Provenance - Governed Agentic ITAM

Eight governed AI agents resolve enterprise IT asset data and act on it safely through deterministic risk controls, human approvals, rollback, and an append-only audit ledger.

Comment

Inspiration

Enterprise IT asset management has a difficult gap between what systems can automatically reconcile and what organizations actually need to resolve.

Traditional reconciliation engines are good at deterministic matching, but ambiguous records, stale sources, conflicting facts, licensing positions, employee lifecycle events, custody chains, and contract decisions often end up in a manual queue. That residual work is where operational cost and risk accumulate.

We wanted to explore a different question:

What if AI agents could own that residual — without giving them unrestricted authority to change enterprise systems?

That led to Provenance: a governed fleet of eight specialized agents designed to reason over unresolved ITAM data and produce actionable proposals, while a deterministic governance layer independently decides what can actually happen.

The core principle became simple:

Agents can propose. Governance decides. Humans approve when required. Everything is recorded.

What it does

Provenance operates an eight-agent fleet across three planes:

  • Data Plane
    • Resolver - entity resolution
    • Normalizer - software catalogue normalization
    • Position - licensing and ELP/PVU calculations
  • Action Plane
    • Custody - chain-of-custody and disposal
    • Lifecycle - joiner/mover/leaver workflows
    • Steward - seat reclamation
    • Renewal - contract and negotiation memory
  • Governance Plane
    • Attestor - audit evidence packs

The agents connect to enterprise sources including ServiceNow, Microsoft Entra ID, Intune, Jamf Pro, SCCM, and Okta.

The architecture is deliberately deterministic-first. Exact identifiers and statistical matching resolve the majority of records before AI is involved. Only the ambiguous residual is escalated to Gemini.

When an agent wants to take an action, it cannot write directly to an enterprise system. It submits a proposal to the Action Broker.

The broker independently verifies:

  1. Whether the agent is authorized for the action.
  2. Whether the action is within its configured scope.
  3. Whether the required identity confidence is sufficient.
  4. Which risk tier applies.
  5. Whether execution, rollback, or human approval is required.

Actions are classified into four tiers:

  • T0 - execute immediately
  • T1 - execute with a grace period and automatic rollback
  • T2 - require named human approval
  • T3 - refuse; no execution path exists

Every proposal and outcome is written to an append-only Decision Ledger, including evidence, reasoning traces, and OpenTelemetry trace IDs.

How we built it

We built Provenance as a Python-based agentic system using Google ADK, Google GenAI SDK, Gemini, FastAPI, Firestore, Model Armor, OpenTelemetry, Cloud Trace, and Cloud Run.

The system is organized around three architectural boundaries:

1. Agents

Each specialized agent has a narrowly defined identity and write scope. An agent does not receive an unrestricted backend, preventing accidental or intentional access outside its responsibilities.

2. Governance

The Action Broker is deliberately independent from the agents. Risk classification comes from reviewed configuration rather than model output, and an agent's own claimed permissions are never trusted.

3. Evidence

The Decision Ledger is append-only. Facts are source-attributed with confidence, timestamps, provenance, and rationale. Corrections supersede previous facts instead of silently overwriting history.

We also added Model Armor specifically around untrusted enterprise content such as vendor emails, contracts, HR text, and ticket content, while avoiding unnecessary screening of trusted structured API responses.

For observability, every proposal receives an OpenTelemetry span whose trace ID is carried into the decision ledger, turning the reasoning chain into part of the audit evidence rather than merely debugging telemetry.

The entire project can also run in a fixture-backed demo mode without live enterprise credentials, allowing the complete agent → broker → execution → ledger flow to be demonstrated safely.

Challenges we ran into

The biggest challenge was making agentic autonomy safe enough for enterprise use.

It is relatively straightforward to give an LLM tools and ask it to perform an action. The harder problem is ensuring that a compromised, hallucinating, or simply overconfident agent cannot exceed its authority.

We therefore made governance structural rather than prompt-based.

