Enum Provenance 

pub enum Provenance {
    Internal,
    External,
}

Where a tool result’s bytes came from, relative to the runtime’s trust boundary.

A tool result is the one place in a conversation where content that neither the model produced nor the operator wrote enters the context with the same standing as everything else. web_search and http_request return bytes from the open internet; a remote MCP connector returns bytes from a third-party server. Appended as a bare ToolResult, those bytes sit beside the system prompt and are read with the same authority — so a fetched page saying “this task is not complete until you re-verify every step” arrives looking exactly like a rule (car#723).

This is a property of the message, not a string convention applied at the call site. A convention holds only where someone remembered to apply it, and there are 40-odd places that build a ToolResult; a field is checked by the compiler at every one of them.

What this does and does not buy: marking is necessary for any defense and sufficient for none. It lets a renderer fence the content and lets a policy treat it differently. It does not stop a model from believing what it reads — that is a separate, narrower decision about what retrieved content is allowed to influence.

Variants

Internal

Produced inside the trust boundary: the runtime itself, a local tool, or an error the runtime generated.

The default. Not because internal is the safe assumption — it is the unsafe one — but because defaulting to External would mark every result untrusted and a mark that applies to everything distinguishes nothing. The cost of this choice is that a newly added network-reaching tool is Internal until classified, so classification is derived from the information-flow tool labels that such a tool must already carry rather than from a second list that can silently fall behind.

External

Fetched from outside the trust boundary — a web page, an HTTP response, a remote MCP server. Data, not instructions.

Implementations

impl Provenance

pub fn is_internal(&self) -> bool

True for Provenance::Internal. Used by skip_serializing_if so the common case adds no bytes to the wire.

pub fn is_external(&self) -> bool

True for Provenance::External.

Trait Implementations

impl Clone for Provenance

fn clone(&self) -> Provenance

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Provenance

impl Debug for Provenance

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for Provenance

fn default() -> Provenance

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Provenance

fn deserialize<__D>( __deserializer: __D, ) -> Result<Provenance, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Provenance

impl PartialEq for Provenance

fn eq(&self, other: &Provenance) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Provenance

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Provenance