Sign every decision

Suppose you have done the harder work already — you instrument the decision, not just the model, and each consequential act leaves behind an account of the inputs it rested on, the policy in force, and the moment the score became a verdict. You have the record. Now ask a narrower and more uncomfortable question: what stops that record from being different tomorrow than it is today? In most systems the answer is nothing structural. The record lives in a table, or an object store, or a log index, and anyone with write access to that store — a migration script, an admin console, a bug, a person under pressure — can change what it says, and change nothing else. The row updates. No trace remains. The record still reads as an account of what happened, and it is now an account of what someone decided it should say.

That gap is the whole subject of this directive. A record that exists is not the same as a record that can be trusted, and the difference is not diligence or good intentions. It is a property you either build into the record at the moment of creation or do not have at all. Sign each decision as it is made — bind its contents cryptographically to the time and the author — so that any later alteration is detectable and the record's origin is provable. That is the line between notes you keep and evidence you can stand behind when the decision is challenged by someone who does not trust you and has reason not to.

The record anyone can revise

Consider what a mutable record actually proves when the decision it describes is disputed. A year after the fact, the affected party asks why they were refused, and you produce the record: here are the inputs, here is the rule, here is the outcome. It looks complete. But the challenger asks the question that a mutable store cannot answer — is this what the record said at the time, or is it what the record says now? You believe it is unchanged. You may even be right. What you cannot do is demonstrate it. The store that holds the record is the same store you or your colleagues can write to, and it keeps no independent memory of its own prior states. The record's own editability is fatal to its standing: not because it was in fact altered, but because it could have been, invisibly, and nothing in the artifact rules that out.

This is the failure mode teams walk into by default, because the default storage for a decision record is ordinary storage, and ordinary storage is built for the current value, not the historical truth. The convenience that makes it a good database — you can update a row in place — is exactly the property that disqualifies it as evidence. Against a casual reader, a mutable record is fine; it is only ever read once and never contested. Against a determined challenge, it proves nothing, because every claim it makes about the past is a claim the custodian could have written this morning. A record that can be quietly changed does not certify what happened. It certifies what the party holding it currently wishes to assert, which is a different and much weaker thing.

Signing turns a log into evidence

A cryptographic signature closes that gap by binding the record's contents to a moment and an author in a way that later editing cannot survive undetected. The mechanism is public and well understood, and you do not need to reproduce it to use it: signing computes a value over the exact bytes of the record such that changing any of those bytes breaks the signature, and such that only the holder of a particular private key could have produced it. Bind that to a trustworthy timestamp and you have an artifact that answers the challenger's question. Tampering becomes detectable — a single altered field fails verification. Origin becomes provable — the signature could only have come from one signer. The record stops being a story the custodian tells and becomes a claim the custodian cannot revise without leaving a mark.

The imperative is specific about when and over what. Sign at the point of decision, not in a nightly batch that leaves a window in which the record is still soft. Sign the contents that matter — the inputs the decision used, the policy and version in force, the outcome, and the timestamp — as one bound object, so the signature covers the actual basis of the act and not a summary of it. Where the stakes warrant, do not stop at a self-signature the author could later reissue against a backdated clock; anchor the signature to something outside the signer's control — an independent timestamp, an append-only log, a published commitment — so that even the signer cannot silently move the record back in time and re-sign it. And verify signatures on read, every time, so that a broken chain surfaces at the moment someone relies on the record rather than years later in a dispute. A signature nobody checks is a lock nobody turns.

A record you can edit after the fact does not remember what happened; it remembers what you last decided it should say.

The honest hard parts

Signing is not a cure, and treating it as one is its own failure. A signature proves the record has not been altered since it was signed. It does not prove the record was true when signed. If the decision was captured wrong — the inputs mislabeled, the policy version stale, the outcome mis-recorded — signing binds that error into the artifact with the same rigor it would bind the truth. Garbage in still signs. The signature protects integrity, and integrity over a false record simply gives you a tamper-evident falsehood. This is why signing sits downstream of instrumenting the decision correctly, not in place of it: sign what you have taken care to capture accurately, and understand that the signature certifies custody, not correctness.

The second hard part is the one that actually sinks most implementations: key management. A signature is only as trustworthy as the control over the key that produced it. If the private key can be copied, borrowed, or quietly reused, then everything the signature was supposed to guarantee — that only this author, at this time, could have produced this record — dissolves, and you are back to trusting the custodian while believing you are not. Key custody, rotation, revocation, and the discipline of never signing with a key that has leaked are the real operational burden here, and they are where the property is usually lost. Budget for that work as the substance of the directive, not its footnote.

The third is subtler and easy to miss precisely because the cryptography feels like the hard part. Sign the right content. It is entirely possible to build a rigorous, well-managed signing pipeline over the wrong object — to sign a tidy summary while the actual inputs and the policy that governed them go uncovered, leaving you with unbreakable integrity over an artifact that omits the basis of the decision. A signature narrows what can be disputed to exactly what it covers. If it covers a caption and not the evidence, you have proven the caption. Sign the decision and its real basis — the inputs, the rule, the moment — because that is the thing a challenge will actually contest, and integrity over anything less is integrity over the wrong thing. Get those three right, and a log becomes evidence; get the cryptography right and the content wrong, and you have only signed your notes.

— Dispatches · Summit Cognitive