How Attribution Actually Works

A common first reaction to Blackridge: "you attribute spend with request headers — everyone does that." Headers are the least interesting part of the system. They are one rung of a nine-resolver ladder, and they are the wire protocol — not the product.

The product is what happens after a value arrives: every attribution field records where it came from (caller_provided, gateway_generated, inferred, missing), that provenance becomes an evidence grade, the grade flows into every economic claim, and coverage gaps are reported instead of papered over. Most tools accept a tag and treat it as truth. Blackridge treats attribution as evidence with a chain of custody.

The resolver ladder

Blackridge resolves ownership from the strongest trusted signal available before asking application teams to instrument anything. In public docs, the important shape is:

• validated SSO or identity tokens when present;
• trusted proxy or ingress identity from infrastructure you control;
• workload identity from the runtime environment;
• API-key or service mappings;
• explicit SDK context when the application declares workflow ownership;
• low-confidence inference only as a last resort.

Every resolved field keeps its source, so a team assignment from SSO is not treated the same as a hostname guess. Customer docs include the exact resolver order, priorities, and wire inputs.

Provenance becomes evidence

Each resolved field is stamped with its source and carried through the economics pipeline:

Field source	Evidence grade	Meaning
caller_provided	OBSERVED	Declared explicitly (SDK, header, signed claim, validated token)
gateway_generated	DERIVED	Trusted mapping (known hostname, registered app, key prefix)
inferred	INFERRED	Indirect signals — verify before chargeback
missing	UNKNOWN	Reported as a gap. Unknown is not zero.

A request's attribution grade is its weakest field, findings inherit the weakest grade of their supporting requests, and the report publishes attribution coverage as a first-class number. This is why a Blackridge number can survive a Finance dispute: the claim tells you how much to trust it, and what to instrument to trust it more.

Where headers fit

Headers are the transport detail, not the value proposition. Most deployments should start with infrastructure identity and SDK workflow context. Direct metadata headers remain supported for gateways, sidecars, diagnostics, and languages without an SDK, but they are not the recommended first integration path.