Provenance is a moral category

Provenance gets filed under housekeeping. Where a piece of evidence came from, how it was obtained, what it passed through before it reached the decision — this is treated as metadata, the kind of thing a careful engineer tracks and a busy one drops, a logistics detail in the long supply chain that ends in a conclusion. It is the field nobody reads until something breaks. And because it looks like bookkeeping, it is the first thing optimized away when a system needs to move faster or store less.

But provenance is not bookkeeping. It is the difference between a decision you can stand behind and one you can only stand near. Standing behind a decision means you can answer for it — you can say not only here is what I concluded but here is why I was entitled to conclude it. Standing near one means you happen to agree with the output and would prefer not to be asked how it got there. The two look identical right up until someone asks the question that separates them, and that question is always the same.

Consider the same fact arriving by two different roads. A name appears on a list of people who should not board a flight. In one case the name got there through a documented chain: a source you can identify, a method you can describe, a transformation you can replay, a human who attached their judgment at a point you can name. In the other, the name is simply there — surfaced by a model trained on data nobody can fully enumerate, merged from a feed whose origin was lost three systems ago, correct, perhaps, but uncorroborated by anything you could show a skeptic. Same name. Same fact, even. One you can act on and defend. The other you can only act on and hope.

A conclusion built on evidence of unknown origin cannot be defended even when it happens to be correct — because you cannot answer the one question accountability always asks: how do you know?

That is the asymmetry worth dwelling on. Correctness is not the test. A decision can land on the right answer for reasons it cannot produce, and that decision is still indefensible, because defense is not about whether you were right. It is about whether you can show you were entitled to your confidence. "How do you know?" is not a hostile question. It is the most basic thing an accountable party owes — and a system that has discarded provenance has, in advance, decided not to be able to answer it.

Laundering provenance launders responsibility

There is a quieter cost, and it is moral rather than technical. When a fact passes through a system that strips its origin, something happens to the responsibility attached to it. At the input, someone obtained that fact — lawfully or not, carefully or not, with consent or without. Those circumstances are not incidental. They are the moral weight the fact carries. Strip the origin, and the weight is gone. What emerges on the other side is a clean number, a confident flag, a tidy score, with no fingerprints on it.

This is laundering, in the precise sense. Money laundering does not change what the money is; it changes what you can be asked about it. Provenance laundering works the same way. The fact is the same fact, but the chain of people who could be held to account for how it was gathered and handled has been severed, link by link, until the output looks self-evident and nobody is on the hook. A decision that would have been unconscionable if you traced it to its source becomes routine once the source is forgotten. The forgetting is not a side effect. For some systems, it is the feature — the comfort of acting on things you would rather not have to explain.

Discarding origin is choosing to be unanswerable

Which brings us to the design choice nobody admits is a choice. A system that does not retain provenance has not merely failed to log something. It has elected, structurally and in advance, to be unable to answer for itself. That election is usually made for honorable-sounding reasons — speed, storage, privacy, simplicity — and it is almost never described as what it is, which is a decision about accountability dressed as a decision about engineering.

The tell is what happens when the question finally comes. An accountable system, asked how do you know, reaches back through the chain and produces it: source, method, transformation, the judgment that was applied and by whom. An unanswerable system, asked the same thing, can only restate the conclusion more loudly. It has nothing behind the output because it threw the behind away. It is not that it refuses to show its work. It is that there is no work left to show, and that absence is not neutral — it is the residue of a choice to operate beyond the reach of the question.

So provenance belongs with the moral categories, not the logistical ones. It sits next to consent and culpability and standing, the things that determine not whether an act succeeded but whether the actor can answer for it. Treat it as metadata and you will optimize it away exactly when it matters, and discover, at the worst possible moment, that you built a system capable of being right and incapable of being responsible. The two were never the same thing. Provenance is where they part.

— Dispatches · Summit Cognitive