How assistants, agents and provenance reshape trust

1. Batch Scope

This study completes the original research programme with three systems that sit at the edge between machine interpretation, delegated action and digital trust:

Conversational AI Assistants and Retrieval-Augmented Generation Conversational AI Assistants and Retrieval-Augmented Generation;
Autonomous and Semi-Autonomous AI Agents Autonomous and Semi-Autonomous AI Agents;
Digital Provenance and Authenticity Systems Digital Provenance and Authenticity Systems.

The common transition is:

Machine-generated interpretation → interactive synthesis → delegated action → inspectable claims about origin and transformation

An assistant makes several information systems accessible through one dialogue. An agent continues beyond dialogue and acts through tools. Provenance systems record signed claims about the artefacts, identities and transformations involved.

These topics are complementary but not interchangeable. An assistant can answer without acting. An agent can act without producing public media. A provenance system can authenticate parts of either system's history without deciding whether the answer was correct or the action justified.

2. Central Comparative Finding

An assistant manages an interaction. An agent pursues a delegated goal through actions. Provenance records claims about origin and transformation. None of the three, by itself, establishes truth, legitimacy or wisdom.

The batch therefore closes Era VII with three discipline rules:

Retrieved evidence is not the same as a grounded answer.
A generated plan is not the same as authorised execution.
A valid provenance chain is not the same as a true proposition.

The visible output is only one state in a larger chain.

3. Three Different Systems

| Topic | Primary object | Defining operation | Main output | Primary governance question | |---|---|---|---|---| | Conversational AI Assistants and Retrieval-Augmented Generation | User turn plus evidence context | Dialogue, retrieval and synthesis | Answer, explanation or proposed tool call | Which evidence and hidden policies shaped the answer? | | Autonomous and Semi-Autonomous AI Agents | Delegated goal plus environment state | Planning, action and feedback | Changed external state or completed task | What authority was delegated, and who bears responsibility? | | Digital Provenance and Authenticity Systems | Digital asset plus production claims | Hashing, signing and validation | Verifiable provenance history | What exactly does the validated claim prove? |

The most dangerous analytical mistake is to collapse these systems into the phrase “AI did it.” The assistant may have retrieved the evidence, the agent may have executed a tool call and a provenance service may have signed the resulting artefact. Each layer has separate failure modes and accountable actors.

4. From Search to Conversational Big-picture essays

Search engines expose ranked candidates. Conversational assistants produce a coherent response from selected candidates, model parameters, dialogue state and hidden system instructions.

The RAG chain is:

Question → query rewriting → retrieval → reranking → evidence selection → prompt assembly → generation → citation attachment → receiver interpretation

Each stage can fail independently.

The corpus may omit the decisive source.
The query may retrieve the wrong entity or version.
The reranker may prefer a superficially similar passage.
The prompt may truncate a qualification.
The generator may add unsupported detail.
The citation may point to a real source that does not support the nearby claim.

RAG therefore creates an evidence channel, not an automatic guarantee of evidence use. Evaluation must distinguish retrieval relevance, evidence coverage, faithfulness, citation correctness, completeness and usefulness.

5. From Assistance to Delegated Authority

The assistant-agent boundary is best expressed through external state.

Drafting an email is generation.
Showing the draft is assistance.
Sending it is action.
Monitoring for a reply and continuing the workflow is agentic persistence.

The same model can therefore inhabit different risk categories depending on tool access, credentials, time horizon and approval architecture.

The agent chain is:

Goal → observation → state → plan → permission check → action → changed environment → verification → revision → completion or escalation

The unit of risk is the trajectory, not one model response. A mistaken early observation can distort later planning. An action can change the environment, and that changed environment can then appear to confirm the mistaken plan. Agent failures are journeys with luggage.

6. Authority Is a System Property

Autonomy should not be represented as a single switch.

The map records at least five dimensions:

Goal autonomy: how broadly the system may interpret the objective.
Planning autonomy: whether it chooses its own steps.
Action autonomy: which actions require approval.
Temporal autonomy: how long it may continue without renewed consent.
Resource autonomy: which credentials, money, computation and communication channels it may use.

A system can be highly autonomous in scheduling but unable to spend money. It can choose tools freely but require approval before sending external messages. It can operate continuously inside a sandbox while having no production access.

This multidimensional model is more useful than branding a product “autonomous” because the word currently has the precision of a foghorn in a library.

