Provenance is the product

Ask an analyst what breaks an investigation and you will rarely hear “we could not find the data.” You hear that the data was found, and then it could not be used.

The hand-off problem

The standard stack buys collection from one vendor and analysis from another. Collection produces a result set. Someone exports it. Someone imports it into the analysis tool. That export is where provenance dies: the record arrives without the query that produced it, the timestamp of acquisition, the source’s state at the time, or the operator who ran it.

None of that matters until it matters. Then it matters completely, because the question in disclosure is not “is this true” but “how do you know, and can you show your working.”

What one entity model changes

When collection writes into the same resolved graph the analyst reads from, none of that context has to survive an export, because there is no export. A node in the graph carries the source records it was built from. A relationship carries the observations that support it. An entity match carries the score and the features that produced it, which means an analyst can disagree with the machine and record why.

This is also what makes a plain-language question answerable in a way you can defend. The system is not summarising a document set from memory. It is traversing records that each know where they came from, and citing them.

The cost

Being honest about the trade: a single entity model is harder to build than a connector. You have to decide what an entity is before you have seen every source, and you will be wrong at least once. Retrofitting a resolution layer onto an existing product is worse, which is why most platforms that started as collection tools never do it.

We think that is the right thing to spend the difficulty on. Everything else in an investigation platform is replaceable. The chain from observation to assertion is not.