Data provenance

Data provenance is the record of where data came from and how it reached the point where it was used. The W3C PROV specifications define provenance as information about the entities, activities and people involved in producing a piece of data, which can be used to judge its quality, reliability or trustworthiness.

For an AI agent, provenance answers the question reviewers ask after almost every disputed decision: what did the agent read before it acted? An agent that drafts a credit memo or clears an AML alert may combine a retrieved policy document, a customer record from the core banking system, a sanctions-screening response and a model's summary. Each input needs its source system, its identifier or version, the time it was read, and the query or tool call that fetched it.

The EU AI Act asks for provenance in two places. Article 10(2)(b) requires the data governance practices for training, validation and testing data to cover "data collection processes and the origin of data". Article 12 requires high-risk AI systems to log events for traceability, and for remote biometric identification Article 12(3) names the reference database the system checked and the input data that led to a match. Run-time provenance for agents applies the same idea to every read an agent makes.

Record provenance at the moment of the read. A record rebuilt later from today's database shows what the data says now. Store a content hash of each input with its source reference, so that a reviewer can confirm the agent saw that exact version. For personal data, record the purpose of the read with it.

In KLA, the Lineage Explorer shows the tool calls a run made with their inputs and outputs, and Document Intake attaches source documents and approved fields to the Process run that used them.