The difference between a log and evidence
An ordinary application log records that something happened, in a format only meaningful to whoever built the system, stored wherever the operator chose to store it, editable by anyone with database access. That is useful for debugging. It is a weak basis for an audit, because a reviewer's confidence in it rests entirely on trusting the operator not to have altered it.
Evidence, in the stricter sense, is a record designed from the start to be checked by someone who does not trust the operator: it binds the request, the identity that made it, the policy version in force, and the outcome together, ideally with cryptographic signing that would reveal tampering rather than merely making it inconvenient.
Provenance ties evidence to its source
Evidence is only as strong as the chain that connects it back to where it originated. If a decision record can be recreated or edited after the fact by the same system that produced it, its provenance is circular — it vouches for itself. Meaningful provenance usually requires the record to be signed at the moment of creation and stored somewhere the original signer does not solely control, so that a later dispute can be resolved by checking the signature, not by asking the operator to repeat their claim.
What this buys, and what it does not
A strong evidentiary record answers 'what happened, and can I verify it independently' — it does not, by itself, answer whether the policy that produced a given decision was the right policy. Those are separate questions. Good provenance makes the first one checkable; it is a precondition for a meaningful answer to the second, not a substitute for it.