State lineage is the chain of system states that shows how one action, decision, or workflow step leads to the next. In practice, it is a provenance record for execution: who or what changed the state, what input was used, and what the resulting state became.
In cyber security, state lineage matters because defenders need to reconstruct how an incident unfolded across agents, tools, and automation. It helps with auditability, incident response, and accountability when an AI agent, script, or service account triggers side effects. Attackers may try to hide or break lineage by using unlogged tool calls, indirect delegation, or tampering with records. Defenders use cryptographic attestation, signed logs, and bounded workflows to make lineage harder to forge and easier to verify. A complete lineage does not guarantee safety, but it makes unauthorized or unexpected behavior much easier to detect and prove.