How to Implement Code-Level AI Provenance Across Your Tools
Written by: Mark Hull, Co-Founder and CEO, Exceeds AI | Last updated: July 15, 2026
Key Takeaways
Engineering leaders lack auditable proof of which AI tools produced specific lines of code across platforms like Cursor, Claude Code, and GitHub Copilot, which creates compliance and security risks.
Heuristic and watermark-based detection methods reach only 20–25% accuracy, so they cannot support board audits, patent reviews, or security investigations.
Client-level capture combined with portable Git Notes attestations provides an architecture for authoritative, line-level AI provenance without long-lived daemons or global git mutations.
Interaction-mode classification (plan, ask, agent, edit, headless) enables coaching and governance that simple descriptive dashboards cannot deliver.
Exceeds AI delivers the code-level truth needed for board-ready ROI reporting, security audit defensibility, and meaningful coaching at scale—book a demo today.
Read This First: Prerequisites for Provenance Rollout
Confirm the following prerequisites before starting implementation:
Repository access on GitHub, GitLab, or Azure DevOps (ADO) with permission to install Git hooks per repo
A completed security review readiness checklist covering data residency, prompt handling, and token revocation requirements
A documented inventory of AI tools in active use across the engineering organization, including which teams use Cursor, Claude Code, Codex, GitHub Copilot, and Windsurf
Clarity on interaction-mode classification needs, since plan, ask, agent, edit, and headless modes produce different risk and coaching signals and must be captured distinctly
Stakeholder alignment on privacy rungs before deployment (covered in Step 3)
Step-by-Step Tutorial
Step 1: Define Provenance Requirements and Accuracy Targets
Begin by documenting what the provenance record must prove and to whom. Board-level ROI reporting, patent examiner inquiries, SOC 2 audits, and EU AI Act transparency obligations each impose different evidentiary standards. The EU AI Act applies high-risk obligations from August 2026 in phases but does not require pull-request logs to capture AI authorship as a structured field.
Set an explicit accuracy target that matches those standards. For board reporting or security triage, the target is 100% authoritative attribution, not a statistical estimate. Document which repositories are in scope, which teams are included in the pilot, and which interaction modes require classification from day one.
Step 2: Choose a Capture Method That Produces Evidence
Two architecturally distinct approaches exist for detecting AI-generated code.
The alternative approach, client-level capture, solves this gap by observing what actually happens on the developer’s machine at the moment the work is done. It records which tool was invoked, how many turns the session ran, and which lines the AI produced versus which the engineer typed. This method produces an authoritative record that survives tool changes and workflow shifts.
Pro Tip: Set the bar at 100% authoritative attribution from the start. Only client-level capture can meet that bar. Any architecture that relies on post-hoc inference will degrade as AI tools evolve and as engineers switch between tools mid-session.
Step 3: Install the Provenance Layer on Developer Machines
Exceeds Ink is a single ~10 MB Rust binary that installs on each developer’s machine. It uses a hook-direct model where capture is invoked from standard Git hooks (prepare-commit-msg, post-commit, post-rewrite) on a per-repo opt-in basis. It does not run a long-lived daemon, does not install a PATH-shimmed git binary, and does not mutate global git config. Every event lands in a local SQLite database on the developer’s machine before any optional remote delivery.
Before rollout, configure the privacy rung for each team. The four available rungs represent increasing levels of data sharing, which lets you balance governance needs against privacy constraints:
Local only, where nothing leaves the machine
Aggregate only, where you see spend and tool inventory without prompt access
Abstracted replay, where AI-redacted prompts and suppressed transcripts protect sensitive content
Full identified replay, where verbatim content is captured by explicit engineer approval
This flexibility allows different teams in the same organization to run at different rungs based on their compliance requirements. Git Notes store session hash references rather than inline transcripts, which keeps PII out of Git history by default.
Step 4: Configure Per-Tool Adapters and Interaction-Mode Classification
Exceeds Ink ships dedicated checkpoint materializers for Claude Code, Cursor, and Codex. These modules resolve edit evidence against the actual working tree at commit finalization, so multi-edit Cursor sessions correctly retain human-typed lines and Claude Code rewrites are attributed to Claude. GitHub Copilot and Windsurf are covered by additional adapters, with lighter-weight detection available across up to approximately 50 AI tools.
Interaction-mode classification for plan, ask, agent, edit, and headless is captured per session. This signal forms the foundation for actionable coaching. Teams with fully governed AI use report higher rates of major efficiency gains compared with teams without full governance. Mode classification turns governance from descriptive reporting into a basis for targeted interventions.
Watchout: Global git config mutations break existing Trace2 tooling. Some competing provenance tools overwrite trace2.* keys during installation, which silently clobbers any prior Trace2 configuration. Exceeds Ink makes no global git config changes, and per-repo opt-in remains the only installation footprint.
Step 5: Generate and Store Git Notes Attestations
At commit finalization, Exceeds Ink writes a structured attestation as a Git Note at refs/notes/exceeds-ink. The note is line-level, portable across forks and mirrors, and machine-readable by any Git client. Lines that cannot be confidently attributed are recorded as unknown_lines, not silently rolled into “human” or “AI.”
The following example illustrates how the attestation captures tool identity, interaction mode, line-level attribution, and token cost in a single machine-readable record:
Key fields include tool, which identifies the AI coding assistant, and model, which identifies the underlying LLM. session and turn enable replay and audit, while interaction_mode classifies how the engineer worked. timestamp anchors the record to a point in time, unknown_lines preserves epistemic honesty, and token_cost connects spend to shipped output.
