What can influence your agents — inventoried, reviewed, on the record.
What an agent picks up.
Each kind runs with a different blast radius. We rank them by that, not by their name.
Hooks and mods that run inside the agent, unsandboxed. The highest severity.
MCP servers the agent calls — CRMs, databases, internal APIs.
Prompts, skills and agent definitions that tell the agent what to do.
Packages the agent names and reaches for. A name that resolves in no registry is a hallucinated dependency — the slopsquatting attack vector.
How Provenance catches them →A review by someone other than the author is what counts.
Review · Approve · Declare · Exempt · Revoke — each recorded with a name and a date.
A review covers that exact version in every repository that uses it.
Owners are suggested from history; a review by someone other than the author is what counts.
“Changed since review,” not a surprise.
When a reviewed item changes, it returns to unreviewed until someone looks again.
Evidence, not another list.
Skills-registry, skill-review and MCP-allowlist controls in the 46-control library read their status from AI Zone — so the inventory shows up as evidence against your matrix, not as another list to track separately.
The questions teams ask.
Do you execute anything?
No. Everything is read as text; nothing is run.
Do you read our source code?
No. AI Zone reads the configuration your repositories already declare.
What about hooks configured on a developer's laptop?
Those live outside the repository and are out of scope — we say so rather than guess.
Can we see it as it was last month?
Yes — set the date. Where a day has no complete record, the page says so.
Related from Provenance.
See your evidence this afternoon.
Connect your first repo in minutes — read-only, no credit card, no sales call. Your Provenance Score, your blind spots, and your first board-ready briefing, from your own estate.