You Can't Backfill Provenance

Confidence: hypothesis. The failure modes below are drawn from published inspection findings and widely reported industry patterns, not firsthand deployment. The buildable pattern at the end is unbuilt: I have not shipped it. Argue with it.

You know this scene even if you have never seen a clinical trial. Something breaks in production. Three weeks later, in the postmortem, someone asks: “why did we make that config change on the 14th?” Nobody remembers. The commit message says fix. The person who wrote it has context switched four times since. You reconstruct an answer from timestamps and Slack scrollback, and everyone nods, and it is a guess dressed as a finding.

Now raise the stakes. Instead of a postmortem with a forgiving audience, imagine a stranger with inspection authority backed by binding regulatory power sits down across from you and asks the same kind of question about something that happened eighteen months ago — and your organization's legal standing to keep operating depends on whether you can answer it from records, not memory. That stranger is a routine feature of one industry: clinical drug development. It is called an inspection, and it is the sharpest version of a problem every engineer already has.

The clinical why

A sponsor — the company running the trial — has to prove to a regulator (FDA, EMA, and counterparts worldwide) that the drug works and that the trial that proved it was run honestly. Periodically, or “for cause” when something looks wrong, an inspector shows up and starts pulling threads: show me this patient's dose change and everything around it, show me how this deviation from plan was found and fixed, show me who knew what and when. The rulebook behind this is GCP — Good Clinical Practice, the international standard for how trials are supposed to be run and documented. The evidence locker inspectors pull from is the TMF, the Trial Master File: the complete paper (now mostly digital) trail that is supposed to contain the trial's whole story. When something goes wrong and gets found, the sponsor has to write a CAPA — Corrective and Preventive Action — a formal document explaining the root cause, the fix, and how they will verify the fix actually worked.