Implementation: IMPLEMENTED (contract) · DESIGN (recording) · Exposure: PUBLIC (docs). See status labels. Every argument in a compiled call is tagged with its origin. The origin decides how much the value is trusted and whether a model may change it.

​
Architecture contract

The map is part of ToolInvocationV1 (argument_provenance). Together with the read set and write set it lets a reviewer answer “why did the agent pass this value?” without reading a transcript.

​
Current implementation

The tag set is in the frozen contract. Recording it on every call depends on the Tool Call Compiler, which is on main behind an off-by-default flag and runs in shadow.

​
Availability

​
Developer relevance

Never let a generated value fill a security-relevant argument such as a path outside scope, a host or a recipient. Those should be POLICY or USER.