Data Provenance
Provenance is the audit ledger. Every change writes an entry with the actor's role at time of action, a SHA‑256 hash of the canonical payload, and the prior chain hash — so the provenance an auditor sees cannot have been silently rewritten.
Data provenance in Magellan provides a complete audit trail for every piece of data — where it came from, how it was transformed, and who was involved.
This goes beyond lineage by capturing the temporal dimension: not just the current state of data flows, but how they have changed over time.
Provenance information supports regulatory compliance requirements such as GDPR's right to explanation and financial services audit trails.
Every change to a schema, mapping, or rule writes a ledger entry — ULID-keyed, SHA-256 hash-chained to the previous entry, and stamped with the actor's role at the moment of action. Tampering with any historical entry breaks every downstream hash and is detectable in a single linear sweep.
The chain head is mirrored to a WORM secondary sink (S3 Object Lock) so a database-level rewrite cannot go undetected: on conflict, the WORM head is authoritative.
Audit ledger entries written by this feature
Each action in this feature appends one of the following entry types to the ULID‑keyed, SHA‑256 hash‑chained audit ledger. A reviewer can replay the chain to reconstruct exactly what happened, when, and under which role.
ProvenanceQueriedChainHeadFlushedChainIntegrityVerifiedRelated glossary terms
Definitions for the technical, regulatory, and standards terms referenced on this page. Each link opens the term in the full glossary.
Open the full glossary