Chain of custody

Every program I've been pulled into has eventually produced the same meeting. A figure from months ago turns out to matter — a forecast that anchored a funding decision, a risk rating that justified a go, a milestone date somebody committed to a regulator. And the question is never "was it right?" The question is "how did we get it?" Because the answer to the second question is what tells you whether the first one can be trusted going forward.

The old process was slow and it left a trail whether you wanted one or not. Someone pulled an extract on a Tuesday. They saved the workbook. They made an assumption about a vendor's ramp, wrote it in a cell comment or at least remembered it, and their name sat at the top of the tab. Reconstructing the number a year later was tedious, but it was possible, and the possibility was itself a control — people are more careful when the work has their fingerprints on it.

An AI-drafted artifact arrives finished. The prose is better than what the analyst would have written, the structure is cleaner, and there is no workbook, no extract, no cell comment. The output is the only artifact. If nobody deliberately captured what the agent read and what it did with it, that chain doesn't exist — and unlike a missing spreadsheet, nobody notices it's missing until the day they need it.

Three links that quietly go missing

Traceability on an AI-assisted program breaks in three specific places, and each one fails silently.

1. The source snapshot

An agent reads the board, the register, and the schedule as they existed at that moment. Those systems then move on. Re-running the same prompt next quarter reads a different program and produces a different answer, so you can't reconstruct the old number by repeating the process — the input is gone. Without a snapshot, the report is an assertion about a state of the world that no longer exists anywhere.

2. The instruction

What the agent was asked matters as much as what it read. "Summarize schedule risk" and "summarize schedule risk for the executive committee" produce meaningfully different documents from identical data, and the second one hedges less. Prompts live in chat windows, on individual laptops, under individual accounts — the least durable storage in the enterprise. The framing that shaped the conclusion evaporates while the conclusion stays.

3. The reasoning step

Somewhere between the source and the sentence, a judgment happened: two dependencies got treated as one, a blank effort field got an assumed value, an outlier got smoothed. A human doing that work leaves a residue — a rounded figure, a note, a hesitation in the meeting. The model's version of that step happens inside the output, indistinguishable in tone from the parts it read straight off the board. This is the confidence problem wearing a different hat: uniform polish across facts and inferences, with nothing marking where one ends.

The regulators got here first

If this sounds like a compliance concern rather than a delivery concern, notice that the compliance world has already written it down. NIST's AI Risk Management Framework treats transparency and accountability as core characteristics of a trustworthy system, and grounds them in documentation and traceable provenance rather than good intentions. The EU AI Act goes further and makes it mechanical: Article 12 requires high-risk systems to automatically record events over their lifetime, with logs retained for a period appropriate to the intended use and no less than six months.

Most program tooling isn't a high-risk system under anyone's definition, and I'm not arguing you should treat a status-report agent like a credit-scoring model. I'm pointing out that people who spent years thinking about how AI systems fail landed on the same control: keep the record of what happened, because the output alone won't tell you. If you work in government, financial services, or healthcare — where I spend most of my time — that obligation is going to reach your delivery tooling eventually. Building it in now costs a fraction of retrofitting it under audit.

What the chain actually looks like

In the Army, evidence that couldn't account for every hand it passed through wasn't weak evidence — it was inadmissible. Not because anyone assumed tampering, but because a claim you cannot reconstruct is a claim you cannot defend, and that standard has to be set before you need it, not after. On my programs the same idea gets implemented in four fairly boring mechanics.

Every machine-generated artifact carries a provenance block: sources read, timestamp of the read, model and version, the person who commissioned it, and the person who accepted it. It's four lines at the bottom of the document and it answers most of the questions that meeting will ever produce. Prompts and configurations for anything recurring live in version control alongside the rest of the delivery assets, not in someone's chat history, so a change in how the weekly gets generated is a reviewable change rather than an invisible one. Anything that feeds a decision gets a source snapshot — the extract the agent read, stored with the output, because storage is cheap and reconstruction after the fact is not. And inferences get marked: where the agent filled a gap or made an assumption, it says so in line, which turns a fluent narrative back into something a reviewer can actually interrogate.

None of that is technically hard. It gets skipped because it's invisible when everything is going well — the entire value of a chain of custody shows up on one bad day, which makes it perpetually easy to defer. It also gets skipped because it slows the demo, and the demo is where most AI-on-programs enthusiasm is generated.

The bottom line

Speed is the easy part of putting AI on a program — the artifacts get faster almost immediately, and that's the part everyone sees. Defensibility is the part that decides whether the speed survives contact with an auditor, a regulator, a skeptical CFO, or just a steering committee with a long memory. A number you can trace is an asset you can build on. A number you can't is a liability that hasn't been called in yet. Keep the chain intact, and you can still put your name on the output a year later and mean it.