Provenance
At The Drive AI, we strongly believe that AI Agents will write most documents moving forward. “Was this made by AI?” then answers itself, and the question left is who stands behind it, and whether this is the version they approved. A document from The Drive AI can carry a signed record that answers both: the person it was made for, the agent that made it, the files it drew on, and the person's approval of this exact content. Anyone can check it, with no account.
Everything is checked in your browser with the published keys: the record's signature, that these exact bytes are the ones it binds, and that the approved bytes are the file's unchanged prefix. Only the record's id goes to the server, to ask the public log. A file without a record inside is looked up by its hash.
Drop a PDF or any file here, or click to choose one.
The file never leaves your browser.
A record proves origin and integrity: this exact content, made for this person by this agent, approved by this person at this time, and unchanged since. It does not prove the content is true. A file with no record is unverified, not forged.
1
The record is a signed statement (ES256). It is checked against the published keys, so anyone can tell it was made by The Drive AI and has not been altered since.
2
Inside a PDF the record sits in a slot of fixed length. The statement carries a hash of the whole file with that slot left out. One byte changed anywhere, or anything appended, fails.
3
The record is appended to the bytes the person approved as a PDF incremental update, so those bytes are the file's unchanged prefix. The verifier checks that too.
4
Every signing and every revocation is a leaf of a public, append-only Merkle log. The verifier asks for the record's inclusion proof under a signed head and reports a revocation when there is one.
In The Drive AI, or from Claude, ChatGPT or any assistant connected through the MCP server, ask the agent to sign the document.
certify_document names the file, the sources it drew on and the SHA-256 of the content as it is. Without the hash the call is refused; the person is never asked about bytes nobody named.
The confirmation, in the assistant or on a card in the app, is bound to the hash. A file that changed between the ask and the signing is refused, not signed.
The row exists before the file is touched, so a record never points at nothing. A PDF then takes the record as an incremental update; the unsigned bytes are kept as a version and the activity log says who signed.
The signing is appended to the public Merkle log and the head is re-signed. A later withdrawal is logged the same way.
Example: Sign the engagement letter in /Clients/Ola as final, citing the three source files.
The statement is public by construction: it travels inside the file and is served to anyone holding a hash. So it carries only what the person agreed to publish, and never a workspace, file or user id, nor a folder path.
hashSHA-256 of the bytes the person approved, and their sizeboundSHA-256 of the file around the record's slot, for a record inside a PDFsubjectthe person the document was made for, by name and email, as they agreed to publishagentwho made it: an outside assistant through the MCP connector, by its client name, or The Drive AI's own agentapprovalwhen the person approved that exact content, and how: a confirmation in their assistant or a card in the appsourcesthe files the agent said it drew on, by name and hash: the agent's claim, checked for existence and hashed at signingprevthe record before it, when the same file was signed beforenotea few words from the person, when they gave someThe verifier is an open package, MIT-licensed, with no dependencies: the same code this page runs. It checks the signature against the published keys, the binding, the approved prefix and the log's inclusion proof under a signed head. Its README is the whole format, written for someone who has never seen our code.
npx @thedriveai/provenance-verifier contract.pdfhttps://service.thedrive.ai/.well-known/provenance-keys.jsonhttps://service.thedrive.ai/.well-known/provenance-log.jsonThat this exact content was made for a named person by a named agent, that the person approved it at a stated time, and that it has not changed since. It does not prove the content is correct. It says who to hold to it.
No. Drop the file on this page, or run the open verifier from a shell. The keys and the log are public. Nothing but the record's id leaves your browser.
Classifiers decay and text watermarks do not survive a paraphrase. Agents will write most documents, so the useful question is not whether AI was involved but who stands behind the result. A signed record answers that.
Only what the person agreed to publish: their name and email, the agent's kind and client name, the file's name and type, its hash and size, the time, the note, and the sources' names and hashes. Workspace, file and user ids and folder paths never enter the statement.
Any file in a workspace, or in a connected Google Drive, OneDrive, SharePoint or Dropbox, gets a registry record, certified where it lives. A PDF also carries the record inside it, bound to its bytes, so the file proves itself with no call to us; on a connected drive the platform's own version history keeps the bytes before. Notes and documents a platform renders on request (a Google Doc) have no fixed bytes: export them as a PDF first. Editable formats such as .docx are registered as they are.
The agent asks with the file's hash. The person's confirmation, in their assistant or in the app, is a decision about that content and nothing else. A file that changes between the ask and the signing is refused, not signed.
A withdrawn record stays and says so, and the withdrawal is logged so it cannot be quietly undone. When a person erases their account their records are revoked and their name, email and the signature are cleared; a verifier is told revoked, never shown who.
A signature proves a record was not altered after we made it, not that we did not make it later or drop it. Every signing and revocation is a leaf of a Merkle log whose signed head is published. An entry inserted later, backdated or removed changes every head after it, and anyone who kept a head can tell.