Glossary

Notary turns opaque AI decisions into forensic, replayable, auditable evidence. It captures a decision as sealed evidence, replays it deterministically, verifies whether a proposed fix corrects it, and issues a signed Proof of Mitigation certificate compliance teams carry into existing GRC tooling. Built for regulated domains where a decision must be defended to a regulator, auditor, or court.

Notary's incontestable entry point: deterministic replay reproduces (or does not), mutation-verified fix works (or does not). No 'trust our score.' Regulator-aligned as EU AI Act, SEC, OCC, CMS move from 'document your process' to 'demonstrate remediation.' Land narrow; expand as verified failures accumulate into Release Gate coverage.

Produced by the Forensic Agent Logger SDK. Every prompt, response, outbound call, tool invocation, guardrail check, and the final decision are captured as elements, each HMAC-SHA256 sealed and combined into a Merkle tree whose root hash represents the entire snapshot. Any later tampering or reordering changes the root and is mathematically detectable. Verifiable offline.

The single top-level hash produced by combining every captured element's HMAC-SHA256 hash into a Merkle chain. Recompute the root from a snapshot's contents; if it matches the stored root, evidence is intact. Any modification, reordering, or omission produces a different root.

The set of outbound API and LLM call/response pairs the SDK captured during an agent run, indexed by call signature. Replay answers each captured call from the cassette by default, so a decision can be reproduced without contacting the original provider. Sandbox escalation is used only when a fix introduces calls the cassette cannot answer.

Every accepted snapshot, review, and proof event is persisted append-only. Any request to modify or delete a record is denied. Backed at rest by S3 Object Lock (Stage 3, WO-37). Review and proof history is derivable from the append-only transition events, never overwritten.

Notary grades the strength of the evidence supporting any candidate on a five-step scale. E0: raw observation only. E1: authoritative context linked. E2: corroborated by an authoritative or second source. E3: sealed and replay-ready (proof-eligible). E4: complete before-and-after fix verification. Promotion into the proof loop is fail-closed on E3 or E4 plus an authorized review.

DEP is the protocol Notary and its providers use to exchange decision-relevant resources: observations, context bindings, evaluator outputs, assessments, review decisions, evidence bundles, and verification claims. Every resource is immutable; transformations are recorded. The protocol is portable — engine algorithms stay private — so third parties can consume evidence without platform access.

The Decision Graph is a logical projection over immutable evidence, not a graph database. Initial implementation is relational metadata over S3-stored evidence. It records resources, Decision Evidence Records (linked resource sets for one decision), Context Bindings, evaluator outputs, outcomes, and attributable relationships — each with a status (confirmed, inferred, ambiguous, missing, conflicted) and evidence basis.

The initial view derived from the Decision Graph. Shows detected decision families, source coverage, policy and context coverage, relationship status, evidence gaps, and evaluator availability. Discovery is progressive: a customer sees an honest landscape from one source and can enrich confirmations incrementally.

A Context Binding says: policy P (version v) applied to subject S during window [t0, t1]. Verified fixes are evaluated against decision-time bindings so a certificate proves remediation under real recorded conditions — not under current settings.

An advisory indication that a declared cohort or repeated pattern warrants review. Each signal states its cohort definition, calculation method, time window, evidence coverage, supporting evidence, and limitations. A signal never establishes decision identity, causality, proof eligibility, or a gate outcome on its own — only an authorized reviewer's disposition confers that authority.

A single, explainable finding produced by an evaluator: what decision, why it was flagged, which node in the decision chain is failing, what the expected behavior is, and its evidence level. Advisory until an Authorized Reviewer records a disposition — advisory never self-promotes.

Across every domain, promotion of an advisory finding into the proof loop requires an Authorized Reviewer. Advisory signals, similarity, and clustering never establish identity, causality, or proof eligibility on their own. Only an authorized reviewer's approval (or an explicitly delegated deterministic rule) confers it.

The bridge deny-lists promotion unless evidence is E3/E4 AND an authorized review is recorded (or a deterministic delegation is explicitly configured). Fail-closed: unknown org, empty org, or missing review all deny. Re-derives evidence level from verified state rather than trusting the caller.

Replay re-executes an incident's captured calls under controlled conditions, answering each call from the sealed cassette by default. The replayed decision is compared to the original; matching means reproducible, differing means not-reproduced (recorded, never silently passed). Sandbox escalation is used only when a fix introduces calls the cassette cannot answer.

Mutation Testing verifies a customer-supplied fix by re-running the exact replay with the fix applied, against the decision-time context bindings and a customer-approved Expected Correct Behavior. For non-deterministic decisions, N-sample verification with a confidence threshold is used and clearly disclosed. A verified fix also runs against a confirmed no-regression cohort where available.

