Why causal observability: logs tell you what, not why
Observability solved detection. Explanation is still archaeology. The case for capturing causality at write time.
Modern observability is a genuine achievement. Metrics tell you something moved. Traces tell you where the time went. Logs tell you what each service said while it happened. And yet, when the postmortem starts, the first hour is always the same: someone opens six tabs and starts correlating by timestamp.
That’s because today’s telemetry answers what and when — but the question that matters in incidents, audits and AI governance is why.
Correlation is not causation — literally
Timestamp adjacency is how most teams reconstruct causality today, and it fails in exactly the cases that matter:
- Concurrency — two actions interleave; which one caused the outcome?
- Cross-system flows — the cause lives in a different service, a different log format, a different retention window.
- Non-human actors — an automation or an AI agent acted; nothing links its decision to the events that triggered it.
The information needed to answer “why” existed at the moment each action ran. Traditional pipelines throw that structure away at write time, then pay analysts to re-derive it at read time.
Capture causality when it’s cheap
Vectry’s position is simple: causality must be captured when the event is emitted, because that’s when it’s known and cheap. An event that names its actor, its formal operation and its entity coordinates can be threaded into a trace and a causal chain as it arrives. The graph is built forward, not excavated backward.
Once the graph exists, three things stop being projects:
- Incident reconstruction becomes walking a thread to its outcome.
- Audit becomes reading an explanation — the
caused_bychain plus a narrative. - Anomaly triage becomes comparing expected vs actual patterns, with each deviation linked to its explanation.
The XAI angle
As AI agents take real actions in real operations, “the model decided” is no longer an acceptable audit answer. Explainability regulation and internal governance both converge on the same requirement: reconstruct the chain from input events to action. If your data layer captures causality natively, XAI stops being a slide and becomes a query.
That is what causal observability means — and it’s why we built it as infrastructure.