---
id: ai-moderators-and-provenance-signals/05-reframed-as-a-prior-provenance-earns-a
title: 'Score provenance as evidence, never as permission: AI moderators and provenance
  signals: 5. Reframed as a prior, provenance earns a little and costs little'
report: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals.md
section: 5
version: 1
updated: '2026-10-27'
author: Hiina
---

Index of everything on this site: https://ai.hiina.space/index.md

# Score provenance as evidence, never as permission: AI moderators and provenance signals: 5. Reframed as a prior, provenance earns a little and costs little

- Section 5 of 11 of the report "Score provenance as evidence, never as permission: AI moderators and provenance signals" by Hiina (v1, updated 2026-10-27)
- Report overview and contents: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals.md
- Previous: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals/04-vouching-works-when-identity-sits-beneath-the.md
- Next: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals/06-the-lab-backstop-runs-through-bans-not.md

## 5. Reframed as a prior, provenance earns a little and costs little

The earlier companion analysis stands, and this report does not reopen it. OpenAI's ChatGPT Work cloud browser signs requests under RFC 9421 ([OpenAI](https://help.openai.com/en/articles/11845367-chatgpt-works-cloud-browser-allowlisting)). Anthropic documents IP lists and no signing ([Anthropic](https://support.claude.com/en/articles/8896518-about-claude-s-web-crawler)). An October 2026 feature request asks Anthropic to start ([GitHub](https://github.com/anthropics/claude-code/issues/101972)). API and CLI agents run from the developer's own machine. In-browser agents look like the user ([Centinel](https://www.centinelanalytica.com/blog/ai-browser-agents)). A signature shows key control, not intent, and covers no body by default ([IETF draft](https://www.ietf.org/ietf-ftp/internet-drafts/draft-ietf-webbotauth-httpsig-protocol-00.html)). As a first-line gate the idea mostly fails. The question here is whether demoting provenance to one input among many saves anything.

### Where the reframing rescues the idea

It drops the false premise that a signature means approved content: a prior only claims that signed traffic has a different spam rate. It fits the draft's own advice that signature handling is "origin policy" and that "absence of a signal is not evidence" about the party that did not send it ([IETF draft](https://www.ietf.org/ietf-ftp/internet-drafts/draft-ietf-webbotauth-httpsig-protocol-00.html)). That supports a bonus for signed traffic, such as fewer CAPTCHAs, higher rate limits or no proof-of-work, and no penalty for unsigned traffic. Most usefully, a stable key is a bucket for outcome statistics. A forum can compute flag and removal rates per `Signature-Agent`, the way Gmail computes spam rate per domain. This is the measuring device the outer loop needs, and it works even if the prior turns out to be worthless.

### Where it doesn't

Coverage is still mostly OpenAI's cloud browser and a few hosting platforms, so the prior applies to a sliver of agent traffic and none of Claude's. Its sign is unknown. Signed agents may be cleaner (accountable operators) or dirtier (cheap volume through an intermediary). And it will drift: once a forum rewards signed traffic, spammers route through signed intermediaries, as they bought aged SendGrid accounts (inference from [Krebs](https://krebsonsecurity.com/2020/08/sendgrid-under-siege-from-hacked-accounts/)). The likely abuse is mild commercial posting, which lab harm categories do not clearly cover. And any visible "signed" badge risks the anchoring effect above.

### A worked example (inference, assuming the signal is independent of the classifier)

Take a forum where 2% of posts are spam and a classifier with 90% recall at a 1% false-positive rate. A flagged post is spam about 65% of the time. If signed posts have half the base odds of spam, a flagged signed post is spam about 48% of the time. If they have double the odds, about 79%. The same classifier flag carries a different posterior, so provenance should move the action band, for example sending flagged signed posts to the queue instead of removing them, and should not override the classifier. The useful weight is a likelihood ratio that each forum measures. On today's evidence nobody can say whether that ratio is 0.5 or 2.

### A composition that matches public practice (inference)

Hard prerequisites (rate limits, schema, write-binding signature components if signatures are used). Then per-account reputation, earned inside this forum the way Discourse trust levels and Stack Exchange privileges work ([Discourse](https://meta.discourse.org/t/understanding-discourse-trust-levels/90752); [Stack Overflow, 2010](https://stackoverflow.blog/2010/03/19/important-reputation-rule-changes/)). Provenance enters here as a capped prior. Then a per-post content score from a spam-policy classifier. Then the band choice, with an LLM judging rule intent only on queued items. Public descriptions support each stage separately. No source states this whole pipeline, and none publishes how it weights verified-bot status in write moderation.

---

Text licensed CC BY 4.0 (attribution: Hiina, ai.hiina.space). Source: https://github.com/hiinaspace/ai-hiina-space