Mutation testing compares the fixed decision to a customer-supplied Expected Correct Behavior with recorded provenance. If it's missing, the mutation test is rejected. This is the boundary that keeps Notary a verifier, not an arbiter of AI safety.

The certificate documents the reproduced incident, the applied fix, the replay method (bit-deterministic vs sampled), the verified outcome, the claim scope, decision-time context, tool versions, and disclosed limitations. Signed with an asymmetric key so a third party can verify without platform access. On main, signing is dev-HMAC — asymmetric KMS lands in Stage 3 (WO-35), RFC 3161 timestamping in WO-36.

Every certificate carries a Known Limitation: cryptographic sealing establishes non-tampering after capture, not that the captured evidence was accurate or complete at the time of capture. Included regardless of Evidentiary Class. Honest bounded claims survive litigator cross-examination; overclaims do not.

A Scenario references the source Incident's sealed Response Cassette; it never copies or mutates it. Expected Outcome comes from the verified corrected decision (mitigated) or the original recorded decision (reproduced only). Scenarios are the compounding regression asset that documentation and monitoring tools lack.

A Readiness Policy is the Scenario set an agent version must pass before release. The Release Gate runs the policy and returns pass / fail / system error, distinguishing a failing scenario from a system-level break. On success, a Proof of Readiness certificate is issued.

Every gate that could leak evidence, promote advisory to proof, or cross a tenant boundary defaults to deny. Empty caller org, empty record org, mismatch, or missing prerequisite all deny with the server reason surfaced. Fail-closed enforcement lives at the tenancy chokepoint, not scattered across routers.

Sealed evidence is immutable. Review transitions and proof events are stored as append-only transitions in the Immutable Log; any status query is derivable from those transitions. A duplicate ingestion is quarantined, never merged over the original.

Notary's credibility rests on the advisory boundary: a systematic signal is never an Incident, and a candidate is never a proof claim. Only an Authorized Reviewer's disposition — or an explicitly declared deterministic delegation — promotes advisory to proof. Zero-instances-crossed is a hard invariant, not a target.

There is one way for a finding to become a signed certificate. Experiments and branching support diagnosis but never generate a certificate; a promising experiment must be promoted through Mutation Testing to receive certificate-grade verification.

Every record carries an org_id and environment_id. Every fetch, list, and mutate re-checks caller vs record. On main, some by-id endpoints (setup.py) still leak; WO-23 removes that with a shared get_or_404(id, caller_org) helper. The Meridian demo runs as a single synthetic tenant precisely because real isolation is not yet fail-closed everywhere.

On certificate issuance, an integration creates a GRC Incident Record, attaches forensic evidence, and maps it to framework requirements (EU AI Act, NIST AI RMF, SEC, OCC). Push and certificate lifecycle are tracked independently; failures retry with backoff (5s, 30s, 3m, 30m) up to 24h, then require manual retry.

Deployer duties include per-decision log retention and reproducibility (Art. 12), risk-management (Art. 9), data governance (Art. 10), and human-oversight evidence (Art. 14). Notary produces the reproduce-and-fix artifact these obligations increasingly demand.

The NIST AI Risk Management Framework organises AI risk into govern/map/measure/manage functions. Notary evidence naturally supports MEASURE-2.11 (impact and disparities), MANAGE-2.3 (fixes verified), and related decision-quality subcategories.

The SDK captures only workflow elements that affect a decision, explain a failure, or verify a fix: model invocations, retrieval events, MCP tool calls, guardrail results, human actions, business side effects, and release context. Each element records kind, timestamp, payload, and its relationship to prior elements where known.

The beachhead buyer. Under emerging obligations, the vendor is primarily responsible for generating decision-level evidence — and their customers' procurement now demands it as a condition of closing. Notary arms them; the pain is revenue-blocking today, not audit-eventual.

The CCO, GC, and domain reviewers accountable when a specific decision is challenged. Notary lands via the vendor relationship and the buyer's own contestability/audit needs, complementing (never replacing) their GRC platform.

As of 2026, insurers make coverage terms contingent on verifiable evidence of decision quality and remediation. When Notary's evidence package becomes a format insurers underwrite against, the product stops being a tool and becomes a trust layer — a network effect nobody in the supply chain can rip out.

Single source of truth for feature-gating. Free: SDK capture and local verify. Professional: platform ingestion, replay, mutation, certificates, one GRC connector. Enterprise: unlimited connectors, custom framework mapping, KMS custody, retention residency. Quotas are configurable; the tier boundaries are fixed.