Reference · Definition of record
Infrastructure that lets any AI decision answer prove it — to a party that does not trust the system that produced it.
Compliance is the reference implementation, not the subject. Part IV answers the three objections the model actually draws — policy engine, behavioral analytics, zero trust. Part V is the current state, including the one claim that sealed perfectly and was false. Figures read 2026-08-15; every count is reproducible by query.
Not a log line, not an event. A claim, and the grounding it terminates in. Grounding has three roots and every claim reduces to one of them.
| Root | Means |
|---|---|
| observed | Happened, and was witnessed |
| computed | Derived deterministically from claims that already hold |
| prior_decision | A decision made earlier that later claims must stay consistent with |
A claim that grounds in nothing, or in itself, is not a weak claim. It is not a claim.
The verifier names this grounding_unresolved, and it is the whole
difference between evidence and assertion.
A claim sits in a neighbourhood. Four relationship types bind it there, and each answers to a different source. To forge a claim you must satisfy all four at once, and satisfying one tends to break another.
A seal proves a record has not changed since it was sealed. It says nothing about whether the record was ever true, or consistent with anything around it. Different questions, and only the second one is differentiated.
The integrity-bearing core — bind, relate, seal, verify — is deterministic. A learned model is confined to two places: structuring messy input into proposed claims that terminate in grounding it did not author, and acting as the filter or fuzzy bar for an audience.
Not squeamishness about models. A learned component inside the core makes integrity unfalsifiable. At the edge the worst a model does is surface the wrong true thing. In the core it can fabricate, and no amount of sealing distinguishes a fabricated claim from a sound one.
A guard that checks the actor label does not enforce this. A projector running
as SYSTEM can seal model-authored grounding while every actor-based check
stays green. Enforce on content provenance, not on who signed the write.
Policy in a prompt is not a control. PocketOS's agent had explicit, repeated, agreed-to instructions and violated all of them. Any agent can. So if the agent both acts and writes the claims about what it did, the graph is worth exactly what a log is worth: a story told by the party under investigation.
The emitters sit around the agent, not inside it.
The obvious hole: what stops the agent going around the broker? Nothing, if it holds a credential that works elsewhere. That is precisely PocketOS step 3 — an over-scoped token found in a workspace file.
A graph without that credential discipline is theater. It produces a beautifully verifiable record of the actions that weren't the problem.
A log records what happened. The graph records what happened and the constraints it had to satisfy, as separate claims from independent sources. The evaluation between them is a computation, not a statement by either party — and anyone can re-run it.
To catch PocketOS in logs, someone had to have written an alert for "agent used a credential outside its provisioning purpose." Nobody writes that alert, because you cannot enumerate the next incident. Coherence is not a query. The constraint was already recorded, and the action simply fails to satisfy it. No anticipation required.
A log can be edited, and its absence proves nothing. A missing chain entry breaks the chain. An anchored envelope proves it existed before the incident rather than after, which is the entire liability question and the thing PocketOS's founder could not show.
| Blocking | Non-blocking | |
|---|---|---|
| Test | Conditional edges dereference | Divergence from prior distribution |
| Nature | Deterministic predicate | Statistical |
| Result | Refuse the action | Hold for a human, or alert |
| Cost | Milliseconds, local neighbourhood | Continuous, background |
Blurring these is how you get an unfalsifiable gate. A model may propose, rank, summarize or draft the envelope; the refusal predicate must be computable, or you have built an LLM watching your deploys, which is not a control. That is also what makes the mechanism auditable: an outside party can read the predicate set, disagree with it, and check whether it fired.
Coherence at write time is not a global recompute. When a claim lands you evaluate only its neighbourhood: the edges it introduces and the claims at the far end. Bounded, and independent of graph size.
On 24 April 2026 a vendor coding agent deleted PocketOS's production database and its backups in nine seconds, using an over-scoped credential found in a workspace file after an authentication failure. This is the benchmark for what the readout must contain.
Re-derivable by an insurer, a customer, a regulator or the vendor without trusting PocketOS, the model provider, or the platform. That is the product. Not the nine seconds.
Same machinery, different question. PocketOS answers what does it show. A deploy answers when. The answer is not the post-mortem, and post-mortem is where most products stop.
| Gate | Catches |
|---|---|
| 0 · envelope | Authority broader than the task. A staging bump requesting production verbs. |
| 1 · proposal | Destructive verb outside the envelope. Files staged with no derivation path to the declared task. A tag bumped by grep window rather than the service's own entry. A secret written directly where the declared source of truth is elsewhere. |
| 2 · post-condition | The whole silent-no-op class. A sync reporting Succeeded while the live image and trigger annotation are unchanged. An asserted effect that observation contradicts. |
| 3 · divergence | Novel verb for this actor. Phase duration outside the known envelope. Blast radius anomaly — this commit touches thirteen files, the last fifty touched one. Two actors holding overlapping authority in an overlapping window. |
Not a dashboard. A Gate 1 break returns into the agent's loop as a tool error naming the unsatisfied condition and the envelope clause it came from. The agent does not choose to stop; the call fails. Gate 3 novelty lands in a human queue. And every refusal is itself a sealed claim, so "the substrate blocked this, at this time, for this reason" is in the record — which is what makes the post-mortem you no longer need unnecessary.