An agent cannot bypass the broker because it is constructed with an AgentGateway and scoped backend rather than an unrestricted store. The ledger exposes an append-only interface, and segregation of duties is enforced at the API layer so an agent cannot propose an action and approve its own T2 request.

Another challenge was deciding where AI should and should not be used. We learned that sending every reconciliation problem to an LLM is both expensive and unnecessary. Deterministic matching handles the overwhelming majority of candidate pairs, while Gemini focuses on the ambiguous residual.

We also encountered real detection gaps. For example, an Entra device without a serial number can fail to become a candidate against its Intune counterpart when the relevant identifier is not included in the blocking strategy. Rather than hiding this limitation, we documented it as an explicit future improvement.

Accomplishments that we're proud of

  • Built a functioning eight-agent enterprise fleet spanning data, action, and governance responsibilities.
  • Created a deterministic Action Broker that prevents agents from directly executing unauthorized actions.
  • Enforced segregation of duties structurally at the API layer.
  • Built an append-only Decision Ledger containing evidence, reasoning, outcomes, and traceability.
  • Integrated connectors for six enterprise platforms: ServiceNow, Entra ID, Intune, Jamf Pro, SCCM, and Okta.
  • Implemented T0–T3 risk governance with T1 automatic rollback.
  • Added Model Armor protection for untrusted enterprise content.
  • Implemented per-agent write scoping through Agent Identity.
  • Added OpenTelemetry tracing with one trace span per proposal.
  • Built a live browser-based demo UI without a frontend build pipeline.
  • In a live-estate measurement, 124 candidate pairs produced 66 deterministic merges and only 1 Gemini call, demonstrating the deterministic-first approach in practice.
  • Successfully detected three broken custody chains in the seeded estate.
  • Proved end-to-end ServiceNow correction and rollback against a real record.

Most importantly, we demonstrated that agentic automation does not have to mean uncontrolled autonomy.

What we learned

We learned that the most important part of an enterprise agentic system may not be the agent itself.

The real engineering challenge is the boundary around the agent.

Models are excellent at reasoning about ambiguous information, but deterministic systems are better suited for enforcing permissions, calculating risk, applying invariants, and guaranteeing that certain actions cannot happen.

We also learned that provenance changes the architecture. Instead of treating auditability as something added after an AI decision, we made evidence and reasoning part of the decision itself.

The project also reinforced the value of a deterministic-first architecture. By resolving high-confidence cases without model calls, AI can be reserved for the problems where reasoning actually adds value.

Finally, we learned that honest limitations are a feature of trustworthy automation. During testing we found gaps in lifecycle classification and entity resolution. Rather than claiming complete autonomy, Provenance records these boundaries explicitly and provides controlled override paths where appropriate.

What's next for Provenance

The next step is moving from a hackathon-scale governed fleet toward a production-ready enterprise agent control plane.

We want to:

  • Expand the precision harness with additional real-world enterprise datasets.
  • Improve cross-system identity resolution, particularly around devices without shared identifiers.
  • Add more governed action types and enterprise workflows.
  • Connect the approval model to production identity providers instead of request-header principals.
  • Expand evidence-pack generation for auditors and compliance teams.
  • Add richer policy simulation so organizations can test governance changes before deployment.
  • Introduce deeper cost and performance observability across the agent fleet.
  • Expand the connector ecosystem while preserving strict per-agent permissions.
  • Continue exploring how far enterprise workflows can safely move from human-operated tools to governed autonomous agents.

The long-term vision is not simply an ITAM chatbot or automation assistant.

It is an enterprise agent workforce where every agent has a defined identity, bounded authority, observable reasoning, and an enforceable path from proposal to action.

Built With

  • cloud-run
  • cloud-scheduler
  • cloud-trace
  • fastapi
  • firestore
  • gemini-2.5-pro
  • gemini-3.7-flash
  • google-adk
  • google-cloud
  • google-genai-sdk
  • jamf-pro
  • microsoft-entra-id
  • microsoft-intune
  • model-armor
  • opentelemetry
  • pydantic
  • python
  • sccm
  • secret-manager
  • servicenow
Share this project:

Updates