Thesis
Principles
Ten commitments. A principles page is cheap to write and expensive to mean, so each one below carries its own status — enforced today means the database refuses the violation right now; partly enforced means the record structure exists and the layer that fills it does not. Nothing here is asserted wholesale:what runs today stays the one authoring home of the product-status statement.
Machine-assisted decisions must remain explainable.
partly enforced The record structure that makes explanation possible — anchored evidence, rationale, rule version — is schema-enforced today. The AI judgment layer that would produce decisions inside it is not yet built.
Evidence must be attributable.
enforced today The schema refuses an extraction that cannot name its document and page, and refuses evidence with no recorded inference behind it.
Rules and policies must be versioned.
enforced today A rule can retire but never change; authority policies carry explicit effective windows; every seal captures the versions live at judgment time.
Historical decisions must remain reproducible after policies or models change.
partly enforced Rule-version capture and the recomputable record are enforced today. Model-level reproducibility waits on the provider adapter — a roadmap item, stated as such.
The system must distinguish source material from derived conclusions.
enforced today Immutable source payloads, observed claims, and resolved values are separate layers with separate writers — and conflicting claims coexist rather than overwriting each other.
Approval authority must be explicit.
enforced today Maker and checker are separate database roles with no membership between them; the database refuses a maker sealing its own work.
A model output is not evidence by itself.
enforced today The kernel treats the model as an untrusted client. Nothing a model believes changes what the system of record accepts.
Human approval should be enforceable where policy requires it.
partly enforced A distinct approver is schema-enforced today. Binding that approver to an enterprise human identity by signature is trust-ladder rung 3 — not built, and labeled not built.
Uncertainty and exceptions should be visible, not hidden.
enforced today Refusals are first-class, named states — not silent failures — and a gate never treats the absence of a blocker as evidence of a pass.
The record should survive changes in models, vendors, and interfaces.
enforced today The record is plain, recomputable structure in the system of record — designed for an outside verifier, owned by no model or vendor interface.