Evidence before endorsement
The framework converts broad governance principles into controls that can be tested against an implementation and evidenced in an operating environment.
Development method
- Define the decision boundary. Begin with the conditions under which an answer may influence a business decision.
- Separate product from deployment. Mark whether an outcome is implemented in code, configurable, dependent on source controls, or owned by the operator.
- Write a falsifiable test. Every control includes a test that can fail.
- Name evidence. A control is not complete until a reviewer can inspect retained artifacts.
- Evaluate refusal. Include missing-data, missing-definition, denied-access and prohibited-action cases.
- Version the claim. Product mappings identify the reviewed commit or version and date.
Evidence hierarchy
Preference is given to public source code, reproducible tests, standards, specifications and official documentation. Vendor descriptions can establish intended behavior, but not that a particular deployment satisfies a control. Practitioner interpretation is labeled as such.
Status vocabulary
Implemented Public code and tests directly support the behavior. Supported The product can represent or enable the control, but operator configuration is required. Deployment responsibility The outcome depends primarily on infrastructure, identity, process or source-native policy.
Case-study scope
The Mnemiq mapping was reviewed against the public upstream repository at commit a08fe859c2ee38eb95f3239ee71a11e8f47b75ba on 15 September 2026. The review examined documentation and relevant public source paths. It was not a penetration test, live-model benchmark, database deployment audit or customer assessment.
Limitations
- The controls are a practical baseline, not a substitute for legal, regulatory or sector-specific analysis.
- A public repository review cannot establish the safety of an unknown deployment.
- Controls interact; passing one does not compensate for failure of another.
- Model, schema, data, policy and semantic changes can invalidate prior results.
- Sample questions are synthetic and must be adapted to real permissions and definitions.
Corrections
Corrections should identify the exact claim, the relevant version and a primary or reproducible source. Relationship disclosures must accompany contributed product examples.