Provenance records who did what, through which entry point, with what outcome and which records changed: one event per HTTP request, job, rake task or explicit block, delivered to SIEM, log pipelines and webhooks in native, OCSF or CloudEvents format.