Add AI/automation metadata (confidence, provenance, review status) on RDX objects

[JohnASRG]

Motivation

Increasingly, TARA artifacts are co-authored with AI or automatically generated from architecture models, threat intelligence feeds, or prior risk libraries. Consumers of RDX need to know which objects were auto-generated, with what confidence, from what source, and whether a human has reviewed them. Without this, downstream automation (and auditors) cannot tell a hand-validated threat scenario from one drafted by a script.

Proposed change

Reusable provenance object attachable to most RDX objects (assets, threatScenarios, attackPaths, controls, riskValues, cybersecurityRequirements, monitoringAndDetection, testCases):

{
  "origin": "human-authored" | "ai-assisted" | "ai-generated" | "imported" | "derived",
  "generatorRef": "rdx-idea-scout@gpt-5-mini" | "<tool>@<version>",
  "sourceArtifactRefs": ["ART-..."],
  "generatedAt": "...",
  "confidence": 0.0-1.0,
  "reviewStatus": "unreviewed" | "in-review" | "approved" | "rejected",
  "reviewerPartyRef": "...",
  "reviewedAt": "...",
  "reviewNotes": "..."
}

Add a provenance discriminator at document level too, so a whole RDX file can be marked as drafted by automation pending human approval.

References

• AI peer review, "Recommended backlog → AI/automation metadata"
• Related: complements every issue surfaced by the AI Idea Scout workflow — those are exactly the artifacts this is meant to characterize.

Acceptance criteria

• provenance object added in JSON Schema + XSD as a reusable type
• At least 6 top-level object types accept an optional provenance
• Document-level provenance field added
• Example demonstrates a mixed document with human-authored and ai-generated objects
• methodology/ adds a "Provenance & review status" page

---

Surfaced by external AI peer review; see chat transcript for full review text.

[mmoseritemis]

I generally like the idea of this proposal, but I think there might be some issues with this exact implementation.

For the origin, I could see a situation where an artifact is imported, but was also generated by AI. In the schema as is; it seems that this particular field is just a 1:1 enumerated list, so the exact nature of the origin could be misleading depending on which one is used when multiple are applicable.

I think it would help to take another look at that field and it might also be helpful to establish some form of quantitative baseline for human
-authored, ai-assisted, and ai-generated. While the ends I think are obvious, the goal of this addition is to improve source clarity and this is an area that could cause further confusion.

It's also not clear to me if the reviewPartyRef field could include AI review processes, or if they would only include human reviewers. If it is the former, I think we need a field to make that explicit and provide quantitative measurements for AI generated vs AI assisted same as the origin. If it is the latter; I don't think we need to do anything here.