Witnessability / Examples / Three ordinary records

One record. Several possible claims.

These teaching examples separate what is observed, what the evidence can support and what needs an additional basis. They are illustrative cases, not reports of tests run on a real deployment.

01 / A signed payment request

The illustrative evidence set contains a signed request to pay an invoice and an acceptance receipt from the receiving service. Assume the receipt is authenticated, bound to this exact request and trusted as an accurate observation of receipt at that service. These are explicit premises of the example, not independently checked deployment facts.

Under those premises, the receipt supports the claim that the request reached the service. Signature verification separately addresses the signed bytes and key under its applicable assumptions. Neither finding alone establishes settlement. The assessed request and receipt supply no basis for a settlement claim; establishing settlement requires appropriate evidence and its binding to the particular transaction.

Useful next question: what did the payment service observe, and what connects its observation to this transaction?

02 / An unchanged archived document

An archive holds a document and a trusted earlier digest. The retrieved bytes match that baseline. Custody records may provide additional grounds about preservation.

This can support a scoped fixity claim. It does not by itself establish that the document was accurate when created, that its author was authorized to make its assertions, or that the archive received every relevant document. Authenticity, integrity and original accuracy are different questions.

Useful next question: which proposition concerns preservation, and which requires evidence about the original content or creation process?

03 / No matching audit entry

A search returns no records matching a particular operation. The result states the source, query, period and cutoff.

This is evidence about that search over that available set. A conclusion of non-occurrence additionally requires justified capture and coverage premises. If another source was unavailable, the report should retain that fact rather than summarize the result as “nothing happened”.

Useful next question: what would have made an occurrence observable in the searched scope, including under the applicable failure and threat models?

Read a result together with its basis

In each example, keep the proposition, evidence set and evaluation context attached to the conclusion. A supported finding on one question can remain useful while another question is unsupported or not evaluated. A decision about what to do next remains a separate policy and risk judgment.

Sources and next steps