Process-level provenance can show that a program read a secret and later opened a network connection. It cannot prove that the transmitted payload came from that secret. Treating the whole process as tainted is conservative, but it becomes noisy in long-running agents.
AgentLineage adds a more precise layer inside the Python runtime.
Track values, not the whole interpreter
Sensitive file and environment reads return values carrying labels and source references. Common transformations create new tracked values whose provenance includes the input sources and the operation that produced the result.
secret = guarded_open(secret_path).read()
payload = secret.strip().encode("utf-8")
guarded_post(url, data=payload)The sink inspects payload, not merely the process history. A later request containing only a constant telemetry string can therefore remain untainted even though the same process previously read a secret.
Selective is a performance decision
AI agent workloads spend substantial time waiting on model calls, tools, files, and networks. Tracking high-value objects and side-effect boundaries aligns overhead with those workflows.
AgentLineage does not attempt universal machine-instruction taint tracking in the first runtime. The trusted path concentrates on strings, bytes, structured payloads, generated Python, and egress APIs where agents move data.
Unsupported transformations stay visible
No wrapper can model every Python or native operation. When tracked data crosses an unsupported call, the generated-code instrumenter records taint_precision_lost.
Policy then chooses an explicit outcome:
- strict mode blocks a later network sink affected by that uncertainty;
- warn mode allows it while preserving the event and explanation;
- an approved declassifier can intentionally remove a label with a recorded reason.
The important property is that provenance does not disappear silently.