Step 6: Visualize AI vs. Human Lines in Pull Requests
Once attestations are in place, the Exceeds AI platform surfaces line-level attribution directly in the PR view. Reviewers can see exactly which lines in a given diff are AI-generated, by which tool, and in which mode. AI-generated code can take longer to review than human-written code, and provenance-aware review routing concentrates that overhead on the lines that warrant it.
View comprehensive engineering metrics and analytics over time
Step 7: Enforce Provenance Policies in CI/CD
The structured JSON attestation lives in the repository, so it becomes a natural input to policy engines. Concrete policy examples include blocking deploys when AI authorship exceeds a defined threshold in security-sensitive paths. You can also require additional review on commits where agent mode produced more than a specified percentage of the diff and flag commits with a high unknown_lines ratio for manual triage. Automated security and governance guardrails that scale with development velocity are essential for teams that want sustainable AI adoption.
Validation and Success Criteria
A correctly implemented provenance layer produces observable, verifiable indicators:
Every commit in scope carries a Git Note at refs/notes/exceeds-ink with a valid authorship/3.0.0 schema
The attestation is resolvable by any Git client with repo access, without depending on the Exceeds platform to read the record
unknown_lines counts are stable and low, which indicates that the checkpoint materializers are resolving edit evidence cleanly
Interaction-mode distribution across sessions is visible in the dashboard and matches engineering team expectations
Token cost per session is reconciled against billing data from each AI vendor
Security and legal stakeholders have signed off on the privacy rung configuration for each team
Scaling Provenance: Rollout, Governance, and Coaching
After the pilot cohort is validated, scaling across the full engineering organization involves three coordinated workstreams that reinforce each other.
Fleet rollout and policy refinement. Extend per-repo opt-in to all repositories in scope. Use Machine Integration Health signals, a dedicated prompt-free channel in Exceeds Ink, to confirm hooks are installed, adapters are wired, and deliveries are succeeding across the fleet without inspecting prompt content.
Skill transfer via ink-prompting-coach. The ink-prompting-coach installs directly into the developer’s own Claude Code or Cursor agent as a SKILL.md and slash command. When Best Practices Insights identify a session pattern worth scaling, such as a particular interaction-mode sequence or a prompting approach that correlates with lower rework, that pattern can be distributed as a versioned skill across the organization and rolled back cleanly if it does not land. Microsoft’s ICSE 2008 study found organizational-complexity metrics, including management span, to be among the strongest predictors of defect-proneness, and in-agent coaching helps maintain quality signal as manager-to-IC ratios widen.
Actionable insights to improve AI impact in a team.
FAQ
How long does it take to go from repo connection to first provenance insights?
GitHub or GitLab OAuth authorization takes about five minutes. Repo scoping takes another fifteen. First insights are visible within sixty minutes of completing the Exceeds Ink install on developer machines, and complete historical analysis is available within four hours. The Git Notes attestation is written at commit finalization, so new commits are attributed in real time from the moment hooks are active.
How does Exceeds Ink handle lines it cannot confidently attribute?
Lines that cannot be confidently attributed to a specific tool or session are recorded as unknown_lines in the attestation JSON. They are never silently rolled into the “human” or “AI” bucket. This conservative approach preserves the epistemic integrity of the record, so an auditor or patent examiner can see exactly what the system knows and what it does not, instead of receiving an inflated confidence figure. The unknown_lines count is a useful diagnostic, since a high ratio typically indicates a hook installation gap or an adapter configuration issue, both of which Machine Integration Health signals surface without touching prompt content.
What privacy controls are available, and can different teams run at different settings?
Exceeds Ink supports four privacy rungs. Local only keeps everything on the developer’s machine with no remote delivery. Aggregate only sends spend and tool inventory data without any prompt access. Abstracted replay uses LLM-based redaction to suppress transcripts before persistence. Full identified replay captures verbatim session content by explicit engineer approval. Different teams in the same organization can run at different rungs simultaneously, so a security team might run Local only while a product team runs Abstracted replay. Git Notes store session hash references rather than inline transcripts, which prevents PII from accumulating in Git history regardless of the rung selected.
How is Exceeds Ink architecturally different from tools that also produce Git Notes?
The key architectural differences involve operational footprint, attribution timing, and the behavior-change layer. Exceeds Ink uses short-lived hook processes only, with no long-lived daemon, no PATH-shimmed git binary, and no global git config mutation. Attribution is deterministic at commit finalization, because per-tool checkpoint materializers resolve edit evidence against the working tree before the commit is reachable for push, so a fast git push cannot race ahead of the attestation. The ink-prompting-coach then closes the loop by distributing coaching directly into the developer’s own Claude Code or Cursor agent, which turns provenance data into behavior change instead of leaving managers with a dashboard and no mechanism to act on it.
Can Exceeds AI replace existing developer analytics platforms like Jellyfish or LinearB?
Exceeds AI does not replace those platforms, and that separation is intentional. Jellyfish, LinearB, and Swarmia are metadata-only tools built for the pre-AI era, so they surface PR cycle time, commit volume, and review latency but cannot distinguish AI-generated lines from human-written ones and therefore cannot prove AI ROI at the code level. Exceeds AI acts as the AI intelligence layer that sits alongside those tools, providing the code-level truth that metadata cannot. Most customers run Exceeds alongside their existing stack, integrating with GitHub, GitLab, ADO, JIRA, Linear, and Slack rather than replacing any of them.
The implementation path stays concrete and repeatable: define requirements, choose client-level capture over heuristics, install Exceeds Ink on developer machines, configure per-tool adapters and interaction-mode classification, generate portable Git Notes attestations, surface attribution in PRs, and enforce provenance policies in CI/CD. First insights arrive within an hour, and defensible ROI proof follows within weeks.
