Governance and lineage

Audit trail#

Every query and every saga execution is logged with the user, duration, row count, a hash of the SQL, the status, and per-source timings. For sagas the log includes per-step outcomes and the compensation history. This is the record you need to answer "who touched what, when, and did it succeed".

Lineage#

Virtual tables and capabilities form a dependency graph. Lineage metadata tracks column-level provenance across federated queries, so you can ask:

kiwi fabric lineage --verbose           # the whole cross-source dependency graph
kiwi fabric lineage-deps   --name vip_orders   # every table a virtual table transitively depends on
kiwi fabric lineage-impact --name orders       # every virtual table that would break if this table changed or was deleted

Use impact analysis before changing a source or a virtual table.

In the Web UI, Lineage lists virtual tables and capabilities; select one to see what it depends on and what it is used by.

Versioned configuration#

Entity versioning covers data sources, capabilities, virtual tables, saga templates and AI assistants. Each save creates a version, and you can compare any two versions side by side.

kiwi fabric versions --type ai-assistant --entity default-assistant            # newest first
kiwi fabric version-diff --type ai-assistant --entity default-assistant --from 1 --to 2
kiwi fabric version-publish --type ai-assistant --entity default-assistant     # promote the latest draft to published

Gap reports#

Compensation gap reports are governance information too: they list exactly which write paths have no automatic rollback. See Sagas and compensation.

Centralised configuration#

Standard appsettings.json and environment variables always work. Kiwi Vault, a companion Kiwify Labs product, can additionally act as a configuration source to centralise federation credentials, timeout policy and node role assignment across a fleet of instances. It is optional, never a replacement for standard configuration.