For governed agent/tool execution, a useful pre-action signal is what machine-readable AI-use / source-rights declaration a third-party source exposes before fetch, ingest, index, search or training actions.

AcqPath resolves that as signed timestamped evidence for resource + intended purpose.

It does not grant licences, determine ownership, prove downstream use, bypass access controls, or treat UNKNOWN as permission.

Possible provider-neutral flow:

1. action declares resource + intended use
2. external evidence provider returns state/freshness/signature
3. local policy decides allow/review/deny
4. evidence ID/hash is attached to the audit record

MCP reference: https://api.getacqpath.com/mcp

Would this fit bytebase/bytebase as an optional governance/policy input?