Skip to content
Black Atlas — Powered by KRYOS V6

Evidence controls

Evidence & Provenance


Every answer rests on registered material with a traceable origin. Sources are registered, versioned and validated; provenance travels with the claim; suspect material is quarantined; and fact is kept visibly separate from inference.

Why evidence quality matters

Bad conclusions are usually evidence failures

In cybersecurity, most bad conclusions are evidence failures rather than reasoning failures: a stale export, an unverified claim, a control asserted but never tested. Black Atlas is designed to answer only within the evidence and permissions it has, and no artefact is presented as fact without explicit provenance.

Controls

How material becomes usable evidence

Source registration

Material becomes evidence only after registration. Registration records who owns the source, what it is permitted to be used for, and which scope it belongs to.

  • owner and permitted purpose recorded at registration
  • unregistered material is not retrievable
  • scope of use fixed before the source is available to answers

Provenance tracking

Every input carries its origin, age and confidence. Those attributes are not discarded when the material is summarised; a conclusion inherits the weakest evidence beneath it.

  • origin, age and confidence attached to each input
  • derived statements keep a path back to their sources
  • the weakest supporting source bounds the strength of the claim

Citation validation

Citations are checked against the registered material rather than accepted as generated text. A citation that does not resolve is treated as a defect, not a formatting detail.

  • citations resolved against registered sources
  • unresolvable citations block release of the claim they support

Versioning and evidence lifecycle

Sources move through a lifecycle: registered, current, superseded, expired. An answer can be tied to the version of the material that produced it, so it stays replayable later.

  • sources versioned rather than overwritten
  • answers replayable against the evidence state that produced them
  • currency thresholds applied so stale material is treated as stale

Quarantine of suspect material

Suspect, unverified or potentially compromised material is held out of retrieval instead of being quietly down-weighted, so it cannot leak into an answer through aggregation.

  • suspect material excluded rather than discounted
  • quarantine decisions recorded and reversible

Fact and inference kept separate

Claims are marked known, inferred, simulated or unknown. Inference is allowed and useful; presenting inference as fact is not.

  • claim status marked per claim, not per answer
  • simulated results labelled as modelling output, never as observation
  • unknowns stated rather than filled

Next

What happens when the evidence disagrees

Registration and provenance decide what may enter an answer. Contradiction handling decides what happens when two registered sources say different things.