Platform and security engineers managing internal artifact registries (Nexus, Artifactory, AWS CodeArtifact) need to track the full provenance chain of build artifacts — from source commit to published package — detect dependency confusion vulnerabilities, and enforce artifact promotion gates across environments. Without provenance, a single poisoned dependency can propagate silently across all services.