A Reference Architecture for Industrial IoT Data Governance: Provenance, Retention and Cross-Plant Access Control

1.Introduction

Industrial telemetry has an unusual lifecycle. A pressure reading captured today may be consulted in a warranty dispute in eight years, long after the PLC that produced it has been replaced, the calibration record has moved to a different system and the plant has been re-laid-out twice. The question asked at that point is rarely what the value was; it is what the value meant — which sensor, in which configuration, under which calibration, transformed by which pipeline version.

Industrial data platforms overwhelmingly treat this as a documentation problem addressed after ingestion. Our four industrial partners had all attempted that route and all failed the same way: once a source system was decommissioned, the information needed to interpret its historical output was no longer reconstructable at any cost. Governance applied late is not governance; it is a record of intentions.

This paper proposes and evaluates a reference architecture built on the opposite premise — that provenance must be captured as an obligation of ingestion, in an append-only ledger versioned independently of both the ingestion path and the policy layer. The central practical question is whether that obligation can be met at industrial data rates without disturbing the ingestion performance plants depend on operationally.

2.Requirements and Related Work

From incident reviews and compliance requests at the four sites we derived six requirements: reconstructable sensor identity across replacement; immutable record of pipeline transformation versions; retention expressible per data class rather than per storage system; access control expressible across plant boundaries without data duplication; auditability without source-system availability; and no regression in ingestion throughput or latency.

Existing work on scientific-workflow provenance provides the conceptual vocabulary but assumes batch execution and modest volumes. Time-series historian products provide throughput but bind identity to the physical tag address, which is precisely the thing that changes when equipment is replaced. Data-lake governance frameworks satisfy the policy requirements but position enforcement downstream of ingestion, which cannot meet the reconstructability requirement. The architecture we describe borrows the ledger idea from the first tradition and the throughput discipline from the second.

3.Reference Architecture

Layer one, ingestion, is responsible only for durable capture and for emitting a provenance assertion alongside every batch. Assertions carry logical sensor identity, physical binding, calibration reference, pipeline version and ingest timestamp. Logical identity is allocated by the platform and survives physical replacement, which is the mechanism that makes cross-decommission reconstruction possible.

Layer two is an append-only provenance ledger. It stores assertions, never mutates them, and is queryable independently of the telemetry store so that audit questions can be answered even where telemetry has been aged out or the source system no longer exists. Ledger entries are content-addressed and their volume is bounded by configuration-change frequency rather than data volume, which is why the storage overhead we measure is modest.

Layer three is policy enforcement: retention rules per data class, and access decisions across plant boundaries evaluated against the ledger rather than against storage location. Because policy consults logical identity, a rule written once continues to apply after equipment replacement — the failure mode most frequently reported by our partners.

The three layers are versioned independently with an explicit schema-evolution contract, so a plant may upgrade its ingestion agents without coordinated redeployment of policy. In practice this decoupling was what made staged adoption in operating plants feasible at all.

4.Evaluation Method

Sites. Four plants adopted the architecture over nine months: automotive stamping (high-rate vibration and press telemetry), food processing (regulated temperature chains), speciality chemicals (batch genealogy) and discrete electronics assembly (per-unit traceability). Aggregate sustained ingestion across sites was 1.4 million points per second.

Measures. We compared sustained throughput and end-to-end ingestion latency against each site's twelve-week pre-adoption baseline. We assembled 240 provenance questions from the sites' own historical incident investigations, warranty disputes and audit requests, and scored whether each was answerable and how long an answer took, on both the old platform and the new architecture. Engineering effort was recorded in person-days.

Analysis. Throughput and latency are reported as distributions across the observation period rather than point figures, since industrial load is strongly shift-dependent. Answerability was scored independently by a site engineer and one author, with disagreements resolved by joint review of the query trace.

5.Results

Performance. All four sites sustained their baseline throughput. Median end-to-end latency rose 3.1% (site range 1.4–5.8%), attributable to assertion emission on the ingest path. Ledger metadata added 11% storage overhead, well below the sites' own 25% acceptance threshold, and its growth tracked configuration changes rather than telemetry volume as designed.

Auditability. Provenance questions were answerable for 96% of the 240 cases, against 41% on the platforms being replaced. Mean time to answer fell from 6.4 hours to 9 minutes. The residual 4% concerned periods predating adoption, where no mechanism can recover assertions that were never captured — a result worth stating plainly, since it bounds what any provenance architecture can offer on legacy data.

Retention and access. Per-class retention was implemented at three sites. The fourth was blocked by a vendor historian offering no deletion primitive, forcing a shadow-copy workaround we do not recommend and report as an adoption prerequisite rather than an architectural finding. Cross-plant access control was implemented at all four sites without data duplication.

Effort. Adoption cost a median of 34 person-days per site, dominated by logical-identity mapping for existing equipment rather than by software integration. Sites with current equipment registers finished in roughly half the time of those without.

6.Discussion

The evaluation supports the central claim: provenance capture at ingestion is affordable at industrial rates, and it converts a class of question that was previously unanswerable into one answered in minutes. The economic case at our sites rested less on audit efficiency than on warranty and incident exposure, where a single unanswerable question had previously cost more than the whole adoption.

The vendor-primitive dependency is the finding with the widest implication. An architecture cannot enforce retention it cannot execute, so deletion and stable-identity primitives belong in industrial procurement requirements. We suggest they be treated as explicit acceptance criteria for historian and control-system purchases.

Finally, the effort profile — identity mapping dominating integration — suggests that plants can reduce future adoption cost now, by maintaining an accurate equipment register independently of any platform decision.

7.Limitations

Four sites in two countries, all discrete or batch manufacturing, cannot represent continuous-process industries with materially different telemetry topologies. Nine months is short relative to the retention horizons the architecture targets, so our retention findings are about mechanism rather than long-run behaviour.

Answerability was scored on questions drawn from the sites' own history, which reflects what they thought to ask on a platform that often could not answer; the question set may therefore understate the value of provenance for questions nobody attempted. We did not evaluate cost of ownership beyond adoption effort.

8.Conclusion

Separating ingestion, an append-only provenance ledger and policy enforcement into independently versioned layers allowed four operating plants to capture provenance at 1.4 million points per second with a 3.1% latency increase and 11% storage overhead, while raising audit answerability from 41% to 96% and cutting time-to-answer from hours to minutes. Provenance is best treated as an obligation of ingestion; retention, however, remains hostage to source systems that expose no deletion primitive.

9.References

1. [1] Hale, E. & Rahman, A. (2025). Provenance ledgers in manufacturing telemetry. Proceedings of IoT-SE, 45–59.
2. [2] Bergstrom, N. (2024). Logical identity across equipment replacement. Computers in Industry 156, 104–121.
3. [3] Rahman, A., Hale, E. & Bergstrom, N. (2026). Retention primitives in industrial historians. JIPCET 2(2), 66–89.
4. [4] Osei, P. (2025). Append-only stores for regulated telemetry. ACM Transactions on Storage 21(2), 1–24.
5. [5] Tan, M. (2025). Metadata growth bounds in time-series governance. Journal of Data Engineering 12(3), 210–233.
6. [6] Marsh, S. & Ng, A. (2024). Governance layering in operational technology. Journal of Manufacturing Systems 73, 401–418.