evidence-protocol/1.1.0 · updated Jul 9, 2026

Verifiable evidence

How to record a fact with a date and make it queryable for audits and incidents.

Each record preserves what happened, when it happened, and the risk assessment behind it while protecting sensitive information and maintaining a reviewable history.

Evidence connects the applied defense with institutional review: it is the support needed to explain why a situation required special care or why an automated action was authorized.

Sealing evidence is not decorative. It closes the gap between observation, decision, and operational accountability.

Checklist

• Seal evidence when blocking, limiting, or escalating an incident.
• Store a summary that operations and legal review can understand.
• Link the record to the corresponding flow or incident.

Quickstart

1. Seal evidence whenever a measure changes system behavior.
2. Use a summary suitable for operators and institutional review.
3. Link the incident, task, or affected resource before closing the case.

Operational flow

Capture

Record the fact and the minimum context needed to make it understandable.

Do not rely on memory or informal conversation.

Seal

Store a hash, timestamp, and sufficient reference to verify integrity.

Preserve traceability and later retrieval.

Connect

Relate the evidence to incidents, certificates, tasks, or automations.

Avoid isolated proof without an operational history.

flowchart LR
  S1["Capture"]
  S2["Seal"]
  S3["Connect"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Validate the evidence workflow

Summarizes next steps and foundational articles for recording verifiable support.

Examples

Payload to seal evidence

{
  "summary": "Bloqueo temporal de ruta /api/login por presión coordinada.",
  "sourceModule": "login-shield",
  "riskLevel": "orange",
  "incidentId": "inc_demo_001"
}

Links and references

APIs

/api/adda/v1/evidence/seal
/api/adda/v1/evidence/[id]
/api/adda/v1/incidents

Docs and supporting routes

docs/ADDA_EVIDENCE.md
docs/ADDA_API.md

Common issues

• Storing evidence without relating it to the main flow makes it difficult to retrieve.
• Blocking without evidence can leave the organization without explainable support.

Suggested actions

• Connect evidence to certificates or packs if the case has a public outcome.
• Use evidence for positive decisions as well when they were especially sensitive.

Useful reason codes

Score dictionary

severity

Institutional priority of the signal on the ADDA scale.

action

Next operational step recommended by the engine.

reasonCodes

Explainable reasons that justify the assessment.

Protocol notes

• Evidence is the bridge between operations, audit, and governance.

Article history

Jul 9, 2026

Added a quickstart and operational payload for sealing.