The Provenance Problem

 

A leading private bank and a major wealth management firm asked us to build AI systems that could improve investment decision making and surface portfolio risk earlier than existing processes allowed. The solution we designed was a RAG architecture, retrieval augmented generation, that pulled dynamically from multiple enterprise data sources, applied business rules and policy parameters, and generated recommendations a relationship manager could act on in near real time. The system was validated carefully. The data sources were approved. The model was tested against historical portfolios. The workflow was documented end to end.

The systems performed well in production. Recommendations were sharper. Risk flags arrived earlier. Portfolio teams reported the tools were genuinely useful.

Several months into production, a specific recommendation came under internal review. The outcome itself was not the issue. The recommendation was reasonable. The process had followed policy. What nobody could answer confidently was a different question, one that had never been asked during design, testing, or deployment.

Where did this conclusion actually come from?

Not who approved it. Not whether it complied with policy. Not whether the outcome was ultimately correct. Where it originated. What specific chain of retrieved information, applied rules, and weighted inputs had produced this specific recommendation on this specific day.

The answer seemed obvious at first. The system had used approved data. The model had been validated. The workflow had been documented. Yet the deeper the investigation went, the less certain everyone became. Which version of the market data had been active at retrieval time? Which policy interpretation had governed the weighting? Which external source had influenced the risk assessment? Which human edits had occurred between the original input and the final output? Had a previous AI generated output from an earlier session influenced the current recommendation?

The organization possessed records. What it lacked was lineage.

We encountered a structurally identical gap in a completely different context while building compliance automation for a global professional services firm. Regulatory filings and litigation documentation carry a legal requirement for traceability, the ability to show exactly which source input produced which compliance output, under which version of which regulatory interpretation, at what point in the workflow. The automation produced correct outputs consistently. But when a regulator asked to see the chain connecting a specific input to a specific filing decision, that chain had to be reconstructed manually, slowly, from records that had been captured for operational purposes by different teams and were never designed to support lineage reconstruction.

The investment platform and the compliance automation system were built by different teams, for different clients, in different sectors, with different regulatory contexts. Both encountered the same structural problem at the same point in their lifecycle, when a specific output was questioned and the organization needed to show not just what had happened but how information had evolved into action.

Traditional systems were largely designed to record transactions, to capture what happened, when, and to whom. Modern intelligent systems, and RAG architectures in particular, require something more demanding. They require organizations to understand and preserve the decision pathway that connects inputs to outputs, because that pathway is not a single step. It is a chain. Historical enterprise data, external information sources, retrieval mechanisms, business rules, human overrides, and previous AI generated outputs may all sit inside that chain. Each link may be valid individually. The challenge emerges when an organization must reconstruct how those links connected to produce a specific conclusion on a specific day.

Without provenance, explanations become narratives assembled after the fact. With provenance, explanations become evidence grounded in a preserved and verifiable chain.

This distinction is not only a technical one. It is an organizational and governance one. When decisions affect customers, shape financial outcomes, carry regulatory obligations, or introduce operational risk, organizations need more than confidence in a result. They need confidence in its origin. And confidence in origin requires that the origin was captured at the time the decision was made, not reconstructed from memory weeks later when it is needed.

This is one of the central arguments in research we published in the proceedings of BIGS 2025. The paper, "From Agentic AI to RAG: A Framework for Responsible AI," proposes that traceability and auditability are not compliance additions to be layered onto a system after the fact. They are architectural requirements that have to be designed into intelligent systems from the start. The paper specifically addresses RAG architectures and the governance questions they introduce, which is precisely the gap we encountered in the investment AI platform engagement. A system that retrieves, reasons, and generates does not produce a simple output. It produces an output with a lineage, and that lineage has to be preserved if the output is ever going to be defensible.

The investment platform case illustrated this precisely. The RAG architecture retrieved from multiple sources. At any given moment the retrieval mechanism was selecting, weighting, and combining information from sources that could change version, interpretation, or availability between sessions. The output was a recommendation. The lineage was everything that connected the retrieval to the recommendation. That lineage was not captured because nobody had designed for it at the architecture stage.

This is the next layer Enterprise Intelligence Architecture keeps surfacing across engagements. Accountability tells you who owned the decision. Evidence tells you why it occurred. Provenance tells you where that explanation came from, and whether it can be trusted.

Organizations that have invested in accountability have assigned owners and built governance committees. Organizations that have invested in evidence have built logging and audit trails. Very few have yet invested in provenance, the architectural capability that preserves the full lineage connecting inputs to outputs in a form that can be reconstructed, explained, and defended long after the decision was made.

As intelligent systems become more autonomous, provenance becomes more than a technical concern. It becomes an organizational capability that determines whether responsible AI is a genuine practice or a governance aspiration.

When outcomes are questioned, evidence explains why. Provenance explains where that explanation came from.

What is the most important provenance gap you have encountered in an enterprise AI deployment?

Source: Investment AI platform and compliance automation consulting engagements. Vikas Sharma, Senior AI and Digital Transformation Advisor | linkedin.com/in/sharma1vikas

Research: "From Agentic AI to RAG: A Framework for Responsible AI," Vikas Sharma and Prof. Arpan Kumar Kar, IIT Delhi, BIGS 2025 | aisel.aisnet.org/bigs2025/1/