Content Provenance and the AI-Drafted Refusal
What it is
CMDash records where evidence-bearing content came from, and refuses to let AI-written text stand as evidence. Every evidence record and every policy version carries one of four provenance values:
| Provenance | Meaning |
|---|---|
| Machine collected | Gathered by an integration or collector. May back a claim. |
| Human attested | A person's own act: uploaded, edited and approved, or marked reviewed. May back a claim. |
| AI drafted | Written by AI and not yet changed and approved by a person. Never backs a claim. |
| Unknown | CMDash cannot tell where it came from (for example it arrived before this tracking, or was imported). Never backs a claim until a person attests it. |
The rule is unknown is never pass: only the first two may back a claim. Unknown is refused exactly as AI-drafted is, because an unknown record may well be AI text.
When to use it
You do not switch it on: it is always on. Read this page when an attach is refused, or when you want to know what it takes to turn a draft into something you can stand behind.
Before you start
- Tier: none.
- Role: the refusal applies to everyone. The actions that clear it (editing and publishing a policy, reviewing evidence) follow the normal roles.
How to
What is refused
An attach is refused with a 422 and a plain error code when the content is AI-drafted
(AI_DRAFTED_EVIDENCE_REFUSED) or of unknown origin (UNKNOWN_PROVENANCE_EVIDENCE_REFUSED). The
refusal happens before anything is written, and covers linking evidence to a control, linking
a policy to controls, propagating evidence across crosswalked lines, and record links. A
proof receipt is not signed over evidence that fails the same check. The
error names the record and the way out.
Clear an AI-drafted policy
AI text becomes human text only when a person changes it and the approval your organization configured is then given:
- Edit the policy text and publish it as a new version. Whitespace-only changes do not count as an edit; any visible change does.
- If your policy approval workflow is off (the default), the OWNER or ADMIN's publish is the approval, so the edited version is human attested at once. If the workflow is on, the edited version stays AI drafted until the reviewer quorum approves it.
- Approving an AI draft without changing it does not change its provenance. Publishing it untouched, approving it, activating it, or reverting to it after a human edit all leave it AI drafted, because CMDash re-derives whether it was edited from the text itself.
A draft saved from the Draft with AI dialog is declared AI drafted as a whole, even if you edited it in the dialog before the first save; that first save is the text later versions are compared with. A declaration can only lower provenance to AI drafted; no request can raise one to human attested. Text produced by some AI outside CMDash and pasted into the ordinary editor is treated as the publishing person's own attestation, because they published it under their name.
Clear an unknown-origin evidence record
A named person resolves it: a reviewer marks the evidence Reviewed or Approved (a Rejected or Pending status vouches for nothing), or someone uploads the artifact behind it, which makes the content that person's. The passage of time never resolves it. One exception exists for unknown records only: a record filed against a control already shows on that control's own line, so that one link is allowed; any other control is refused until a person attests the record.
AI-drafted evidence
An AI-drafted evidence record is not cleared by a review or by uploading a file beside it: approving AI text without changing it is the laundering the rule exists to stop. Attach the underlying artifact (a document, screenshot or export) instead.
Where it shows
Sampling Export lists policy versions with their provenance, so an AI-drafted version is visible as such to an assessor. The Skeptic's explanations are labelled AI-drafted and can never be attached (Skeptic).
Common questions
Can AI write a receipt or an attestation? No. AI never writes evidence, receipts or attestations in CMDash, and anything AI-drafted is labelled.
Why was my evidence refused when I wrote it myself? If it predates provenance tracking or was imported, it may read as unknown. Have a reviewer mark it Reviewed or Approved, or upload the underlying artifact.