Provenance vs audit: two append-only ledgers, different granularity#

Audience: both — staff read provenance during disputes; admins own both surfaces and the query posture.

When an owner or service lead asks "Who changed this client's billing rate?" or "Who viewed that domain admin password yesterday?", you need a straight answer—not a shrug. Marula keeps two permanent, append-only history ledgers that answer those two different questions: Provenance (/provenance) tracks field-by-field value changes on records, while Audit (/audit) tracks security and administrative events across your organization.

1. Provenance (/provenance): Who changed this specific field?#

Open /provenance whenever you are investigating a specific record (a ticket, client, contract, or asset) and want to see how a field got its current value:

"field-level provenance query — who changed what, field by field, across every applied write — including agent sessions and imports… never rewrites history"

Every row in Provenance shows:

• The Before → After values for the field that changed
• The monotonic sequence number (Seq) and timestamp of the edit
• The actor kind chip: human (a staff member), agent (an AI assistant run), or import (a CSV/JSON batch or connector sync)

Use Provenance when a client disputes when a ticket priority changed, when you want to see whether a person or an import updated a device serial number, or when you need to trace every edit made during a batch import.

2. Audit (/audit): What security or admin events happened?#

Open /audit when you are reviewing security, access, or system lifecycle events across the workspace:

"Append-only ledger of security, administrative and domain lifecycle events for the org."

The Audit screen lets you filter by action category (auth.*, secret.*, plugin.*, portal.*, billing.*), actor ID, and date range. Each row shows human or system actor badges and expands to show full event metadata.

Use Audit during a security review to check login attempts, password vault reveals (secret.*), plugin consent grants (plugin.*), API key creations and revocations, or billing period sign-offs.

Quick comparison#

Both ledgers are append-only#

Neither Provenance nor Audit can be edited or cleared from the UI. New changes always append new rows, and actions taken by AI agents or bulk imports are tagged right alongside human actions so nothing ever happens off the books.