What clinical-AI
decision provenance is.

What clinical-AI decision provenance is (and why every AI decision needs a receipt)

Clinical-AI decision provenance is cryptographic evidence that a specific clinical-AI decision came from an approved, un-tampered model running on clean data, sealed at decision time to an externally-anchored, tamper-evident log and independently verifiable later, without exposing patient data. As AI moves from the research bench into triage, imaging, documentation, and early autonomous-prescribing pilots, a new class of risk appears that traditional security never addressed: not the theft of data, but the unprovable decision. A recommendation reaches a patient, and weeks later no one can confirm which model produced it, on which version, or whether the inputs were intact. The published framework for an auditable, source-verified clinical-AI record^[1] establishes the academic ground here; RankShieldMD ships the commercial, externally-anchored, post-quantum, per-decision implementation of that idea. Two principles govern the design, and we hold to both honestly: attest, don't decide, and prove without exposing, so verification never requires revealing protected health information.

How do you prove a clinical-AI decision is genuine?

You prove it by separating the proof from the data: recording verifiable statements about a decision rather than its clinical contents. RankShieldMD attests each decision in four steps, and none of them touch patient data. First, it registers a cryptographic baseline of the approved model, a hash of the model and its container, so there is a fixed reference for what the validated model means.

Second, at decision time, it captures digests of the inputs and the output, never the underlying PHI, which is rejected at the guard before anything is sealed. Third, it seals those digests, together with the model fingerprint and a per-decision credential, to an append-only transparency log built on the same certificate-transparency principle standardized as RFC 6962^[8], signs them with composite post-quantum cryptography, and anchors the log root to an external record so the structure is pinned in time. Fourth, it emits an evidence package with a verify recipe: an auditor, an FDA reviewer, or opposing counsel can recompute the hash chain and confirm the signed root using standard tools, without access to your systems and without trusting RankShieldMD. Tamper with the model, the data, or the record after the fact, and verification returns false. The medical data stays where it belongs, governed by the clinical systems built for it, while RankShieldMD holds only the cryptographic proof about the decision. That separation is what lets the same evidence be handed to a hospital board, a regulator, and opposing counsel without any of them needing access to the patient record itself.

How is provenance different from an AIBOM or model monitoring?

Provenance differs from an AIBOM and from model monitoring because they operate at different layers, and the difference is the whole point. An AI bill of materials and a model card describe a model at the supply-chain level, its components, datasets, and lineage, a static inventory of what went into the system^[5]. Model monitoring watches aggregate behavior over time, flagging drift across many predictions.

Both are useful, and RankShieldMD can emit AIBOM artifacts itself. But neither proves anything about an individual runtime decision. When a specific result is questioned after the fact, an inventory of the model's ingredients and a dashboard of last month's drift cannot tell you whether this decision came from the approved model on intact data. Per-decision provenance is the finer, missing layer: a cryptographic receipt for each decision, sealed at the moment it happens, that can be verified in isolation. It is the difference between knowing what is generally in the kitchen and having a signed, tamper-evident receipt for the specific meal that was served. Governance platforms document risk and policy; monitoring tools observe behavior; RankShieldMD proves the decision. The three are complementary layers, not substitutes. Provenance is simply the one that survives the question prove this one, because it attaches a checkable record to each individual decision rather than to the program that produced them all. A buyer evaluating AI-trust tooling should ask which layer a vendor actually delivers, since a governance dashboard and a per-decision receipt are easy to conflate and very different to rely on when a single decision is challenged.

Why does the proof need to be quantum-safe?

The proof needs to be quantum-safe because the evidence behind a clinical decision must stay unforgeable for as long as the decision matters, and that is measured in decades, well within the window where quantum computers could threaten today's cryptography^[2]. A proof that is unforgeable now but forgeable in fifteen years is not good enough for a record of a person's care.

There is also a specific, documented threat pattern: harvest now, forge later, where an adversary copies today's classically-signed evidence and waits for a capable quantum computer to forge or repudiate it retroactively. Long-retention healthcare records are an attractive target precisely because they are kept for so long^[2]. That is why RankShieldMD signs every attestation with composite post-quantum signatures, ML-DSA-65 paired with Ed25519, built to the NIST post-quantum standards FIPS 203, 204, and 205^[4], so the evidence stays verifiable and unforgeable as cryptography evolves. We state the posture honestly: it is quantum-safe, not quantum-proof. No quantum computer capable of breaking current cryptography exists yet, and no one can guarantee any system is unbreakable; what we can do is build to the standards so a decade of decisions stays defensible.