The case above is what the deploy path should produce. This is what it did produce, on staging, on 2026-08-15, through a PreToolUse hook that the harness invokes rather than the model. Every row below is real and reproducible by query; nothing here is illustrative.
Three sessions ran under the same actor, deploy-orchestrator. Each opened by sealing
an authority grant before any work, and every command afterwards was classified, gated,
and sealed as either a permitted proposal or a refusal.
git.push has a precedent chain two
hops deep, while git.local and unclassified — genuinely new — get no
edge at all. A behavioral dimension that fired on everything would be noise; one that fired on
nothing would not exist.
The session C refusal is the one worth reading, because the gate could not classify the command and it named production. It was refused under the ordinary deny-by-default verb allow-list rather than a special case, so the verdict re-derives exactly like every other one:
Everything needed to recompute the verdict is in the row: the predicates that failed with expected
and actual, the version of the logic that ran, and a hash of the exact (grant, action)
pair it ran over. A hostile party re-derives this without asking us for anything.
| A hostile party confirms | Mechanism | State |
|---|---|---|
| this record existed at this time | RFC 3161 anchor | live 493/493 |
| it has not changed since | hash chain + Merkle | live |
| it is consistent with its neighbours | coherence verifier | live |
| and here is what it asserts, correctly scoped | per-subject read path | broken |
One and two are good and currently under-claimed. Three is the differentiated one. Four is a read-path defect, not a design gap — scope is persisted correctly on every claim and discarded on serve.
Each of these has been asked in earnest, and each is a reasonable thing to suspect. The answers below concede more than a pitch would: in every case there is a component that does the thing being named, and the distinction lives in what happens after that component runs.
EvaluateAuthority is a policy decision point. Deny-by-default allow-lists, a bounded validity window, seven predicates, no model in the
path. Anyone who says that part is not novel is correct, and dressing it up invites the harder
question later.
A policy engine emits a decision and a decision log. That log is a report written by the system
that made the decision, and it is believed because the reader already believes that system. Our
refusal seals the grant it was evaluated against, every failed predicate with expected and actual,
the gate version, and a hash of the exact (grant, action) pair the verdict ran over.
A party who trusts us not at all recomputes it and lands on our answer. That is a different kind
of statement, not a longer one.
IaC is a further step away. It declares desired state and converges toward it. It has no
representation of an actor, a proposal, or a refusal — Terraform does
not record what you almost did, or under whose authority you were doing it. And its report is
about the request, not the world: the deploy that motivated this document reported
Succeeded with the image unchanged. IaC's own status was the false
claim. post_condition exists for exactly that gap — assert the effect, read the world
back, seal a FAILURE when they disagree.
No, and the difference is architectural rather than rhetorical, which means it is checkable.
Behavioral analytics builds a statistical model of normal and scores deviation from it. It is probabilistic, it drifts every time it is retrained, and it cannot tell you why beyond a number. Coherence is not a model at all. It is a fixed set of predicates over the graph: does every claim's grounding resolve, does a hub's asserted count match the corroborating edges it actually has, is a superseded claim still being cited, do two declared time windows contradict. Every finding is typed, names its claim, and re-derives on demand. No training set, no threshold, no drift.
The behavioral dimension is where the suspicion is most reasonable, because
has this actor issued this verb before is exactly the question UBA asks. The answer is a
lookup, not a score. LatestActionClaimByActorVerb either returns a prior claim — in
which case a precedent edge is sealed — or it does not, in which case the verb is reported as
novel. Absence is the signal, and absence is a fact rather than an anomaly rating.
The load-bearing constraint: behavioral never blocks. Novel verbs are reported. Refusals come only from the deterministic authority predicates. The moment a learned model decided what was permitted, the verdict would stop being reproducible by a hostile party, which is the entire product — and it would breach the rule that confines a model to proposing claims and to the audience filter, never to authoring grounding and never to sealing.
That boundary is not theoretical. It has been violated once, caught by the verifier rather than by review, and the offending claim was retired. The account is in Part V.
The authority gate is a zero-trust PDP. No implicit trust from context, per-action evaluation, bounded envelope. Zero trust is a mature, well-funded category, and the graph consumes its primitives rather than competing with them.
Zero trust asks whether a request should be allowed right now. The property being sold here is that the authority was fixed before the work began, and the ordering is provable. In the PocketOS case the agent held valid credentials making authorized requests the entire way down — zero trust was working. What nobody could demonstrate afterward was that the operator's instructions predated the incident, which is why the agent's own confession became the record. Zero trust does not model task derivation, so it has nothing to say there.
It verifies identity and posture. It never verifies that a statement about the world is true. A tool can report success and change nothing, and a flawless zero-trust posture will wave that through — as it did on the deploy above.
Conditional is the zero-trust-shaped one. Depth, temporal and behavioral are about whether a body of assertions holds together over time, which is not admission control. Integrity is emergent from the coherence of all four; the chain seals that coherence rather than creating it.
