Skip to content

Supporting position

Audit trails don’t create accountability.

Build provenance (SLSA) attests where and how an artefact was produced; it does not attribute the decision. Accountability needs a decision-and-attribution trail engineered above the pipeline.

Conventional wisdom

Build provenance (SLSA) gives us an audit trail, so we’re covered.

Our position

Knowing how something was built is not the same as knowing who decided it.

Why we believe it

Provenance attests how an artefact was produced; it does not attribute the decision. Accountability needs a decision-and-attribution trail engineered above the pipeline.

What we’ve observed

  1. 01EU AI Act Articles 12 and 14 make a queryable decision log and human oversight a requirement for high-risk systems.

Challenge the thinking

Provenance can prove how an artefact was built; it does not yet prove who decided it. Tell us how you’re closing that gap — or whether you think provenance is enough.

How vs who — where’s your gap? →