An evidence graph still needs a decision spine.

A rich graph can still leave the decision unexplained

AI systems are getting better at preserving the ingredients of a result: source documents, model responses, retrieved passages, edits, tools and people. That is important. It can help a reviewer reconstruct where an artifact came from and which transformations shaped it.

But a dense provenance graph can still leave the most consequential question unanswered: why was the system allowed to act?

The relationship between a source and an output is not the same as the authority to use that source, release the output or execute a downstream action. An artifact can have excellent lineage and still be used outside its permitted purpose. A decision can cite the right evidence and still be made by the wrong actor, under a stale policy, with an effect nobody verified.

That is why an evidence graph still needs a decision spine.

Provenance standards give us a strong foundation

The W3C PROV family, published in 2013, defines provenance as information about the entities, activities and people involved in producing data or a thing. Its framework supports attribution, processing steps, reproducibility, versioning and derivation. It gives systems a common way to express relationships across a creation process.

C2PA's April 2026 version 2.4 specification adds a practical content layer. Its manifests can describe ingredients and actions affecting an asset, require validation of listed ingredients, and state whether all actions are included. That makes content history more inspectable and verifiable.

Neither standard should be stretched into an authorization system. W3C PROV tells us how to represent provenance. C2PA records claims about asset history. They do not, by themselves, decide whether an actor had permission, whether the applicable policy was current or whether an intended effect actually occurred. That boundary is not a weakness. It is where governance must begin.

Build the decision spine beside the evidence graph

A decision spine is an ordered record that connects six things: the mission, the delegated authority, the evidence and policy versions, the proposed action, the control decision and the independently observed effect. Human review and correction should attach to that sequence without erasing the earlier state.

The evidence graph can branch. A source may contribute to several drafts; a model output may be rejected; a later document may reuse only one fragment. The decision spine should remain linear enough to answer: who decided, under which authority, using which policy and evidence, what action was permitted, what happened, and what changed after review?

NIST's current AI RMF Playbook supports the organizational discipline around this record. Its GOVERN guidance calls for transparent processes, standardized documentation, clear roles and delegated authorities, inventories, monitoring, incident response, appeal and course correction. NIST also says AI RMF 1.0 is being revised, so organizations should date the version of the guidance they rely on.

The decision-spine pattern is my proposed synthesis of these needs, not a NIST requirement or a report of new measured results.

Test whether another reviewer can reconstruct the decision

Choose one bounded AI-assisted workflow and give an authorized reviewer the final artifact plus its provenance record. First ask whether the reviewer can identify the relevant sources, transformations, tools and contributors. Then ask a second set of questions: who had authority, which policy version applied, what action was approved, whether the effect was observed, and whether a correction changed the future behavior.

Now remove one part at a time. Remove the authority record. Replace the policy with a newer version. Hide the observed effect. Break the link between a correction and the next execution. Measure reconstruction time, reviewer agreement, unsupported approvals, unnecessary blocks, missed effects and legitimate task completion.

This proposed evaluation separates two problems that are often collapsed. Attribution asks what contributed and how. Governance asks what was allowed, decided, executed and corrected. A trustworthy operating record needs both.

The goal is not to turn every creative act into bureaucracy. It is to preserve enough evidence that responsibility does not disappear inside a beautiful graph.

Map the evidence. Preserve the decision spine. Test whether another authorized reviewer can follow both.