Provenance-Based Data Acceptance in Cross-Organizational Pipelines: Design, Implementation, and Evaluation of dPLaaX and provin

Abstract

This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. Recording provenance and deciding whether data may be accepted are not the same operation. As generative artificial intelligence expands cross-organizational data production, more data reaches downstream processing before human review. This paper tests a conditional, existential proposition: structuring the flow as a data pipeline, with cryptographic provenance from processing boundaries as the verification input, can give each recipient an independent acceptance basis at delivery — attributable acceptance: signed claims bound to issuing keys, decisions bound to evidence, profile, and payload, content truth excluded. The construction is specified in dPLaaX and partially implemented in the provin reference runtime: an EvidenceView fixes the credential representations, transformation sequence, and snapshot digests actually used; a recipient profile renders a fail-closed decision before the sink's writer runs. Separately implemented Python and Go verifiers computed identical EvidenceView identifiers on shared vectors. In a three-organization experiment, the sink reached different decisions on the same evidence under its two local profiles; a tampered payload produced no sink record; semantically inappropriate but correctly signed data was accepted under the provenance-only profile. Stopping the issuer's identity infrastructure immediately stopped default-posture deliveries; cached deliveries continued on locally held evidence within a declared freshness window. Full-path cost is linear in chain depth, 123 microseconds per credential; a measured ceiling near 330 deliveries per second under modelled resolution latency is lifted by an opt-in cache. The proposition partially holds; a global reading of the evidence-selection rule is unachievable under the committed premises, with a snapshot-relative replacement proposed, unimplemented. This record contains the English preprint (provenance-based-data-acceptance-preprint.pdf) and its Japanese translation (provenance-based-data-acceptance-preprint.ja.pdf). Version 2 (2026-08-14) corresponds to the manuscript submitted to IEEE Access on 2026-08-13: the body was condensed to the recommended length, implementation detail was moved to a new Appendix E, a cross-system scenario walkthrough was added (Section 7.6), and the Japanese edition was fully retranslated to mirror the English text.