Ask a question in most data chat tools and you get a number wrapped in a friendly sentence. Ask where the number came from and you get silence. That gap is not a missing feature. It is the difference between an answer and a rumor.

At 0plus we treat lineage as the product, not a tab bolted on afterwards. Every answer the chat interface produces carries its own evidence: the SQL that computed it, the tables it read, the transforms those tables passed through, and the approvals that let the result reach a decision maker. This post explains why we built it that way and what changes when you do.

A chat interface without lineage is a rumor mill

A rumor has three properties. You cannot trace it to a source, you cannot reproduce it, and it mutates as it travels. An unattributed chat answer has all three. The model paraphrases, the user screenshots, the screenshot lands in a slide deck, and by the time the figure reaches a steering committee nobody can say which table it came from or whether the filter was right.

In a governed environment this is not a cosmetic problem. A wrong revenue figure in a chat bubble carries the same authority as a right one, and it spreads faster than any dashboard because it arrives exactly when someone asked. If the interface cannot show its work, the rational organizational response is to distrust everything it says, which defeats the point of deploying it.

The audit model: what every answer carries

Our rule is simple. An answer is not an output, it is a record. When the chat interface replies, it attaches a verifiable bundle to the response, generated inside the same perimeter where the data lives.

  • The exact SQL that produced the result, in the dialect it ran, with the runtime and the engine that executed it.
  • The source tables it read, resolved to their versions in the lakehouse, so time travel can reproduce the answer later.
  • The transform chain upstream of those tables: which pipeline cleaned the raw files, which quality rules validated them, which joins built the model.
  • The approvals attached to each dataset: who certified it, under which policy, and when that certification expires.
  • The access decision: which role asked, which permissions applied, and what was masked or excluded from the result.

None of this is reconstructed after the fact. The lineage graph is written while the pipelines run, so the chat interface only reads what governance already recorded. The distinction matters to auditors. A trail assembled on demand is a story. A trail written at execution time is evidence.

-- attached to the answer, generated in-perimeter
SELECT region,
       SUM(amount) AS total_sales
FROM   sales_star        -- certified: finance, 2026-Q2
WHERE  quarter = '2026-Q2'
GROUP  BY region
ORDER  BY total_sales DESC;
-- lineage: raw_files -> sales_clean -> sales_star

What this looks like in the chat window

Three tabs, one answer

In the product, lineage is not a buried export. Next to every reply sit three views: the chat answer, the SQL, and the lineage graph. An analyst reads the sentence. A data engineer flips to the SQL. A reviewer follows the graph from raw files to the answer source. One answer, three levels of scrutiny, and no extra tickets for the data team.

An answer you cannot trace is an opinion with good formatting. An answer that carries its SQL, its sources, and its approvals is a fact you can defend in front of an auditor.

Why executives start trusting the numbers

Executive distrust of analytics is usually rational. Leaders have been burned by dueling dashboards and numbers that change between meetings. Lineage changes the failure mode. When two figures disagree, the argument is no longer about whose number feels right. You open both trails, find where the paths diverge, and fix the transform or the filter. Disagreement becomes a short diagnosis instead of a standing agenda item.

It also changes how answers are consumed. A finance chief who can expand an answer and see certified sources will quote it in a board pack. One who cannot will ask a trusted analyst to redo the work by hand, and the chat interface quietly becomes a toy. Trust in this category does not come from accuracy claims. It comes from the ability to check.

What auditors actually ask for

Auditors and regulators rarely ask whether your AI is impressive. They ask who accessed this data, what produced this figure, whether you can reproduce it, and who approved the dataset it came from. With lineage written at execution time, each of those questions maps to a query over the audit log instead of a week of archaeology across email threads and scattered notebooks.

Because 0plus runs inside your perimeter with zero egress to public AI, the trail is complete by construction. There is no external model call to explain away, no third party log to request, and no gap where a record crossed a boundary you do not control. The same architecture that keeps the data private is the architecture that keeps every answer accountable.

That is why we say lineage is the product. The chat window is where people meet their data. The lineage behind it is the reason they can believe what it says.