Skip to main content

Evidence-Bound Assurance

What does HAIEC need to establish before an assurance decision?

Assurance is not a single scan result or a generic risk score. HAIEC evaluates the evidence applicable to a bounded system and decision, keeps authority planes separate, and records where the proof remains limited.

Five questions, not one blended score

The planes are independent analytical questions. They are not a guaranteed causal sequence, and evidence in one plane does not silently promote another plane.

PLANE 1

Requested

What action or outcome was requested or declared?

PLANE 2

Policy Authorized

What did approved policy or the Operating Envelope allow?

PLANE 3

Effectively Granted

What does credential evidence establish about available authority?

PLANE 4

Code Capable

What can the evaluated implementation technically reach or trigger?

PLANE 5

Observed

What authorized runtime or action evidence shows actually occurred?

Evidence states are part of the result

Established

The evaluated evidence supports the statement within the stated scope.

Partial

Only part of the relevant relationship, path, or evidence surface is established.

Unknown

Available evidence cannot support a stronger conclusion.

Not Assessed

That evidence family was not evaluated in this scope.

Source Reachability is adjacent context

Source Reachability helps explain supported relationships among agents, tools, handlers, resources, services, persistence paths, and evaluation surfaces. It is not a sixth authority plane and it does not establish runtime execution or provider permission by itself.

A source-capable path is not an observed action. A credential reference is not an effective grant. Missing runtime evidence is not proof that an action did not happen.