replay attempts, or out-of-order events.