Verification: what did the check establish?
Verification checks a specified property under specified rules. Depending on the system, that property might concern a signature, a hash, inclusion in a log or a proof of computation. The useful output names the property, the inputs and the assumptions of the check. The word verified on its own leaves too much unspecified.
A signature check can establish that particular bytes satisfy the verification relation under a particular key. A further claim about the source requires grounds for the key binding. A claim that an event described by those bytes occurred needs its own evidentiary basis. Cryptographic verification is valuable precisely because its result can be stated exactly.
Appraisal: what follows about the claim?
Appraisal examines whether identified evidence supports a specific claim under stated premises. It considers what was observed, constituted or proved; the relationship to the exact subject or action; and the control and observation conditions that matter to the conclusion. A valid artifact may be an input to this assessment without settling it.
Consider a laboratory report. A file-integrity check addresses the report's bytes. The claim that a sample met a measured threshold also depends on the measurement process and the connection to that sample. Extending that finding to every future production batch requires additional grounds. The same distinction applies when a software trace is used to support an execution claim.
Reliance: is this basis sufficient to act?
Reliance is the decision to use a finding for a purpose. A purchaser, researcher or operator may need a particular level of assurance, additional evidence or a response to uncertainty. Those requirements belong to the decision context. An appraisal that supports a narrowly stated claim does not by itself authorize a payment, establish compliance or determine an acceptable risk.
A decision may also proceed when the evidence leaves a question unresolved. If so, the policy and responsibility for that choice should remain visible. Recording a decision does not retroactively strengthen the evidence on which it was made.
Preserve the distinctions in the report
CBEE separates whether an assessment was performed from what it found. When it ran, the evidence may support the claim, fail to support it, or support its negation. When it did not run, no finding follows from that status. An input may be unverifiable for this evaluator with the evidence available at that time.
A supported invocation claim can remain alongside an unsupported execution claim. It should not disappear into a single failed badge. Equally, not evaluated must not become refuted in a summary. These are reporting distinctions, not a universal result-code format.
- Name the check and the evidence actually evaluated.
- State the claim, premises and appraisal context.
- Preserve who performed the appraisal when results are reused.
- Keep the decision policy separate from the evidentiary finding.