If you can't prove why an AI wrote it, you can't ship it

Summary of an essay on muthub.org

Read the full essay on muthub.org →

Reviewed by Muthu · Essay · Last verified Oct 18, 2026 · Drafted Oct 17, 2026 by seed-import/1.0 · Re-check by Oct 17, 2027 · 1 source

Show in graph · Markdown

Overview

Shipping AI-generated code without recording where it came from is unmanaged risk. Regulated teams need deterministic provenance for non-deterministic models: line-level attribution, Git-native session history and AI bills of materials.¹

What it covers

• Provenance is an old idea with a new gap
• The problem with autonomous agents
• Three patterns for code provenance
• What I found testing it
• From SBOM to AI-BOM
• A decision rule for depth

Bottom line

Provenance is not paperwork. It is what lets a regulated team say yes to agents: every change traceable to its intent, its model and the person who approved it, captured at creation and governed like the code itself.

Sources

1. If you can’t prove why an AI wrote it, you can’t ship it · published Feb 24, 2026

See also

• Model is a tool, harness is the strategy - Handing an AI agent a production codebase without a harness is like putting a teenager in a sports car with no dual brakes. Deterministic guardrails and sensors, owned as a platform, are what make agents safe to scale.
• Adopting MCP in a bank: the four risks to solve first - The Model Context Protocol standardizes how agents connect to tools and data. It is silent on whether they should. Four risk areas a regulated institution should resolve before agents get tools.

Footnotes

1. If you can’t prove why an AI wrote it, you can’t ship it, muthub.org, 2026-02-24. ↩