How to use provenance hashes for AI citationsSHA-256 of JSON-LD + UPDATED_DATE. Deterministic. Free.
A provenance hash is a SHA-256 digest of the page's JSON-LD @graph plus its UPDATED_DATE. It lets human and AI citers pin to a specific page version instead of citing the URL ambiguously. Major AI engines do not yet broadly consume provenance hashes; this is a Tier-2 hedge with positive expected value. Promagen Sentinel ships it on every authority page.
By Martin Yarnold · UpdatedThe minimal implementation
Algorithm
Render
provenance: sha256:<first 16 chars>…. Full hash in claims.json route under provenanceHash.Frequently asked questions
What is a provenance hash?
A SHA-256 hex digest of a stable representation of the page's content — typically the JSON-LD @graph plus the page's UPDATED_DATE. It is a version pin: a citer (human or AI engine) can reference the hash to say "I cited the version with this hash" rather than "I cited the URL", which is ambiguous when the URL's content changes. Promagen Sentinel's authority pages display the hash in the footer (first 16 chars rendered, full hash recomputable from the JSON-LD).
How is it computed?
Two inputs hashed together: (1) JSON.stringify of the page's JSON-LD @graph; (2) the page's UPDATED_DATE string. Concatenate them, run through SHA-256, and you have a stable hex digest that changes when either input changes. Promagen's implementation is in frontend/src/lib/authority/schema.ts — function name provenanceHash(graph, updated). Same inputs always produce the same output; deterministic.
Why not just use a version number?
Version numbers require manual discipline to bump on every change. Hashes are mechanical — they change automatically when the underlying content changes. If a CMS editor updates a fact on the page and bumps UPDATED_DATE, the hash changes without anyone remembering to bump a separate version number. Hashes also catch drift the operator might forget: if the JSON-LD changes but UPDATED_DATE stays, the hash still moves, which is a useful signal.
Where should the hash be displayed?
In the page footer, as a small monospace line. Promagen's pattern: render the first 16 characters of the hash for visual brevity. The full 64-char SHA-256 hex is recomputable from the JSON-LD at any time, so storing the prefix is sufficient for human use. The full hash is also exposed in the page's claims.json route at provenanceHash, which is the machine-readable surface AI engines should consume.
What changes invalidate the hash?
Any change to the JSON-LD @graph (FAQ wording, title, description, schema structure) or any bump of UPDATED_DATE. Trivial edits (typo fixes, formatting) that do not change the JSON-LD or UPDATED_DATE leave the hash stable — this is intentional. The hash is for material content versioning, not edit history. If you want a hash on every commit, use git instead.
Do AI engines actually consume provenance hashes?
Honest answer: not yet broadly. No major AI engine publicly documents consuming provenance hashes as a citation surface. This is a Tier-2 differentiator that Promagen Sentinel ships in advance of broad engine adoption — the cost is low (a few lines of code), the upside if engines adopt it is high (verifiable citations), and it serves human verification today (anyone can hash the JSON-LD + UPDATED_DATE and confirm the page version). It is a hedge with positive expected value, not a guaranteed AI citation lever.