Definition
A reconstructable chain linking an outcome to the intent, identities, system versions, inputs, actions, evidence, and state changes that produced it. For an agent run, lineage may include the run contract, model and provider, harness version, prompts, retrieved context, tool schemas and results, credentials or delegated identity, environment, artifacts, evaluations, approvals, and promotion decision.
The aim is answerability. When a result is challenged, an operator should be able to trace backward from the outcome to what acted, what it knew, which authority it used, what changed, and why the system allowed the result to advance. Forward links also matter: if a source, model, dependency, or credential is later found unsafe, lineage identifies affected outcomes.
Structure matters more than volume
A folder full of logs may still leave no lineage if events cannot be joined across agents, tools, retries, and state transitions. Use stable identifiers, timestamps, content or version references, parent-child relationships, and explicit promotion records. Preserve enough content to reconstruct the decision while respecting privacy, security, retention, and licensing constraints.
Distinguish it from nearby terms
A trace records the sequence inside one execution. Provenance records where data or artifacts came from. An audit log records security-relevant events. Execution lineage connects these materials across the full outcome path. It supports causal reconstruction but does not prove that every recorded cause was correct.
Check your understanding
A vulnerable dependency is discovered. Can you identify which agent runs loaded it, which artifacts they produced, which evaluations those artifacts passed, and where they were deployed? If not, you have records but not sufficient execution lineage.