Provenance

Goal: Set up where your workspace keeps its record of changes, and for how long.

Provenance is the workspace's record of changes, kept in storage in your own Azure subscription. What it records, and what it does not, is set out in the Compliance Matrix. This window sets up the storage: its region, its retention periods and its signing setting.

Before you start

• A connected cloud and a provisioned private landing zone. Until both exist the menu has no Provenance.
• The region list comes from your connected subscription. If it is empty, check the cloud connection, then Reload regions.

What the window shows

The window, titled Provenance, is one column: Latest deployment, the health of what it built, Record retention with a status badge, any pending proposal, the settings, Provisioned details once it is provisioned, the save button and History.

Status badge	Means
Not Configured	"No Provenance storage has been provisioned for this workspace."
Provisioning…	"Storage was requested. Policy state has not been reported yet."
Protected — Locked	Records are held under a locked time-based immutability policy, which nobody can shorten or remove, including Fathym
Protected — Unlocked (dev/test)	The policy behaves the same, but it can be removed

The settings

Data residency

Field	What it does
Region	Where the storage lives ("Select a region..."). Required. Fixed once provisioned
May data cross geography?	Off by default. On shows Replication target
Replication target	A second region. Required when the switch is on. Set only before provisioning

Retention

"Retention periods can be extended later, but never shortened." Three cards, each with a period and a basis:

Card	Covers
Domain records	"Default for a new scope. A scope may override this while it remains open."
Access control	"Team membership, access grants and permission changes."
Platform configuration	The record of the configuration itself

Each period is one of 7 years (2,555 days), 15 years (5,475 days), 30 years (10,950 days) or Indefinite (146,000 days). Platform configuration must be at least as long as the longer of the other two, so the window raises it for you and disables the shorter choices.

Each card has a Basis: "Your stated reason this period applies — shown to auditors exactly as written." Fathym never fills it in for you.

The first time a card goes to Indefinite, the window asks you to confirm: indefinite retention can never be shortened once a container policy is locked - "not by you, not by Fathym, not by Microsoft."

Signing

Sign in again to sign:

Choice	What it does
Off	"A signature uses the signer's existing sign-in. No extra sign-in is asked for."
Once per signing session	The first signature in a session asks the signer to sign in again
Every signature	"Each signature asks the signer to sign in again first."

"The sign-in uses the directory your workspace's App Identity is connected to." With Once per signing session or Every signature on, signing needs a working App Identity directory.

Save configuration

Save configuration is enabled once a region is set (and a replication target, when the switch is on), and no retention period is shorter than the stored one. On success: "Saved. Azure provisioning ran as part of this save." The badge changes once the window reads the stored record back. In production the retention policies are locked, and a locked policy cannot be shortened or removed.

Provenance cannot be retired or removed today. Nothing in this window waits for Deploy.

Rights

Save configuration checks no access right beyond being in the workspace.

Azi and agents

Azi and agents can propose Provenance settings, including policy settings this window has no control for (reason categories, signature meanings, approval and two-person rules). The region and replication target only before it is provisioned. A proposal may extend a retention period, never shorten it, and may tighten the signing setting, never weaken it.

A pending proposal shows in the window as a table of current and proposed values; rows an accept would refuse are marked. "A pending proposal is not included in this Save — accept it first." Accept it in Proposals, then save. The Provenance menu item counts pending proposals.

Messages you may see

Code or place	Message or meaning
PRIVATE_LANDING_ZONE_REQUIRED	"This needs a private landing zone, which this workspace does not have yet."
The retention floor	Platform configuration is shorter than the longer of the other two. Raise it
Shortening	"A retention period can never be shortened. Reverted values required for:" and the list
A refused save	The server's reasons are listed under the explainer
A failed provision	The platform's reason, or "Azure provisioning did not complete, and the platform did not report a reason."
DEPLOY_IN_PROGRESS	A setup window or a Deploy is already running for the workspace. Wait for it to finish, then try again
PROVENANCE_NOT_PROVISIONED	A Provenance call before this window has been saved: "Provenance storage is not provisioned for this workspace."

Next steps

• What is recorded -> Compliance Matrix
• Reading and exporting the record -> Activity Log
• The order things unlock in -> Environment