Action provenance is evidence that shows what action was taken, when it happened, and how it was authorized. In security systems, it links an operation to its initiating user, service, policy, or workflow, and preserves a trustworthy record of the execution path. That record can come from signed logs, chained audit events, or policy decisions tied to a request.
It matters because modern attacks often target actions, not just data. An intruder may abuse an API token, trigger a privileged job, or alter a file through an automated agent. With strong action provenance, defenders can reconstruct who approved the action, whether the right controls were present, and whether the record was tampered with. It is useful for incident response, compliance, and detecting unauthorized or replayed operations, but it works best alongside least privilege, approval workflows, and secure key management.