An autonomous system that cannot explain itself is a liability with good uptime. When a client asks “why did the system do that?”, the answer has to be retrievable in minutes by a person who did not build it. That requirement, taken seriously, defines a minimum observability surface, and it is smaller than the monitoring industry would like you to believe.
The three layers
Traces tell you what happened: every request and every action gets a trace that follows it across services, so a slow afternoon can be decomposed into the four calls that caused it. Structured logs tell you what the system saw: not prose, but fields, who, what, when, which record, that can be filtered and joined. Decision provenance tells you why: for every automated decision, the inputs it read, the rule or model that fired, and the confidence it acted with.
The third layer is the one most stacks skip, and the one operators actually need. Traces and logs answer engineering questions. Provenance answers the client’s question, “why did it flag this customer and not that one?”, which is the question that decides whether the system keeps its autonomy.
Practical notes
Keep provenance records for as long as the decisions matter, which is usually years, and keep them queryable by the operator, not just by engineers. Alert on absence as well as errors, a pipeline that silently stopped is worse than one that failed loudly. And resist dashboard sprawl: one screen the operator actually reads beats nine screens nobody does.
“Uptime tells you the system is running. Provenance tells you whether it should be.