AI CORE / DOCUMENTATION

Results must be reviewable

A good record distinguishes what was actually performed, what was merely claimed and what cannot be assessed from the available evidence.

Minimum evidence trail

Each control needs a requirement identifier, exact profile version, assessment subject and snapshot, method, scope, result and limitations. A performed observation needs a time and supporting evidence. If a control was not performed, its execution time must not be invented. A public snapshot identifier must be internally traceable to a real state; an unverified link must be disclosed.

Result states

PASS

The documented method demonstrated that the criterion was met within the stated scope and time. It does not mean the whole system is secure.

FAIL

An observation demonstrated that the criterion was not met. Severity and impact are assessed separately.

NOT_TESTED

The control was not performed. A test plan or the existence of test source code is not a result.

NOT_APPLICABLE

The control does not apply to the scope. A specific justification is mandatory.

INCONCLUSIVE

Evidence is insufficient, conflicting or does not allow a result to be determined.

These are AI CORE contract states, not native codes of every source framework. A summary must also include untested items and exclusions; a single average or green indicator must not conceal them.

Provenance and independence

An operator statement, automated test output and independent assessment are different types of evidence. An automated observation may be sound, but it is not independent by itself. Independence is assessed from the assessor's role and relationship to the system.

Integrity, currency and history

SHA-256 helps check whether particular bytes changed. It does not establish truth, completeness, creation time or the author's trustworthiness. A signature may establish origin when its key is trusted; it does not replace content review. When the system changes, determine which results no longer apply and create a new assessment linked to the previous one.

Limited public evidence

A public output may substantiate only part of a control. If a complete test needs private evidence, state the boundary of public reviewability and how further information may be obtained with authorization. Redaction must preserve the meaning of the result and must not remove an adverse finding.