7. The New Permission Ladder

This study adds a permission and action ladder:

Requested: a user states a goal.
Interpreted: the system constructs an operational understanding.
Planned: candidate steps are proposed.
Permitted: credentials and policy allow a step.
Approved: a human or institution authorises it where required.
Executed: the tool changes state.
Observed: the result is returned.
Verified: success and side effects are checked.
Accepted: an accountable party accepts the result.
Recoverable: rollback or remediation remains possible.
Recorded: the trajectory enters logs and provenance.
Appealable: affected parties can challenge the action.

“AI-generated” describes none of these states adequately. A generated proposal may never be permitted. A permitted action may not be approved. An executed action may not be verified. A logged action may still be unjust.

8. Provenance Adds History, Not Omniscience

Digital provenance systems respond to the ease with which files lose their production history during copying and redistribution.

The provenance chain is:

Asset → hash → assertions → manifest → signature → certificate chain → distribution → validation → contextual verification

The chain can support several claims:

specified bytes have not changed since signing;
a key signed a manifest;
a recognised issuer associates that key with an identity or device;
declared ingredients and edits form a machine-readable history;
a timestamping service asserts that a representation existed by a given time.

It cannot establish automatically that:

the signer was honest;
the camera recorded the claimed event rather than a staged one;
the history includes every earlier transformation;
the caption is accurate;
the signer had moral or legal authority;
the represented proposition is true.

Provenance is evidence about the production chain. Truth remains a wider investigation.

9. Integrity, Identity, Authenticity and Truth

This study formalises four separate properties.

9.1 Integrity

Has the protected object changed since the signed state?

9.2 Identity

Which key, device, person or organisation made the claim?

9.3 Authenticity

Is the object what it claims to be in the relevant context?

9.4 Truth

Does the represented proposition correspond with reality?

These properties can diverge.

A dishonest institution can sign a false statement with perfect integrity.
An authentic photograph can be presented under a false caption.
A synthetic illustration can have honest provenance and legitimate purpose.
A true witness image can lack credentials because it was captured on unsupported hardware.

The map must never use “verified” without specifying which property was checked.

10. The Shared Need for Evidence Lineage

All three topics require lineage, but at different layers.

10.1 Assistant lineage

Record, where appropriate:

model and version;
system and user instructions;
conversation state;
retrieval queries;
source identifiers and versions;
tool observations;
generated claims and citations;
human edits and approval.

10.2 Agent lineage

Record:

delegated goal and constraints;
identity and credentials;
plans and revisions;
actions and tool parameters;
observations and errors;
approval events;
external state changes;
verification, rollback and escalation.

10.3 Content provenance

Record:

capture or generation origin;
ingredients;
transformations;
signer identity claims;
timestamps;
certificate status;
publication and custody events.

A universal lineage system is unlikely because privacy, security and volume differ by context. The shared principle is that consequential outputs should not arrive as orphans.

11. Evidence and Action Require Different Confidence

An assistant may safely present an uncertain possibility if uncertainty is visible and the user remains the decision-maker. An agent acting on the same possibility may require a much higher threshold.

The appropriate confidence depends on consequence:

| Use | Typical consequence | Suitable control | |---|---|---| | Brainstorming | Low and reversible | Generated alternatives with disclosure | | Research summary | Epistemic | Source inspection and claim-level citations | | Internal draft | Moderate | Human review before publication | | External communication | Social or legal | Approval before sending | | Financial transaction | Material | Strong identity, limits and independent verification | | Account deletion | Potentially irreversible | Explicit contemporaneous approval and backup | | Safety-critical control | Physical harm | Domain certification, redundancy and deterministic safeguards |

The same model accuracy cannot justify all of these uses. Consequence, reversibility and observability matter as much as benchmark performance.

12. Human Oversight Must Be Operational

“Human in the loop” can describe meaningful governance or a ceremonial button.

Oversight is meaningful only when the human has:

sufficient time;
access to evidence;
a comprehensible explanation of the proposed action;
authority to refuse or modify it;
freedom from incentives that punish careful review;
a practical way to interrupt execution;
a recovery path after error.

If reviewing the agent's plan requires more effort than doing the task manually, people will approve mechanically. That is not oversight. It is liability being passed around in a fluorescent vest.

13. Attack Surfaces Converge

Assistants and agents ingest untrusted information. Provenance systems depend on trusted keys and metadata. Their attack surfaces intersect.

A malicious document can inject instructions into an assistant.
The assistant can pass those instructions to an agent.
The agent can use valid credentials to perform an unauthorised action.
The resulting artefact can be signed by a compromised or over-broad identity.
A receiver can see technically valid provenance and infer excessive trust.

