Why CertiField · Traceability & provenance
Every answer has a source.
Confidence scores are a claim about a model. Provenance is a claim about a record — and it is the one an assessor can actually check. CertiField is built so that the question 'on what basis?' has an answer at every hop.
- Statement provenance
- Assessment → version binding
- Content-hashed snapshots
- Hash-chained audit
- Ref
- W-21
- Kind
- Chain
The chain, end to end.
- EvidenceWhere did this come from?EV-4471 · sha256:9f3a…
- ControlHow is it implemented?SC-7 · Boundary Protection
- AssessmentWho assessed it, against what?CAMP-12 · architecture v7
- DeterminationWhat did they conclude?Satisfied
- FindingWhat requires action?F-0093 · CAT II
- POA&MHow is it being resolved?POAM-0093 · in progress
- SSP · SAR · PackageWhat did we hand the reviewer?generated from the above
From a generated sentence back to the evidence that supports it.
- Ref
- W-22
- Kind
- Statements
- Tags
- authored · generated · accepted
A sentence in the SSP knows where it came from.
When a statement is accepted from an extraction proposal, CertiField records durable content provenance for it. Regenerate the SSP later and that statement is correctly tagged as accepted from a proposal rather than freshly generated — and if a person subsequently edits it, the tag changes to reflect that a human has taken ownership of the wording.
That distinction sounds academic until an assessor asks which parts of a two-hundred-page document a person actually wrote. On most programs the honest answer is nobody knows.
- Authored — a person wrote this
- Generated — rendered from the record
- Accepted — proposed by a machine, accepted by a named person, on a date
- Quote-grounded — extractions carry the source text they came from
- Ref
- W-23
- Kind
- Snapshots
- Identity
- SHA-256 of canonical bytes
- Mutability
- none
A version you can prove was not edited afterwards.
A published architecture version is canonicalized to a stable byte representation — explicit field order, sorted collections, normalized nulls, invariant dates — and hashed. The hash is the version's identity. Two versions with the same hash are the same architecture; two with different hashes are not, and the diff will say why.
No API exists to update or delete a published version. Not disabled by permission: absent, and its absence is asserted by an automated test so it cannot be reintroduced by accident.
- Ref
- W-24
- Kind
- Audit
- Chained
- row hash + previous hash
- Verified
- nightly
An audit log that resists being rewritten.
Each audit event carries a hash of itself and of the event before it. Altering one row invalidates every row after it, so tampering is detectable rather than merely discouraged — and the chain is verified nightly, not at the moment somebody thinks to ask.
Events record the UTC timestamp, the actor, the action, the target, the result, the source address and a correlation identifier that follows a request across every operation it touches. They deliberately do not record secrets or sensitive payloads.
What gets logged
- Data creation, modification and deletion
- Access to sensitive and privileged data
- Authentication events and failures
- Every grant of a permission, attributed to who granted it
- Uploads accepted and rejected
- Ref
- W-25
- Kind
- Position
Why we lead with this rather than with accuracy.
An accuracy number is a claim you are asking a reviewer to take on trust. Provenance is the opposite: it is an invitation to check. It costs more to build, it is harder to market in a single slide, and it is the only one of the two that survives an assessor who is having a bad day.
From a generated sentence back to the evidence that supports it.
Next step