Skip to content

CONCEPT Cited by 1 source

Observed-resource provenance

Observed-resource provenance is the runtime record of the concrete resources an agent or generated application actually read or otherwise observed while performing work. Unlike a static entitlement list, it captures the resources that shaped a particular workspace, output, dashboard, application state, or future action. It lets later sharing and egress decisions be evaluated against data exposure rather than against only the caller's original tool permissions.

Why it matters

An agent may hold permission to call a broad tool but inspect only a narrow subset of its resources. Conversely, a policy that only checks the initial call cannot protect against a later flow: an agent may read a restricted warehouse table, place its result in a dashboard, then share that dashboard with a user who lacks table access. Observed-resource provenance supplies the missing input for that later authorization decision.

In Cloudflare OS, observations remain attached to the agent and its work. Before another user opens the workspace, interacts with its agent, or views an output, Gatekeepers verify access to the recorded resources. The same record can prevent certain external writes, invitations, agent hand-offs, or outbound requests after a sensitive read. (Source: sources/2026-08-05-cloudflare-os-an-open-platform-for-agents-apps-and-work)

Relation to adjacent concepts

  • Data lineage normally represents source-to-sink relationships for data assets, often for audit or analysis. Observed-resource provenance is an execution-context record attached to a particular agent/work item and used for online authorization.
  • Information flow control is the broader security model in which labels propagate with data and transfers are checked at runtime. Observed-resource provenance is a practical agent-workspace form of propagation: it records what was read, then uses that record to gate later collaboration and egress.
  • Least privilege restricts initial capabilities. Provenance constrains what may happen after an allowed capability reveals sensitive data; both are necessary.

Caveats

The Cloudflare OS article does not specify whether observation is tracked at object, row, field, query, response, or derived-artifact granularity; how long it persists; how it handles transformations and summaries; or how false positives/negatives affect collaboration. Treat it as an architectural disclosure rather than a complete provenance model.

Seen in

Last updated · 622 distilled / 1,953 read