Working with provenance
Trace any result's origin or impact, and export the trail for an auditor.
Provenance answers "where did this come from?" and "what was made from this?" directly in the app. This page covers the two places you'll use it — the workspace Provenance page and the per-entity Provenance tab — plus exporting a trail for an auditor. For the mental model behind it, start with the provenance graph.
The workspace Provenance page
Sidebar → Provenance. Every recorded mutation run in the workspace, oldest to newest, in one of two views:
| View | Best for |
|---|---|
| Timeline | Time flows left to right. Reviewing what happened, in order. |
| Galaxy | Force-directed clusters. Seeing which sessions and datasets belong together. |
The page follows live activity by default — new runs slide in as they are captured — and you can restrict it to the last 24 hours, 7 days, 30 days, or a custom range, then Load older history to scroll further back.
In Galaxy view, the physics menu offers presets: Default (balanced), Tight clusters (sessions condense into compact blobs), Spread out, and Readable (extra whitespace so labels breathe). Tweak the sliders and Relayout if a busy month needs untangling — your preference persists.
Everything on this page — view, range, filters, search, isolation — lives in the URL, so a filtered view of "the runs behind this figure" can be pasted straight into a chat message or a review ticket.
Picking and isolating
Click any run or node chip to select it into the detail panel, which shows its Origin, Produced by and Read by relations without leaving the graph. Right-click opens a context menu: Open entity, Center view here, and Isolate — trim the display to just this chip's Cluster, Origin, Impact, or Origin + impact. You can also hide whole run or node types to cut noise.
A short investigation, end to end:
- Find the artefact
Type its name in the search box — matches stay lit while everything else dims. Click the match to select it.
- Isolate its origin
Right-click → Isolate → Origin. The graph trims to only the runs and versions that led to it. An isolation chip appears in the toolbar; click it any time to restore the full graph.
- Inspect the suspect hop
Select the run where things look wrong. The detail panel shows its inputs and outputs with their quality and precision badges, the code or query plan it executed, and who performed it.
- Check the blast radius
Right-click the bad input → Isolate → Impact. Everything downstream — every artefact you now need to re-examine — is what remains on screen.
The entity Provenance tab
Any file, document, or data object → the info panel → Provenance. Three lenses over the same trail: Galaxy, Tree view, and List view, with a direction toggle — Origin ("Where did this come from?") vs Impact ("What was made from this?").
Each hop card shows the activity, the agent chain ("AI agent — on behalf of …"), when it ran, an expandable snippet of the exact code or query plan (hash-verified against what actually executed), and its inputs and outputs with verified / declared and exact / coarse badges. Imported data additionally shows "N rows attested by origin". Every hash is clickable to copy in full.
If the entity has versions, the trail can be pinned: "Trail pinned to version …" with a Clear button to widen back to every version ever recorded.
Capture begins when a run first touches an entity. The tab says so explicitly rather than hiding — an absent trail is not evidence that nothing happened before recording began.
Exporting a trail
The Export button on the Provenance tab renders the trail as the document an auditor reads. One traversal feeds every format, so the human and machine copies can never disagree:
| Format | Best for |
|---|---|
| Trail report (Markdown) | Human-readable copy — hop-ordered runs, plans, and quality/precision badges. |
| PROV-JSONLD | W3C machine form of record — activities, entities, qualified derivations. |
| BioCompute Object | IEEE 2791-2020 — FDA computational-pipeline submission contexts. |
| OpenLineage | RunEvent stream for off-the-shelf lineage tooling. |
| RO-Crate | Workflow Run RO-Crate (Process Run Crate profile). |
| Define-XML (CDISC) | Dataset definitions with Origin and derivation Method — dataset grain. |
An optional Context of use field lets you declare what the evidence is for ("Supporting evidence for IND section 5.3"). It is recorded verbatim and labelled declared — a narrative, never a verified fact.
Every export also carries, for the auditor on the receiving end:
- Scope honesty — direction, depth, and whether the walk was truncated, so a complete closure is distinguishable from a bounded slice.
- AI involvement — a machine-readable marking of how many runs were AI-performed, which models, and the human-review coverage.
- A verification verdict — the structural checks re-run over the exported
segment, plus the tamper-evidence level and the honest
anchoredflag.
The review gate
If the trail ends in AI-authored outputs that no human has reviewed, the export refuses with a clear message: those runs need review first. Reviewing is a deliberate act — approve or reject with an optional reason, view the session's code as a whole, and confirm with an e-signature using a fresh second factor (passkey, or password + TOTP). Only a human signature clears the gate.
An assistive AI review can be run on coarse claims first, but its verdicts are always outlined with a bot glyph and marked "assistive only — it does not replace or satisfy human review".
Workspace managers control the gate under Settings → AI Output Review Queue, which also lists every AI-authored output still owing a decision, with a Require review before exporting AI outputs toggle.