Provenance: Why Not Every Finding Deserves the Same Trust

Magatama started out with a simple rule: something on the fleet trips a check, the finding gets scored, and if the score clears a threshold, Magatama acts on its own. Restart a service, kill a process, roll back a config. For the first stretch of building it, that was the whole model. A finding was a finding. I judged each one on how bad it looked and nothing else.

That held up because every finding came from scanners I wrote myself and ran on hardware I control. I knew what they measured, I'd watched their false positives for months, and by the time I let Magatama act on their output I trusted it about as much as I'd trust my own judgment at three in the morning. Autonomous action on that kind of input felt earned rather than risky.

Then I started feeding in signal from outside the fleet. A public threat-intelligence feed, some scraped advisory text, the sort of thing that's supposed to make a security tool see further than its own logs. I wired it into the same pipeline as everything else, because once a finding hits the scoring layer it's just a record with a severity field and a description. It doesn't carry a return address by default.

The problem showed up when I actually thought through what that meant. If Magatama scores a finding purely on how convincing it looks, and one of its inputs is a feed I don't control the origin of, then whoever controls that feed's content effectively gets a vote on what my own infrastructure does. I don't run that feed. I can't audit who writes to it or how. Treating its output the same as my own scanner's meant I'd quietly outsourced part of my trust boundary to a source I have no relationship with beyond a subscription URL.

Nothing had to actually go wrong for that to bother me. Severity, computed from content alone, says nothing about who put that content there in the first place.

So I reframed the question Magatama asks about every finding. The old question was does this look dangerous. The new one is where did this come from, and do I control that origin. Everything that clears both, dangerous enough and sourced from something I built and can audit, stays in the autonomous tier. Everything that only clears the first gets downgraded no matter how alarming the payload reads. It gets logged, flagged, surfaced to me. It doesn't get to touch anything on its own.

In practice this meant adding a provenance tag at ingestion, something as basic as marking each source as self-controlled or external, and hard-coding a ceiling on what external sources are allowed to trigger regardless of their computed score. A feed I don't run can flag something as critical all it wants and land at the top of a review queue. It cannot restart a service or touch a config file. Only my own vetted checks get that authority, and only because I know exactly how they were built.

I'll admit the first version of this felt like overreacting to a threat that hadn't happened. Nobody had poisoned a feed I was using, as far as I know. But the failure mode is obvious once you say it out loud: an external source doesn't need to touch Magatama's code at all. It just needs to write something convincing enough to a channel Magatama already trusts. That's a much easier attack than anything involving my actual servers, and I'd built a system that would have handed it the keys.

The annoying part is that this cost me some of the simplicity I liked about the original design. I can't just add a new intel source and let it plug straight into the action pipeline anymore. Every new integration now comes with an extra few minutes of asking myself whether I control where the data originates, or whether I'm just trusting a hostname. Most of the time the answer is embarrassing.

What I ended up with is a distinction between trusting what something says and trusting where it came from. Those turned out to be two completely different questions, and I'd spent a long time answering only one of them.