Signed metadata is authenticated. It is not encrypted.
A provenance graph can reveal source systems, internal paths, people, code, parameters, partners, and processing schedules. Put only the claims a recipient needs into portable statements, and protect the evidence bundle like any other sensitive operational record.
Minimize before signing
| Need | Prefer | Avoid |
|---|---|---|
| Source identity | Stable opaque URI or governed system identifier. | Credentials, query strings, access tokens, or raw connection URLs. |
| People and services | Key identifiers and policy roles resolvable by the receiver. | Personal email, display name, or team roster copied into every statement. |
| Transformation details | Operation type, code digest or reference, and the parameters needed for review. | Secrets, salts, proprietary source code, or raw PII in extensions. |
| Data constraints | Private, digest-pinned JSON Schema profiles and results. | Embedding sensitive schemas or sample records merely to explain the rule. |
| Artifact identity | Logical name, media type, digest, and optional size. | Unnecessary storage topology or temporary signed URLs. |
Patterns that preserve verifiability
- Private profilesAn organization can keep its schema bytes private. The signed reference pins their URI, root digest, and transitive closure; the receiver resolves them from an authenticated local catalog.
- Opaque identifiersUse stable URIs that carry no secret by themselves. Authorization and human meaning can live in a separate policy system.
- Commitments instead of disclosureHash exact artifacts or selected values when the receiver only needs equality or membership evidence. A digest does not anonymize low-entropy data, so model that risk explicitly.
- Separate encrypted transportEncrypt bundles in transit and at rest with ordinary security controls. Encryption is intentionally outside the signed statement format.
- Audience-specific handoffsCreate a handoff containing only the statements, profiles, and artifacts the recipient needs; do not export the producer's entire operational graph by default.
Privacy claims need their own evidence
Hashing an email does not automatically anonymize it. Redaction does not prove deletion from upstream copies. A profile can require that direct identifiers are absent, but the receiver must validate the actual structured artifact and still evaluate re-identification, retention, access, and legal obligations separately.
Treat every extension field as a permanent, signed export.
If a field is not needed for verification, leave it out. If a private rule is needed, pin its schema rather than publishing its contents.