A fintech product team runs a customer onboarding agentic workflow that touches KYC checks and audit trails. Auditors demand rollback to any prior approved version and a clear record of who changed prompts and tools. Which versioning approach addresses these workflow governance needs?

Storing workflow definitions in Git with semantic tags and required reviews directly satisfies both governance demands because tags create immutable, discoverable checkpoints for every approved state enabling rollback to any prior version, while commits, pull requests and mandatory reviewers provide a tamper-evident record of who changed prompts and tools and why. Versioning prompts in a managed registry with approvals is standard practice for prompt iteration, but by concept it versions prompt text in isolation and leaves tool additions, removals or parameter changes outside governed rollback and attribution, which fails the stated KYC scope covering both prompts and tools. Pinning runtime images in a container registry is a sound reproducibility control for deployments, but by concept it versions the execution environment rather than the workflow definition, so it can redeploy a prior image without showing who edited which prompt or tool or enforcing review on those edits. Logging full execution lineage for every run is essential observability for audits, but by concept it records instances rather than governing definitions, so auditors can see what ran yet cannot restore an approved definition or trace its change approval. The exam caveat is to distinguish audit of runs from governance of definitions, since lineage and storage can look audit-ready while lacking restorable approved versions. As a practical check, confirm that git log links each tag to author, diff and approved review and that checking out a prior tag fully restores prompts, tool bindings and policy.