Start with the right question
A code suggestion can be useful while its origin and assumptions remain unclear. A provenance record gives maintainers a way to identify generated contributions and the review performed. It should support normal engineering practice rather than replace it with a promise of automatic legal safety.
Work through the checks
Mark the contribution
Record the relevant commit, file, tool, and date. Describe the task and any sensitive inputs excluded. Keep enough context to understand the suggestion without storing credentials or private customer material in the repository.
Review dependencies and resemblance
Inspect imports, copied comments, unusual identifiers, and external snippets. If the output resembles known code or contains a license notice, investigate rather than deleting the notice or assuming generation creates new rights.
Separate review types
Record functional tests, security review, and rights questions independently. A passing unit test only checks the behavior it exercises. It does not establish that the code is safe, original, or licensed for every use.
Retain human changes
Keep the commit history showing corrections and design decisions. Describe actual human contributions accurately. Do not rewrite the record to imply that generated portions were written entirely by a person.
A record you can use
- Commit and file
- Tool and task
- Generated portion and human changes
- Tests and review performed
- Rights or source question
Keep this record locally. Use document references rather than publishing account numbers or other people's personal details. An empty field means the information is still missing; it should not be filled with an AI guess.
Worked example
A fictional assistant proposes a parser that includes an unexpected dependency and a copied-looking comment. The developer records the suggestion, checks the dependency's source and license, and replaces the parser after review. Tests are rerun, but the review record does not claim that testing alone resolved the licensing concern.
This example is fictional and illustrates the method, not a real case result.
Limits and next steps
This record does not determine copyrightability or license compatibility. Provider terms, employment agreements, and third-party code can affect the analysis. Do not place proprietary prompts or secrets in a public provenance log.
Include the reviewed record in the software handoff and revisit it when generated components are reused elsewhere. Keep unresolved legal questions visible to the person approving distribution.