The trust gap in AI agents: Why provenance isn’t optional anymore

The agent economy is here. AI agents are carrying out intricate workflows for increasingly longer periods of time and interacting with other agents on…

Datafund 4 min read

Source: Datafund, Gemini Source: Datafund, Gemini

The agent economy is here. AI agents are carrying out intricate workflows for increasingly longer periods of time and interacting with other agents on complex objectives. This raises a fundamental question: how do you trust an agent you’ve never met?

When an agent’s behavior is emergent and its decisions have real-world consequences, we need an immutable and verifiable chain of events or in other words, provenance.

The use of decentralised storage solutions for storing provenance (meta)data solves this problem. By also adding Model Context Protocol (MCP) to this chain, we equip AI agents with a universal, open way for connecting to external data and tools.

In this blog we take a look how decentralised storage, coupled with MCP, elegantly solves the growing needs for agent transparency, traceability and verifiability.

Centralised logging struggles to deliver agent accountability

Imagine building a multi-agent supply chain system, then something goes wrong.

Which agent made the bad call? What data did it see? Why did it choose that action?

Without a provable context at the moment of decision for each agent everything reduces to a guess. The Coalition for Secure AI emphasises that for agentic systems to be secure and reliable, their behavior and provenance must be observable and verifiable.

When agents can’t prove their actions, trust collapses and the entire system becomes fragile.

The reality is that most developers default to centralised logging when addressing persistent provenance. But this approach has considerable flaws:

  1. Single points of failure: An entire audit trail maintained on a single entity is vulnerable to outages, security breaches or changes in business terms.

  2. Trust dependencies: One party must trust another’s internal records, which is not enough for an independent verification.

  3. No interoperability: Agentic frameworks often utilise proprietary logging formats, making it nearly impossible to construct a coherent, end-to-end provenance record.

MCP for creating a shared truth

We can begin to reconceptualise this model when we realise that provenance data should not belong to any single agent but rather to the interaction itself, stored on neutral ground.

Decentralised storage networks, such as Swarm or IPFS, provide this substrate, offering immutability, censorship resistance, and high availability by design.

However, direct interaction with these networks still presents a barrier to entry for many developers. By using an MCP server, AI agents can easily start communicating with a decentralised storage backend with a simple tool call, while the server and backend handle the complexities of cryptographic hashing, data formatting, and persistent storage.

This makes using decentralised storage the same as using any other database. The defining difference is the trustless environment in which the interaction takes place.

The result is a framework for a composable and trustworthy agent systems where:

  • Trust is verifiable, not assumed.

  • Compliance becomes provable for regulators.

  • Incidents are fully traceable across agent boundaries.

  • Agents from different organizations can safely work together.

The industry is already converging on similar solutions. Projects like Sigstore are bringing cryptographic signing infrastructure to enable provenance verification and maintain an audit trail of all agent interactions.

Major payment networks like Visa and Mastercard are developing protocols where each commerce agent request is verifiable, time-based, and non-replayable.

We’d appreciate your input

The need for data provenance has shifted from optional to mandatory and the potential cost of non-compliance is skyrocketing.

Jurisdictions with global reach are demanding data traceability and transparency as it is ingested and repurposed by AI; copyright lawsuits are mounting and companies are closing off their public-facing data repositories.

We’re already developing a toolkit that will enable a simple and universal way of providing auditable data linage. Part of this solution is also an MCP integration and we’d deeply appreciate input from the technical community to ensure its utility for real-world applications.

We are particularly interested in feedback from builders on the following:

  • Attestation and notarisation: What level of cryptographic signing and identity verification is necessary for your workflows?

  • Granularity controls: Is task-level provenance sufficient for auditing, or is per-action logging a requirement?

  • Query capabilities: What methods for searching and analysing historical provenance data would be most effective?

We invite you to help us build a new foundational layer of the agentic economy.

Get involved:

  • Review the technical details and contribute to the discussion on our SWIP.

  • Contact us directly with your specific use case, questions, or feedback.

The trust gap in AI agents: Why provenance isn’t optional anymore was originally published in Datafund on Medium, where people are continuing the conversation by highlighting and responding to this story.

First published on Medium on 2025-11-03.