The defence must therefore cross layers:

permission-aware retrieval;
separation of data and instructions;
least-privilege tools;
approval gates;
sandboxing;
action verification;
key protection and revocation;
provenance interfaces that state exactly what validated.

14. Missing Evidence Is Not Negative Evidence

The final batch reinforces an asymmetry that appears throughout the map.

Failure to retrieve a source does not prove the source does not exist. Missing provenance does not prove an asset is false. Absence from an agent's observation does not prove the environment lacks the relevant state.

Negative conclusions require coverage claims:

Which corpus was searched?
How current was the index?
Which permissions applied?
Which tools and sensors were available?
Which file transformations preserve credentials?
Which jurisdictions or systems were outside scope?

The machine can report what it observed. It should not quietly promote incomplete observation into universal absence.

15. New Cross-Topic State Ladder

This study adds a common machine-mediated responsibility ladder:

Human or institutional purpose exists.
Goal or question is expressed.
System interprets the expression.
Evidence or environment is sampled.
Machine proposes meaning, plan or claim.
Permission and policy are applied.
Output or action is generated.
Provenance and logs are attached.
Receiver or environment encounters the result.
Human or institutional verification occurs.
Consequence follows.
Correction, appeal or recovery remains possible.
The event enters future memory, training data or institutional precedent.

The ladder closes the feedback loop. An assistant answer can become a source. An agent action can alter the database. A signed artefact can be used as future evidence. Machine-mediated outputs do not leave the system after publication. They return as inputs.

16. Scarcity Migrates Again

Earlier eras reduce scarcity in recording, copying, distance, computation, storage, publication and discovery. Era VII reduces the cost of interpretation, synthesis and some forms of action.

Scarcity migrates towards:

reliable evidence;
accountable authority;
high-quality human attention;
trusted identity;
permission design;
recovery capacity;
provenance continuity;
institutional legitimacy;
the right to appeal machine-mediated decisions.

The final map therefore does not end with unlimited information. It ends with a more difficult trust problem.

17. Batch Relationship Spine

The recommended spine is:

Generative Language Models Generative Language Models
→ Conversational AI Assistants and Retrieval-Augmented Generation Conversational AI Assistants and RAG
→ Autonomous and Semi-Autonomous AI Agents Autonomous and Semi-Autonomous AI Agents

With the parallel governance edge:

Binary digital representation Binary Digital Representation

cryptographic hashing and signatures

archival provenance
→ Digital Provenance and Authenticity Systems Digital Provenance and Authenticity Systems

And the cross-cutting relationship:

Digital Provenance and Authenticity Systems authenticates claims and histories associated with assistant sources, agent actions and synthetic media, without replacing factual verification.

18. Register and Taxonomy Decisions

This study recommends:

retaining Conversational AI Assistants and Retrieval-Augmented Generation under Interpretation & mediation, while expanding its secondary categories to interaction, storage, identity and governance;
retaining Autonomous and Semi-Autonomous AI Agents under Interpretation & mediation, while making authority, feedback, security and coordination explicit;
retaining Digital Provenance and Authenticity Systems under Governance, trust & control, while expanding its connection to encoding, identity, distribution and security;
defining assistant, agent and provenance as socio-technical systems rather than model classes;
recording autonomy as multidimensional;
recording provenance validity separately from proposition truth;
treating citations, action logs and content credentials as evidence interfaces whose meaning must be explained.

19. Publication Opportunities

Long-form essay

From Answer to Action: How Machine-Mediated Meaning Acquired Authority

Video series

Why an AI Assistant Is Not Just a Language Model
The Moment an Assistant Becomes an Agent
What Happens When a Model Can Click Send?
Content Credentials: What They Prove and What They Do Not
The Final Bottleneck Is Trust

Interactive resources

Assistant-versus-agent authority simulator.
Claim-to-citation support inspector.
Permission and approval-gate designer.
Provenance-chain validator.
Integrity, identity, authenticity and truth classification exercise.

20. Batch Conclusion

This study completes the original topic set by following machine-mediated meaning to its institutional edge.

The assistant compresses many information systems into dialogue. The agent converts dialogue and interpretation into action. Provenance attempts to preserve an accountable history of the artefacts and claims that result.

The completed sequence is not:

machine understands → machine acts correctly → credential proves truth

It is:

machine interprets under uncertainty → institution delegates bounded authority → system acts through fallible tools → provenance records selected claims → humans and organisations remain responsible for verification, legitimacy and consequence

That final distinction is the lock on the whole grimoire.