Provenance, Freshness, and Signed Agent Responses
A cryptographic signature can prove which gateway emitted a response. It cannot prove the underlying fact was correct or current.
Trustworthy agent responses require several distinct questions to be answered. Collapsing them into a single “verified” badge creates false confidence.
Where did the fact come from?
Provenance connects a returned fact to its source record. For dynamic information, the response should also carry when that source was observed and, where possible, when the source itself says it changed.
Is the fact still current?
Freshness is a policy, not a timestamp alone. A company description may be acceptable for days. Inventory may become stale in minutes. The gateway should evaluate freshness against the type of fact and expose stale states rather than quietly serving an old value as current.
Was the response altered?
A content digest lets a recipient detect a changed response body. A digital signature can bind selected response components to a key controlled by the gateway operator. This helps establish integrity and origin when the recipient knows which key to trust.
Signatures do not validate the underlying business claim. A correctly signed stale price is still stale. A response from a verified domain can still be sourced from the wrong system. Integrity, identity, provenance, and freshness are complementary controls.
What should a client display?
Client applications should avoid reducing these signals to one trust score. Show the source, observed time, stale state, signature state, and any policy limitation separately. This gives a user or downstream agent enough information to make an appropriate decision.
The objective is not to make every response appear certain. It is to make uncertainty and responsibility inspectable.