Evidence-First Data Management for Trustworthy AI: A Database Architecture for Ecological Tourism Intelligence

Multi-source operational data, in this study, tourism-village records from Indonesia’s national JADESTA portal is rarely stored with enough structure to support trustworthy artificial-intelligence consumption: values are overwritten, provenance is recorded per record rather than per attribute, and unverified data reaches downstream consumers indistinguishably from verified data. This paper proposes P1, a database-driven data management architecture that stores every attribute value as a claim carrying source, time, and confidence; accumulates corrections as new, non-destructive evidence events; computes a confidence score per claim; and enforces a policy gate before any value is published to an AI-facing semantic view. P1 is compared against two realistic baselines B0, an overwrite ETL pipeline, and B1, a record-level lineage pipeline on the full 21,461-record JADESTA corpus under five injected synthetic failure scenarios (duplicate, conflict, missing, late update, and schema drift), and against a 304-pair manually labelled gold sample (Cohen’s κ = 0.742) for entity-resolution quality. The results show that P1’s provenance is not merely nominally complete like B1’s but substantively so: B1 reports a provenance coverage of 1.000 yet a provenance precision of only 0.471, quantifying a "phantom provenance" gap that attribute-level claims avoid by construction. P1’s entity resolution achieves an F1 of 0.849 (precision 0.900, recall 0.804) on the merge decision, and its conservative refusal to auto-merge ambiguous record pairs is empirically justified in 78.6 per cent of the labelled pairs it deferred. P1’s policy gate reduces unverified data reaching the semantic view from 1.000 in both baselines, by construction, to 0.000. These gains carry a scale-dependent performance cost: P1 is approximately 151 times slower than B0 at 500 records, growing to approximately 5,447 times slower on the full corpus, traced to the quadratic per-block complexity of its entity resolution a concrete direction for future optimisation. The evaluation is scoped explicitly: entity-resolution quality claims cover the merge decision only, not the reject threshold, and policy-gate claims cover the gating mechanism only, not the calibration of the confidence function against independent ground truth. The data model, the confidence and policy contracts, and the evaluation protocol are architecture- and technology-independent, and the experiment code, gold sample, and raw results are released as a reproducible benchmark.