Evidence Control Surface
The Evidence Control Surface defines what records remain to prove what happened. Evidence is more than logging: it must be sufficient for the material reconstruction question and its attribution boundary.
What question does it answer?
Can the workflow be reconstructed from preserved evidence?
What does evidence failure look like?
Common failures include missing prompts, tool-call chains, timestamps, source references, approvals, verification results, handoff records, or recovery actions. A log may show that a tool ran while failing to show who authorized it, which state governed it, or whether its result was relied upon.
Evidence volume does not equal evidence sufficiency. The required record depends on the claim an investigator must establish.
What evidence should an audit inspect?
- provenance and custody of source records;
- prompts, outputs, tool calls, and timestamps where appropriate;
- source-state and version references;
- human approval and override records;
- verification inputs and results;
- handoff and reliance records;
- correction, rollback, and recovery actions; and
- contradictions, missing records, and retention limits.
What is the decision consequence of a gap?
When evidence cannot establish a material claim, the determination must preserve that uncertainty. Missing evidence cannot be converted into favorable readiness, absence of failure, or confident attribution.
Related Terms