Provenance Is Not Evidence: Why Traceable AI Can Still Be Institutionally Wrong

Enterprise AI governance is increasingly focused on provenance. Organizations want to know which data fed a model, which source produced a claim, which pipeline transformed it, which retrieval step supplied it, and which permissions governed access.

This is necessary.

It is also not enough.

Provenance can establish where information came from. It does not, by itself, establish that the information is sufficient evidence for the decision an institution is about to make.

That distinction is foundational to Continuity Science.

A Source Can Be Authentic and Still Be the Wrong Evidence

NIST defines provenance in terms of origin, development, ownership, location, change, and associated processes. In practical AI systems, provenance provides chain-of-custody information about data, models, retrieved context, and outputs.

That answers important questions: Is this the actual source? Which version was used? Was it transformed? Who or what handled it? Can the path be reconstructed?

But institutional decisions require another question:

What makes this source relevant, sufficient, applicable, and acceptable as evidence for this purpose?

An authentic document can be outdated for a current case. A verified dataset can represent the wrong population. A current policy can apply to a different jurisdiction. A reliable operational log can prove that an event occurred without proving why it occurred. A high-quality research paper can be methodologically sound and still be insufficient to justify a specific institutional action.

Provenance establishes origin. Evidence establishes support.

Source → Evidence Is a Governance Transformation

The GovKM Continuity Topology begins Source → Evidence → Authority → Context.

These elements are intentionally distinct.

A Source is the originating person, system, record, event, or environment from which information enters institutional use. Evidence is verifiable material that supports, qualifies, challenges, or constrains a claim.

The transition between them is not automatic.

Information becomes usable evidence only when the institution can evaluate its relevance, completeness, authenticity, limitations, and relationship to the question being decided.

This distinction becomes more important with AI because retrieval systems can dramatically increase the number of technically relevant sources available to a model. Retrieval success can create the appearance of evidentiary strength even when the retrieved material has not been qualified for the decision at hand.

Traceability Does Not Establish Admissibility

Financial-services discussions illustrate the issue clearly. Provenance is increasingly treated as a board-level requirement because regulators and risk teams need to trace consequential outputs back through data, source, pipeline, and permissions.

That is a major advance over opaque model output. Yet a perfectly traceable credit decision can still be institutionally invalid if the evidence used was inappropriate, incomplete, outdated, unauthorized for that purpose, or interpreted outside the circumstances in which it was valid.

The same pattern appears in healthcare. A dataset may have excellent lineage and documented processing but still be unsuitable for a particular population or clinical use.

In regulatory science, recent work on evidence-based agentic AI similarly emphasizes that provenance should preserve a chain of custody from retrieved material to extracted facts and downstream synthesis. This strengthens evidence workflows because it keeps claims inspectable. But even an inspectable chain still requires institutional judgment about whether the material supports the decision being made.

Authority and Context Qualify Evidence

Evidence does not acquire institutional force in isolation.

Authority determines whether a source, rule, interpretation, expert, model, or decision-maker has standing for the present purpose. Context supplies the legal, temporal, semantic, organizational, operational, and situational conditions required to interpret the evidence correctly.

This means two organizations can possess the same source and legitimately reach different determinations about whether it constitutes usable evidence. Their governing authorities, purposes, populations, thresholds, or operating conditions may differ.

AI systems are particularly vulnerable to collapsing these distinctions because language models are optimized to combine relevant information. Relevance is not the same as permission, sufficiency, admissibility, or institutional validity.

Correct Retrieval Can Still Produce Wrong Institutional Action

Recent research on provenance sensitivity in LLM agent action selection makes this risk concrete. It distinguishes whether contextual information is merely relevant from whether it is authorized to determine a specific tool action. The research demonstrates why source authority must be evaluated in relation to the action target rather than assumed from textual relevance alone.

That is a continuity problem.

If an AI system retrieves the correct fact from the correct document but cannot determine whether that fact is authorized evidence for the current decision, the system can be technically grounded and institutionally wrong.

This is one reason citations alone cannot establish trustworthy enterprise AI. A citation can show where a statement came from. It cannot prove that the source should govern the action that follows.

Evidence Must Remain Connected to the Claim It Supports

Evidence continuity requires more than collecting trustworthy artifacts. The institution must preserve the relationship between each evidentiary object and the claim, decision, or action it was used to justify.

This allows later personnel or AI systems to ask whether the evidence remains complete, whether limitations were disclosed, whether contradictory evidence existed, whether the governing authority changed, and whether later developments superseded the original basis.

Without those relationships, institutional memory can preserve the conclusion while losing the evidentiary conditions that made the conclusion defensible.

From Data Provenance to Institutional Trust

Provenance should remain a non-negotiable requirement for trustworthy AI. Organizations need to know where data, model outputs, retrieved context, and generated content came from.

But provenance is the beginning of the trust chain, not the completion of it.

A traceable source becomes trustworthy institutional evidence only when the organization can establish why it is relevant, sufficient, authoritative, and contextually valid for the decision being made.

This is why Continuity Science separates Source from Evidence, and Evidence from Authority and Context.

AI systems should not merely retrieve information with provenance. They should operate inside an architecture that preserves the institutional relationships required to determine what that information is allowed to mean.