What a timestamp promises

A timestamp is the field nobody reads. It sits in the margin of the document, in the corner of the log line, at the end of the row, and the eye slides past it on the way to the content that seems to matter. We treat it as bookkeeping — a clerical detail attached to the real claim, the way a postmark is attached to a letter. But a timestamp is not bookkeeping. It is a claim in its own right, and it is doing more work than any other claim in the record, because it is the one the others stand on.

Consider what a timestamp actually asserts. It says: this happened, and it happened then, and — crucially — it happened in a particular relation to everything else in the record. It is a statement about order. And order is not decoration laid over the facts; it is part of what the facts mean. The same observation, the same approval, the same warning carries one meaning if it arrived before a decision and a different meaning if it arrived after. Move the timestamp and you have not adjusted a detail. You have changed the story while leaving every word of it in place.

This is why a timestamp is so easy to underestimate and so dangerous to get wrong. It does not contradict the rest of the record. It does something quieter and worse: it silently determines how the rest of the record is to be read. A false timestamp does not announce itself as a lie. It lets every true statement around it tell a false story.

Order is meaning

Take the most ordinary example. A risk was flagged. A decision was made. If the flag is timestamped before the decision, the decision-maker either ignored a known risk or judged it acceptable — and is accountable for that judgment. If the flag is timestamped after the decision, the risk was unforeseeable at the moment that mattered, and the same person is simply unlucky. Two records, identical in content, opposite in what they prove. The only thing standing between those two readings is the ordering of two timestamps. If you cannot trust that ordering, you cannot adjudicate the case at all; you can only pick the story you prefer and dress it in whichever sequence supports it.

The point generalizes. Almost every question we ask of a record is, underneath, a question about order. Did the diligence precede the commitment, or follow it to justify a decision already made? Was the disclosure made before the harm or after it? Did the model see this input before it produced that output, or has the input been backfilled to make a bad result look reasoned? In each case the substance is not in dispute. The sequence is. And the sequence lives entirely in the timestamps, which means the entire weight of the account rests on a field we habitually treat as the least important one present.

You are never only asking what a record says. You are asking when it knew it — and a record that cannot answer that has not told you the truth, only arranged it.

Trustworthy time is infrastructure

If time carries this much weight, then where the time comes from is not a minor implementation choice. A timestamp written by the same party who benefits from how it reads is not evidence of when; it is testimony, and self-interested testimony at that. A timestamp that can be revised after the fact without leaving a trace is not a record of order; it is a draft of order, editable until someone needs it to say something. The question that matters about any timestamp is not what it reads but whether it could have been made to read otherwise — and by whom, and with what difficulty, and whether the act of making it read otherwise would show.

This is what it means to treat trustworthy time as infrastructure rather than metadata. Metadata is the stuff you record about the thing; you can change it and the thing remains. Infrastructure is the stuff the thing depends on; if it fails, everything resting on it fails with it, often silently. A timestamp is the second kind. When the when of a record is captured at the moment it happened, bound to the content so it cannot be detached and reattached, and ordered against everything else in a way no single party can quietly rewrite, the record gains a property that no amount of careful prose can supply: it can locate itself in time against challenge. That is the difference between a record that asserts an order and one that can defend it.

A Decision Receipt that carries the capture-time of each input, and the sequence in which those inputs arrived, is not adding ornamental precision. It is making the one claim on which all its other claims depend into something that can be examined directly instead of taken on faith. Provenance is usually discussed as a question of source — where did this come from. But source without sequence is incomplete. Knowing where a fact came from tells you little if you cannot also establish when it arrived relative to the decision it supposedly informed. The chain of custody is a chain precisely because it is ordered; cut the ordering and you have a pile, not a chain.

So the next time you find yourself trusting an account — a log, a file, an explanation of how a decision was reached — notice the field you were about to skip. Ask not only what it says but whether you have any reason to believe its when. If the time was recorded by an interested party, after the fact, in a form that could be revised without anyone the wiser, then you do not have a record of what happened. You have a record of what someone, at some later moment, found it convenient to have happened in that order. The timestamp promised you the truth about when. It is worth checking, every time, whether it was in any position to keep that promise.

— Dispatches · Summit Cognitive