Systems that go into an operation have to survive being asked why.
Every number ours produce can be taken apart, back to the documents and rules that made it. We call that Chain of Record.
The question arrives sooner or later and it arrives from someone senior: where did this come from? A system that cannot answer it does not get signed off, however good its output — and that is the difference between a system that runs in a demonstration and one that runs in an operation. We build every engagement against that requirement, whether the output is a settlement value, a compliance verdict or a matched part number.
Provenance cannot be added afterwards
Traceability is not a feature you attach to a working system. It is a property of how the system was assembled, and retrofitting it means rebuilding most of it — which is why so many systems that reach production without it never acquire it.
The reason is structural. If a value passed through a step that did not record what it stood on, that step erased the chain, and no amount of downstream logging restores it. The chain is only as long as its weakest link, and the weakest link is usually the convenient one: a lookup that returned a value without a source, a model call whose prompt was not versioned, a spreadsheet that was read but not kept.
One number, taken apart
THE NUMBER
Settlement value€ 416,382.08
the figure somebody acts on
ASK IT ONE QUESTION
Where does 1,240.0 t come from?
ASK A HARDER ONE
Why 0.8 % off?
NOW THE WHOLE CHAIN
- quantity
- 1,240.0 t
- contract 2026-0417 §3, rev 2, signed 04 Mar
- grade adjustment
- − 0.8 %
- lab certificate LC-88213 · moisture 14.2 %rule MOISTURE_SCALE v4
- net quantity
- 1,230.08 t
- unit price
- € 338.50 / t
- price sheet 2026-08-19 14:02 · broker feed
- fx
- 1.0000
- contract denominated in EUR
- demurrage
- € 0.00
- laytime not exceeded · SOF received 08:41
- settlement
- € 416,382.08
Every line names a document, a revision and a rule version. Change one and the number recomputes, and the change is recorded.
Illustrative data.
Six inputs, six sources, one rule version. Re-run it and you get the same figure or a recorded reason why not.
What it takes to hold the chain — router, engine, agent
Intake keeps provenance. Every document arrives with its origin, its revision and the time it was received, and it keeps them for as long as anything downstream depends on it. A document read and discarded is a broken chain later.
Decomposition produces typed facts, each carrying its source. Not tokens, not a blob of extracted text. moisture = 14.2 % is a fact whose source is a certificate number, and it travels with it.
The router decides what handles what. This is the least discussed and most consequential component. Some facts belong to deterministic rules — arithmetic, standards, tolerance tables — and putting those through a model is how you get a system that is right most of the time. Some facts require judgement, and putting those through a rule is how you get a system that is confidently wrong at the edges.
The engine does what can be determined. Rules, standards, scales, conversions. Versioned, testable, and boring by design. Most of the value sits here, and most of the marketing in this category pretends it does not exist.
The agent does what cannot. With retrieval that names its sources, an output format that carries them, and an evaluation set with known answers behind it.
The boundary is explicit. There is a written statement of what the system may conclude and what it must hand to a person. The boundary is part of the architecture, not an operational preference, and it is the thing that makes the whole arrangement signable.
The record is reconstructible. Which document, which revision, which rule version, which prompt version, which model. Not so that anyone reads it routinely — so that it survives the day somebody does.
Four things this buys, and all four arrive at once
Sign-off. Somebody has to put their name on the output. The chain is what makes that a decision rather than an act of faith.
Audit. An auditor's question is always the same question, and it is this one.
Dispute. When a counterparty disagrees with a figure, the argument is settled in minutes by the same structure, rather than in weeks by two spreadsheets.
Regression. Because every output names the rule and prompt versions it used, a change to either can be replayed against history. Drift becomes something you measure rather than something you notice.
The four distinctions that matter
A post-hoc explanation is generated after the fact and cannot be falsified. This is a set of inputs that can be re-run — and re-running it either reproduces the result or does not.
A confidence score says how sure the system is. This says what the system stood on. Those are different questions, and only the second one survives an audit.
A log records what happened. This records what was true, and re-runs to demonstrate it.
It is how the systems are built, not something bought alongside them. There is no product with this name. It is in the price of building them.
It costs something. Holding the chain adds engineering time in the first weeks and a discipline that has to survive the whole build. It pays for itself the first time someone senior asks the question, and not before.
Where this is running
AgriCore — settlement values traced to contracts, certificates and rule versions. Closed testing on live deals at partner desks; ten signed LOIs.
LogiSea — compliance verdicts that name the document and the clause. Three vessels in installation.
Airport Journey Orchestrator — every passenger-facing number traced to the feed it came from and the moment it arrived. Twelve-week terminal pilot scoped.
Catalog Brain — matches that list the attributes matched, the attributes inferred and the attributes missing.
Forty-five minutes. Bring an output your current system produces that nobody can fully explain. We will take it apart on screen and show you where the chain breaks.