pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x KnowledgeGovernance

How provenance changes what a governance finding means

What must travel with a finding for it to be worth acting on?

By João Livio·pH7x Knowledge

30-second answer

A finding without provenance is an opinion with formatting. The minimum that must travel with it: when it was collected, what collected it and at which version, which identity kind produced the view, and which rule version judged it.

json
{
  "collected_at": "2026-08-06T12:24:26Z",
  "collector": "spo-collector",
  "collector_version": "0.10.0",
  "identity_kind": "delegated",
  "scopes": ["AllSites.Read"]
}

What this proves

With provenance attached, a finding is a checkable statement: anyone can re-run the same collector, under the same identity kind, against the same resource, and compare. Without it, the same sentence cannot be distinguished from a guess made on a different day by a different pair of eyes.

What it does not prove

  • That the finding is still true. Provenance dates a finding; it does not keep it fresh. "573 days inactive" was true at the collection moment, and a report read a year later describes that day, not today.
  • That the collection was complete. Completeness is its own field. Provenance says who looked and when; coverage says what they managed to see.

PowerShell

powershell
# Stamp provenance at collection time, from facts, not from intentions
[pscustomobject]@{
    collected_at      = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
    collector_version = '0.10.0'
    identity_kind     = 'delegated'
    module            = (Get-Module PnP.PowerShell).Version.ToString()
}

Example output

text
collected_at      : 2026-08-06T12:24:26Z
collector_version : 0.10.0
identity_kind     : delegated
module            : 3.3.0

Explanation

Each field answers a failure that actually happens. collected_at is what lets a day-count mean something after the report is old. identity_kind is the difference between "the tenant has 47 sites" and "one person could see 47 sites". The collector version is what tells you whether a defect fixed last month affects this document. And the rule version, carried on the finding itself, is what separates "the tenant changed" from "the rule changed" when two reports disagree.

Production considerations

  • Imported evidence (an export from another tool) carries provenance too: the source tool, its version, when it exported. What it can never carry is verifiable completeness, and a report over imported evidence should say so in as many words.
  • Provenance is written at collection time or never; reconstructing it afterwards is authorship, not observation.

References