# Security evidence

Ordered records that someone outside the team can read. A research area, not a product.

> **Research area.** This is a research area, not a product. Where it mentions Vraelis Contour, it says what exists in the experiment and what is proposed.

## What we study

What a record has to hold.

- **What belongs in one observation?:** Approved identity, reported identity, policy result and arrival time.
- **How is missing evidence recorded?:** As unavailable, with a reason. Never as the last known state.
- **Can a reader tell a self-report from proof?:** Only if every record carries its scope.
- **How does a record stay in order?:** Discrepancies, gaps and recovery in one sequence, nothing hidden.

## What exists today

Recorded observations, in the experiment.

- **Working in the experiment:** Deployment evidence: four observations recorded in order, including evidence unavailable.
- **Working in the experiment:** Each keeps the approved identity, the worker's reported runtime identity and the policy result.
- **Working in the experiment:** Recovery verification: after one recorded explicit reload, the reported identity was compared again.
- **Working in the experiment:** The app refuses to import pending, missing evidence or wrong runtime observations as matched.
- **Proposed:** Recovery failure tests, specified but not run, and an investigation workflow.
- **Not claimed:** Independent attestation. Every record is a worker self-report.

![An observation's details in Vraelis Contour, with its reason code RUNTIME_UNAVAILABLE.](https://vraelis.com/v8/contour/app-observations-unavailable.webp)

*Read-only evidence app, inside the controlled ONNX reference experiment.*

## What is still open

- **Edited records:** An edited, self-consistent trace still validates today.
- **Evidence freshness:** Heartbeats that show a report is current, not stale. Not built.
- **Expected silence:** Telling a planned outage from a fault.
- **Reviewer effort:** Time for an outsider to reach a conclusion. Not measured.

## How it connects to Vraelis Contour

Draws on directly: Ordered observations, including unavailable evidence.

On vraelis.com: [Security evidence](https://vraelis.com/research/security-evidence), [Recorded observations](https://vraelis.com/contour#observations), [Government and institutions](https://vraelis.com/applications/government).

- [Model integrity](https://docs.vraelis.com/model-integrity): Whether the model that runs is the model that was approved.
- [Machine trust](https://docs.vraelis.com/machine-trust): Explicit identity, limited permissions and checks at execution boundaries.
- [Adversarial threats](https://docs.vraelis.com/adversarial-threats): Inputs, updates and supply paths built to change what a model does.

---

Vraelis documentation, Research. https://docs.vraelis.com/security-evidence