Provenance is a product requirement

There is a question that decides whether a legal technology product is usable in contested proceedings: where did this number come from?

It sounds like an audit question. It is actually a data modelling question, and answering it late is much more expensive than answering it early. This post sets out why Pivot treats provenance as a constraint on the record itself, and what breaks in systems that treat it as a reporting feature.

What provenance means here

Provenance, in Pivot, means that every value in the disclosure record — and every value in a document Pivot generates from that record — carries a reference to the specific source it came from: the document, the page, and the location on that page. Not the document in general. The page.

Two things follow from stating it that way. First, provenance is a property of the value, not of the session that produced it, so it survives editing, export and merge. Second, it is verifiable by opening one page, which is the only test that matters when someone is challenged on a figure with a judge listening.

The failure mode this prevents

A language model asked to summarise a bundle of bank statements will produce fluent output including figures. Those figures are generated, which means they can be right, right for the wrong document, or wrong. Fluency is uniform across all three cases: the correct figure and the invented one are written in the same confident register.

If the system does not carry provenance, the only way to check the output is to redo the work — read the statements and confirm each number. That leaves the practitioner in a worse position than before, because they now have a document that looks finished and a verification task that has not shrunk.

If the system does carry provenance, checking is bounded. Each figure has one page behind it. Spot-checking is meaningful, full checking is proportionate, and a figure with no source attached is visibly a figure with no source attached rather than blending in with the ones that have.

This is the practical reason provenance is a product requirement and not a compliance feature. Compliance features are about being able to explain what happened afterwards. Provenance is about the document being checkable while it is being made.

Where the liability actually sits

In financial remedy proceedings, the documents that reach the court are signed. A party signs their Form E under a statement of truth. A solicitor is responsible for the accuracy of the summary documents filed on their client's behalf — the ES1 case summary, the ES2 schedule of assets, the D81 statement of information that accompanies a consent order.

Software does not sign anything. So a system that generates content without provenance is not removing work; it is moving risk onto the person who signs. That trade is a bad one to offer a professional, and it is also commercially unstable: the first time a generated figure cannot be traced under scrutiny, the product stops being used.

Pivot's position is that a generated entry without a source is not an entry. The record will not hold it.

Why we impose it beyond what the rules require

The Family Procedure Rules and the forms themselves set out what must be filed and, in places, how it must be presented. ES2 requires a schedule of assets with figures and, where the parties disagree, both figures shown. Nothing in the rules requires a link from a schedule row to the page of the bank statement that produced it.

Pivot requires it anyway, for three reasons that are about engineering rather than obligation.

It makes disagreement expressible. ES2 exists to show two positions on the same asset. If each of the two figures carries its own source, the schedule stops being an assertion of difference and becomes a document you can adjudicate from. The disagreement is displayed with its evidence attached.

It makes regeneration safe. Disclosure records change: further documents arrive after the questionnaire, valuations are updated, a pension report lands. Court documents therefore have to be regenerated. If every figure knows its source, regeneration is a re-derivation from a known set of sources and the change between versions can be explained line by line. Without provenance, regeneration produces a new document with no defensible relationship to the old one.

It constrains the model's role. When every value must resolve to a source, a language model cannot be the author of a figure. It can locate, extract, align and describe. It cannot introduce. That is not a policy applied on top of the model; it is the shape of the data structure the model has to write into. Constraints in a schema hold better than constraints in a prompt.

What it costs

Provenance is not free, and pretending otherwise would misrepresent the engineering.

It requires that documents are stored in a form where page-level references remain stable, including for scans that need optical character recognition and for exports produced by other systems. It requires reconciling documents that have been paginated differently by different senders. It makes extraction slower, because a value that cannot be located is not accepted. And it makes some output impossible: a plausible-sounding summary that no page supports will not be produced.

Each of those costs is worth paying for the same reason. A disclosure record's value is not that it contains figures. Spreadsheets contain figures. Its value is that every figure in it can be defended in the room where it is used, by the person who put it there.