Proof & Accountability
After an autonomous effect, can you prove what authority was actually in force?
Logs show that something happened. That is rarely the question afterwards.
A consequential autonomous action creates harder questions. They arrive weeks later, from people who were not in the room.
The sole witness
The actor should not be the sole witness to its own authority or its own actions.
An autonomous system can explain what it intended to do. A log can record what a component reported. Neither by itself establishes what organizational power was actually delegated at the time of consequence.
WhiteFin ties the governed attempt to the Authority in force and the decision that followed, and can link that record to the resulting or prevented effect.
The purpose is not another account of activity. It is evidence another party can evaluate independently.
A governed decision produces evidence designed to survive disagreement.
Each governed decision produces cryptographically protected evidence of the governed attempt, the Authority in force, and the decision made. WhiteFin can link that record to evidence of the resulting or prevented effect.
The resulting record can be checked independently of the live WhiteFin runtime.
The result is an accountability record another party can examine without asking either the autonomous system or WhiteFin to explain itself.
The difference
“We monitored it” and “we can establish it” are not the same sentence.
Most organizations have the first one. Telemetry, dashboards, an event trail. It is real work and it is worth having.
The second one is a different thing. It is a record another party can check for themselves. The distinction is invisible until someone with standing asks a hard question, which is the worst moment to discover you only had the first.
A record you produced.
Written by your systems. Stored in your systems. Read back through your interface and explained by your people. In calm conditions that is enough. Its credibility rests on your organization’s account of itself, and after a consequential incident reasonable people will test that.
A record someone else can check.
The reviewer checks it themselves, on their own machine, without you in the room and without taking your word for any step. That is a higher bar. It is also the only one that holds when the questions get serious.
A record you made is an account. A record someone else can check is evidence.
Activity and Authority
Activity evidence is not Authority evidence.
who called what, when, and whether it succeeded.
- What organizational power had actually been delegated?
- Was that Authority still current?
- Was this action inside it?
- What effect followed, or was prevented?
WhiteFin is built to connect those questions rather than leave them distributed across unrelated systems and teams.
The questions that arrive with the incident
Four rooms. The same six questions.
Incident review. The board. A regulator. Internal audit. They arrive at different times, with different authority, and they converge on a short list.
None of them is asking for a dashboard. Each is asking whether the organization can still account for the power it gave away.
What Authority was valid?
Not what was technically possible, and not what the token allowed. What bounded power the organization had deliberately delegated to this system, for this work, at that moment.
Who was entitled to approve it?
Delegated power widens for a new use case and narrows after an incident. Every change was somebody’s decision. Each one should still point back to a person entitled to make it, long after the meeting is forgotten.
What decision was made?
The action was allowed, or it was refused. A decision nobody recorded cannot be defended later, however sound it was at the time.
What effect occurred, or was prevented?
Boards ask what happened. They ask just as often what nearly happened, and why it did not. Both belong in the record.
Can the evidence be independently verified?
Evidence that only the vendor’s own system can read is weak evidence. It puts the vendor between an institution and its own account of what happened.
Is the scope of the claim explicit?
What the evidence covers, and what it does not. A claim with no stated boundary is not a stronger claim. It is a weaker one, and an experienced reviewer reads it that way.
Design principle · what a record has to carry
An event is the end of a chain. The chain is the answer.
Every question on the list above is a question about derivation. Not “did this happen” but “what made this permissible, and who decided that.” A record that keeps only the final event has thrown away the part being asked about.
So the record is built backwards from the question. Each link points at the one before it, all the way back to a human act inside the organization.
A person or body entitled to delegate power decides to delegate it, for a stated purpose.
That decision is fixed in a stable form outside the agent, so it can be pointed at later.
The committed form becomes the boundary actually in force at the execution surface.
A specific attempt is allowed or refused under that boundary, at that moment.
The action reaches the system it was aimed at, or it does not get that far.
Something changed in the world, or something was stopped before it could. Both are outcomes.
The governed decision leaves cryptographically protected evidence of the governed attempt, the Authority in force, and the decision made. WhiteFin can link that record to evidence of the resulting or prevented effect, while protecting the record so later alteration can be detected and the derivation can be checked independently.
Proof should preserve the derivation, not only the last event. The institutional question is not merely what happened. It is what Authority existed, how it became active, what decision was made under it, and what consequence followed.
Independent verification
A reviewer should be able to check the record without us.
Evidence only the vendor can read is weak evidence. It places us between an institution and its own account of what happened.
Customers should not need WhiteFin in order to verify WhiteFin.
WhiteFin produces cryptographically protected evidence of governed decisions that can be checked independently of the live WhiteFin runtime and linked to the evidence supporting the resulting or prevented effect.
WhiteFin states separately what the available evidence establishes about integrity, provenance, Authority, decision, and effect.
Those are different claims. We do not collapse them into one larger statement for marketing convenience.
The exact assurance available in a deployment depends on the evidence and trust configuration established for that deployment, and that scope is stated during evaluation.
Whose evidence it is
Your account of what happened should not depend on us still being there.
WhiteFin is designed so the organization’s evidence remains under the organization’s control.
A future incident review, audit, board inquiry, or regulatory examination should not depend on WhiteFin being online, cooperative, or even present in the room.
Honest scope
We state what is covered. We do not imply the rest.
The tempting move for a vendor is to leave scope vague and let the reader assume it covers everything. That assumption survives exactly until the first person checks. We would rather be narrow and correct.
Proof is strongest when its boundary is explicit: which execution was governed, which Authority was in force, which effect is supported by the evidence, and what remains outside the claim.
Partial visibility does not become a universal claim by being described carefully.
Proof and the next boundary
Verified history can improve the next boundary. It cannot become Authority.
Verified execution history gives the organization better context for future Authority decisions: what was approved, what was exercised, what was denied, what recurs, and what is genuinely new.
WhiteFin can use that history to recommend a change.
A recommendation is not Authority. Repetition is not permission.
Nothing observed, inferred, or recommended by WhiteFin becomes additional organizational power until a person or body entitled to delegate that power decides that it should.
Standards reference
Where this has already been examined outside WhiteFin.
Selected WhiteFin execution-proof objects were mapped to the RFC-0509 Receiving-Boundary Reliance Grammar in a controlled bilateral exercise; see https://3pmobile.com/standards/rfc-0509-mapping.
The WhiteFin reference page, including the published file and its checksum, is at whitefin.ai/standards/rfc-0509-mapping.
What would you need to establish, and to whom?
If an incident review, a board, a regulator, or an internal audit is going to ask what authority governed an autonomous action, that is a concrete requirement. Bring it and we will tell you plainly what we can establish, what we cannot, and where the boundary sits.