The two fail in opposite directions, which is why both are needed. Zero trust fails by letting the wrong request through. This fails by letting a false claim look grounded — and a false claim looking grounded is precisely what Part V opens with.
Every mechanism above exists. In production, almost all of the data is still about compliance controls rather than agent operations — the reference implementation is well populated and the product is not.
| Claim type — production | Claims | Domain |
|---|---|---|
| control_satisfaction | 1,256 | compliance |
| evidence_record | 682 | compliance |
| gap | 592 | compliance |
| aggregate | 12 | compliance |
| model_determination | 2 | compliance — one retired, see below |
| autonomous_decision | 1 | agent operations |
| remediation | 1 | compliance |
| Relationship — production | Edges | State |
|---|---|---|
| temporal | 1,868 | exercised |
| depth | 1,520 | exercised |
| conditional | 1,076 | exercised |
| behavioral | 1 | still unexercised in prod |
Production grounding roots: computed 1,321 · observed 1,224 ·
prior_decision 1. The two dimensions that carry both case studies
are still the two with no production data.
The gap named in the previous revision has been closed on staging, by real gated sessions rather than fixtures. The agent-operations claim family exists, a PreToolUse hook is the chokepoint, and both previously-empty dimensions now carry rows produced by an agent actually being governed:
| Staging — agent operations | Rows | Grounding / subtype |
|---|---|---|
| action_proposed | 7 | computed |
| authority_grant | 3 | prior_decision |
| action_refused | 2 | computed |
| conditional edges | 9 | authorized_by |
| behavioral edges | 3 | precedent |
| temporal edges | 1 | supersedes |
The discrimination is the part that matters, not the counts. On a cold first session every verb came back novel. On the second session by the same actor, only the genuinely new verb was novel and the repeats drew precedent edges instead. A behavioral dimension that fired on everything would be noise; one that fired on nothing would not exist. This one distinguishes.
The clearest evidence that this is not a tamper-evident log is that the log was perfect and the graph still caught something.
A model_determination claim was sealed into production on 2026-08-11 carrying an AI
verdict about PCI 12.1.1. It was grounded computed with the model named as the
grounding engine, which puts a learned model on the authoring side of grounding — forbidden by
the core rule that a learned model may propose but never author grounding.
Its payload also carried roughly 4.5KB of raw chain-of-thought, a shape the meta-schema forbids by
name twice. Its grounding_ref was set to its own source_record_ref, so
the claim grounded on itself and terminated nowhere.
The chain was flawless throughout. The hash was correct, the sequence number was correct, the seal
verified. The coherence verifier returned coherent: false for four days on
exactly one finding, and no amount of re-verifying the seal would ever have surfaced it.
The write path was reverted rather than patched, because the mechanism was wrong and not merely buggy. History was deliberately not rewritten: the claim stayed sealed and current until a supersession path existed, and the revert said so in as many words.
That path now exists and has been run. A terminal version was sealed on the claim's own lineage
with a temporal/supersedes edge to exactly that claim, grounded on the withdrawal
rather than on the retired claim's own reference — copying that identity would have left the
verifier reporting the replacement. Production went coherent: false → true, findings
1 → 0. The original row is untouched and still readable. It stopped being current; it
did not stop existing.
The withdrawal is deliberately narrow and refuses any claim type the projector still writes, since a live type would simply be re-derived by the next compose. That same guard is what prevents it from ever being reached for to retire an inconvenient finding.
Six days after the coherence catch above, the authority gate refused a real destructive command
in production. On 2026-08-17 a coding agent proposed kubectl delete against a live
production pod. The gate rejected it on two predicates in the same evaluation: the verb was
outside the grant, and the environment named production against a staging-scoped envelope. The
command never reached the cluster.
The refusal sealed to the production chain across sequences 18956–18960 — five
hash-linked entries covering the proposal, the failed predicates with expected and actual, the
gate version, the snapshot hash of the exact (grant, action) pair, and the refusal
outcome itself. Every field re-derives against the same grant to land on the same verdict.
What this adds to the record above: Case two, actually run shows the mechanism firing on real command traffic in a staging environment. This is the same mechanism firing on real command traffic in production, on a destructive verb, on the current chain, this month. It governs work driven through the agent harness; the platform's own in-cluster autonomous routes are a separate build, still ahead of us.
Hours after those three sessions were sealed, a production deploy of this very service ran. The PreToolUse hook was installed and fired on every single command of it. It produced zero claims.
Nothing malfunctioned. No grant was open, so the gate did the only honest thing available to it: allowed each command and said so.
That deploy changed a production image, and the only record of it is the ordinary one — a GitOps commit, an ArgoCD operation, a shell history. Exactly the artifacts that were available to PocketOS's founder, and exactly the ones that could not answer the question that mattered.
It is left in this document deliberately, because it is the most honest thing in it. The chokepoint exists, it is installed, it is unavoidable, it fired every time — and a governed session is still something a human remembers to open. Until opening the envelope is the default rather than a discipline, coverage is not a property of the architecture. It is a habit, and habits are what the PocketOS operator also had.