4.4 Output Attribution

Description

Agent outputs MUST be cryptographically attributable to their source.

Rationale

Without attribution, malicious outputs cannot be traced to their source.

Audit Procedure

1. Check if outputs are signed
2. Verify signature validation
3. Check for timestamp inclusion

Remediation

1. Sign all agent outputs
2. Include provenance metadata
3. Store outputs in append-only log

Framework Mappings