Turn on Provenance and Attribution before Tabnine's agent touches production code, and have legal and engineering set the blocking policy together. The service checks chat and agent output against public GitHub code, names the source and license, can block non-permissive matches, and logs every detection.
When you need this
- Your company sells or relicenses the code it writes and has no tolerance for copyleft code.
- Legal asks how AI-generated code is checked for license risk.
- Teams use third-party models whose training data you cannot inspect.
Steps
Enable the service
Is Provenance and Attribution switched on for your account?
What to setAsk Tabnine Support to turn on Provenance and Attribution, which it enables for any Enterprise customer while it remains a private release. Allow outbound access to attribution.tabnine.com, or install the full database inside an air-gapped network.
Know what it checks
Which code and languages does it cover?
What to setCheck coverage before you rely on a match. The service checks chat and agent output and skips inline completions. A match needs at least 150 characters across multiple lines. It supports 19 languages, including Python, Java, TypeScript, Go, Rust, C#, and C++. The reference index covers GitHub repositories above a popularity threshold and refreshes about once a quarter.
Decide on censorship
Should matching non-permissive code be blocked or only flagged?
What to setTurn on censorship for code that ships to customers. Turn on check_provenance in each workspace as well, because the agent tool is off by default. The agent then rewrites matched code before applying it, and custom commands cannot override the check.
Give legal the logs
Can you show what was detected and what happened next?
What to setExport attribution logs for legal review. The default export covers the last 14 days and records the user, team, model, license, and snippet, plus whether the user applied, inserted, or copied the code.
Understand the privacy model
What leaves your network during a check?
What to setOnly signature hashes of the generated snippet reach the attribution service. Tabnine's documentation says the check never sends plain-text code.
Questions for legal and engineering
- Which licenses does legal treat as non-permissive for our products?
- Which teams need censorship on, and which only need attribution?
- Who reviews attribution logs, and how often?
- What do we do with code accepted before provenance was switched on?
Red flags
- Assuming inline completions are checked. Provenance and Attribution covers chat and the agent.
- Relying on the retired Tabnine Protected model's training-data guarantee after upgrading past 6.2.0.
- check_provenance left off in the agent while censorship is on in chat.
- No one owning the attribution logs.
Products in this piece
Sources
- Official documentation
- 7