{
  "id": 19912818,
  "title": "Who wrote this code? AI provenance starts with the wrong question",
  "url": "https://urgent.news/2026/11/14/who-wrote-this-code-ai-provenance-starts-with-the-wrong-question",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-14T04:00:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/naman_here/who-wrote-this-code-ai-provenance-starts-with-the-wrong-question-2jdb"
  },
  "original_language": "en",
  "account": "<ins>AI Provenance: The Real Question</ins>\n\nThe recent incident where a pricing change led to a customer losing access to a feature sheds light on the growing issue of AI provenance. Originally published at <source 5181895d-ecb>, the code change in question was made by an AI coding agent, but the underlying decision behind the change remains unclear.\n\nWhen a customer experiences an unexpected change, it's natural to ask \"Who wrote this code?\" However, the more critical question is \"Who decided what the code should accomplish?\" A commit in a version control system provides a record of when a file was altered, who authored the change, and how the repository progressed from one version to the next. Yet, this record does not inherently capture the reasoning behind the change.\n\nAI agents can compress the entire decision-making process into a single commit, making it difficult to discern the rationale behind the code. While attribution metadata can track AI contributions, it does not provide insight into why the code was implemented in a particular way. Multiple AI-generated changes can result in conflicting outcomes, highlighting the need for a separate layer of decision provenance.\n\nTo address this, teams should strive to gather and preserve decision provenance alongside AI provenance. Decision provenance provides context for why a change was made, including the active team decision, its owner, the alternatives considered, the evidence used, and the approval that allowed the change to be implemented. This information is crucial for understanding the intent behind the code and ensuring that the final product aligns with the intended business decisions.\n\nWhile storing complete agent transcripts may seem like a solution, it is not without its drawbacks. Raw transcripts can contain sensitive information, such as credentials, customer data, and irrelevant context. This raises privacy and security concerns and may make it difficult to reconstruct the final decision later. Instead, teams should focus on keeping only the essential evidence needed to explain the change, without overwhelming the system with unnecessary information.\n\nIn conclusion, the true challenge lies not in identifying the AI agent that made the change, but in understanding the decision-making process that led to that code. By establishing a robust provenance system that captures both AI contributions and the underlying business decisions, teams can ensure transparency, accountability, and alignment with the intended outcomes.",
  "summary": "Originally published at getlockstep.dev . A customer loses access to a feature after a pricing change. The code path is easy to find. git blame points to a commit from three weeks ago. The commit is clean: one eligibility condition changed, tests updated, pull request approved. The diff was written by an AI coding agent, but the commit sits under an engineer's name because that is how the work…",
  "key_points": [
    "AI coding agents made the code change without clear decision-making context.",
    "Commit records in version control show when code was altered but not the reasoning behind it."
  ],
  "editors_take": "Shifting focus from code authorship to decision provenance allows teams to maintain accountability and ensure that automated agent changes align with intended business logic and strategic goals.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}