Incident records must trace the source of decisions

What it is

Incident decision provenance records whether action came from human command, autonomous policy, safety control, or shared arbitration, together with input, authority, mode, version, and time. Investigation reconstructs actual influence rather than inferring responsibility from final motion.

Why it happens

One actuator receives sources whose commands may be clipped, delayed, or overridden. Output-only logs erase human intent and automatic modification; click logs do not prove execution. End-to-end causal identity links input, arbitration, actuation, and feedback and reveals transfer gaps.

Studying it

Known-root-cause faults can test independent reconstruction of source, sequence, and preventability through agreement, time, and missing evidence. Clock drift, offline cache, restart, update, and access restriction matter. A correct guess is not an adequate record.

Where it stops holding

Logs contain images, location, and behaviour, requiring minimisation, access, and retention limits. Provenance informs but does not decide legal or moral responsibility. Logger failure needs integrity and explicit missing-data markers.

Applying it

• Record source identity, authority, mode, raw input, arbitration, execution confirmation, and synchronised time for consequential commands.
• Use restart-stable event identity, version signatures, and integrity checks; never backfill missing evidence as fact.
• Have independent reviewers replay samples, tracking unattributable events, timeline conflicts, and privacy violations.

Related

• Same group: X4.08.1 Autonomy level and responsibility allocation must align · X4.08.2 Nominal supervision does not constitute actual control
• Adjacent: X3.07 Explainable decision basis · X4.06 Explicit transfer of control authority
• Search terms: decision provenance · incident audit trail · control attribution