Typed evidence, with declared ceilings
Evidence comes in types, and each type has a ceiling on what it can prove. A thousand log lines do not add up to an attestation. And evidence about your work, produced by you, is labeled as exactly that.
The ceiling rule
No volume of weak evidence becomes strong evidence.
Every type of evidence has a ceiling on what it can prove, fixed in advance. That is what makes it safe to let bad news win automatically.
A thousand log lines≠One independent observation
Four classes of evidence are not interchangeable: a measured synthetic result, internal field use operated by the producer, a prototype the producer attests to, and a result independently verified. The class is part of the evidence, not a footnote about it.
Independence
Measured, not organizational.
A quorum proves enough enrolled observers responded. It does not prove the set could detect the event. Three observers watching the same blind spot agree perfectly and know nothing.
Independence is judged against a written list of the ways things could fail together. Being in different departments is not independence if the systems share a weak point, and required independence is declared per obligation, exactly as strength of proof is.
What defeats independence
A shared foundation model, provider, data source, prompt lineage, parser, verifier library, benchmark author, or control plane.
What independence requires
Something that could contradict the system that did the work. A command that succeeded is not proof the effect happened.
What the account records
Evidence from inside the system that did the work proves the process ran, not that the effect independently happened, and the Account records which.
Occurrence
An agent’s report is evidence of what it claims.
Never proof of what happened. Whether it happened must be established by something that could contradict the system that did the work.
A timeout is not evidence that nothing happened, and a call that returned successfully is not proof the effect followed.
A successful command≠The effect actually happening
One rule closes the loop: nothing may grade its own work. A connector that produces evidence about outputs its own author generated is a self-report dressed up as evidence, and is either separated or capped accordingly. Applied to people the rule is unremarkable; the architecture refuses to forget it when the author is a model, agent or vendor integration.
Next steps
Evidence proves. Authority decides.
Support is necessary and not sufficient.
Authority and standing
Who may declare a roster, who may accept, and where the chain of checking ends.
Explore →NextThe Confidence Ladder
Seven rungs, from not packaged up to R3, each a ceiling on what may be claimed, and none of them a permission to rely.
Explore →AppliedWhat we measured
What we measured, in plain terms.
See the evidence →