Source provenance and data authority

RapidValue records where imported objects and governed edges came from. That provenance is evidence: it lets an operator distinguish an observed target value, an imported identity fact, a calculated governance result and a platform-issued write.

Provenance is not the same as a universal data-authority matrix. The product does not currently claim one central policy that resolves every conflict per object, property and identity type.

What is authoritative today

Authority is declared at the boundary that owns the operation:

• a connector instance is the source of the records it imports;
• correlation declares which external key identifies the same governed object;
• mappings declare which canonical field a source value populates;
• write mappings and connector capabilities declare which fields and operations can be sent to a target;
• governance rules and approvals are the source of Expected access;
• the most recent successful import is the source of Actual access.

When a system is downstream of another writer, a sync relationship can route a matching operation to the upstream source rather than writing directly to the downstream target.

What provenance lets you answer

For a supported object or edge, the product can name the connector, rule, approval, request or calculation that produced it. High-volume workbenches use server-side filtering and pagination, and show provenance where the underlying row carries it.

That is narrower—and more honest—than saying every field conflict is resolved by one global precedence engine.

Conflicts and safe failure

An API identity push does not silently overwrite an identity owned by another source. The default is a conflict response. A credential may opt into partial merge for the explicitly safe field set; the response and audit then name the owning source and skipped fields.

For ordinary imports, correct the source, mapping or ownership declaration and re-run. Do not use source ordering as an undocumented business rule.

Which source owns a person

Identities are the one object kind with a declared ranking. Each person is owned by the source that supplied them, and a person is only matched against rows that source owns by its external id. Matching across sources is a separate, counted step: the cross-source join key is a per-connector setting (cross_source_join_key in the connector's engine configuration: email, the default, employee_id, or none), and joins and exclusions are counted in the sync step log instead of happening silently.

The ranking is the ordered source list for identities on the Data model page. Ownership moves from one live source to another only when both are ranked, and it is decided when the person is recognised, not when a field happens to change. Connectors that do not exist, are targets, or are the API push source are ignored, and an empty effective ranking means no ranking: nobody is moved and the connector's role decides who may attach. Each move is audited as a source transfer. A connector also proposes leavers only among the people it owns, and offboarding a source suspends nobody unless the administrator chooses to terminate them, which goes through the normal leaver path and the leaver safety threshold.

Proposals from the synced data

Two places propose authority from what the sources actually send, and neither applies anything by itself:

• Per attribute, which source wins. The Data authority tab of the Identity type proposes a mode and a pinned source per attribute, measured from how many people each source fills it for, how fresh each source is (a failed or week-old sync is stale; the API identity source pushes changes when they happen, so it is stale only when it never pushed) and which side an administrator kept when sources disagreed. Where sources disagree about the same people, or the best source is stale, the row asks for a decision instead of proposing. Accepting writes through the same audited configuration as a manual change. The go-live readiness board lists open proposals.
• Per source, which attributes it owns. A source's "attributes this system owns" panel shows, per attribute, how many of the people it supplies carry a value, and offers the measured set as a proposal to review before it is staged.

Roadmap boundary

A unified matrix across object kind, property, source and identity type is not a shipped product claim. Until that model exists, evaluate authority per connector, mapping, sync relationship and governed operation.

See imports and schedules, provisioning mappings, read/write parity and API reference.