Guarantees
Four sentences. Everything else exists to make one of them true.
These four are the whole contract between this system and the person reading its output. They are written to be falsifiable: each one names the behaviours it forbids, is illustrated by a case that actually costs something to get wrong, and ends in a short list you can hold us to without our help.
how to break one
- 01You find one company under two identifiers, or two companies under one.
- 02You find a client-visible value with no sentence behind it.
- 03You find an empty cell on a surface a client reads.
- 04You cannot reproduce a brief we produced, as of the date we produced it.
Any of the four would be a defect in the product, not a limit of it. We would like to be told.
Index
Four guarantees, one concrete consequence of each
- 01One canonical record per real thingA supplier that changed its name twice keeps one identifier; the two former names still resolve to it.read
- 02A cited, verbatim, dated source behind every valueA phase reads Phase 2 because a registry record version 9, read on 11 March 2026, says so in those words.read
- 03Unknowns declared, never blankA readout date with no published source reads not found, and lists the four sources searched and the dates.read
- 04Any past state reproducibleThe brief you sent in March can be reproduced in September, with the source each line rested on then.read
One canonical record per real thing
A company, a person, a facility, a program, a contract: each has exactly one record, whatever it has been called. Former names are kept. Records that relate are linked rather than folded together, because merging two real things falsifies both.
Five grooves, machined separately, meeting at one point. A company arrives through as many channels as it has names, spellings and registrations. What they converge on is one record, and it does not move when a name changes.
what it rules out
- Two records for one company because two sources spell it differently.
- One record for two companies because they share a name, a director or an address.
- An identifier that changes when a company is renamed, breaking every reference to it.
- A former name deleted on the day a new one is adopted.
a worked example
Two companies, one trading name
caseTwo entities in different jurisdictions traded under the same name, shared a director and used the same registered agent. Merging them would have summed an exposure that belongs to two counterparties; treating them as unrelated would have hidden the connection. The record holds two entities, relates them, states the basis of the relation, and prints the names each is known by with the source and date of each. A name is evidence about identity. It is never identity.
the guarantee operating
Halden Pharma AG
Supplier master extract, contract of 3 Sep 2021, read 6 Mar 2026.
Halden Therapeutics AG
Annual report 2025, cover page, read 6 Mar 2026.
One record for two real companies, because a name matched. The arithmetic on the surviving record is then faultless and about nobody.
Two records for one real company, because two sources spell it differently. Half the evidence is then attached to a record nobody reads.
what you can hold us to
- Every record has one identifier that survives every rename.
- Every name a record has been known by is retained, with the source and date it was observed.
- Where two records are related rather than merged, the relation is stated and can be read back.
A cited, verbatim, dated source behind every value
Every value points at the sentence it was read from, quoted word for word, with the page or address, the date it was observed, and a retained copy of the document. A paraphrase is not a citation and is not accepted as one.
One thread, pulled straight across a sheet held flat. That is the distance between a value and the sentence that asserts it: no summary in between, nothing to interpret, and both ends visible at once.
what it rules out
- A value with a source name but no sentence.
- A citation to a page that has since changed, with no retained copy of what was read.
- A summary of a document standing in for the document.
- A date of retrieval standing in for the date the source states.
a worked example
The sentence, not the source name
caseA pipeline page and a February presentation named different lead programs. Both are real sources; only one contains a sentence that asserts the value. The record carries the value with that sentence quoted verbatim, the slide it appears on, and the date it was read, and keeps the retained copy of the deck. The competing value stays on the record with its own sentence and its own date, and a single line saying why it was not carried. A reader who disagrees can see exactly what to disagree with.
the guarantee operating
as most systems emit it
lead program
HLD-204
Source: Halden Therapeutics pipeline page.
- no sentence: nothing asserts the value in words
- no locator: a site, not a page and a position on it
- no observation date: current as of nothing in particular
- no retained copy: the page has since been edited
as the record emits it
lead program
HLD-204
“HLD-204 remains our lead program and entered Phase 2 in January 2026.”
- locator
- Investor presentation, 12 Feb 2026, slide 7.
- observed
- Read 6 Mar 2026; the deck is retained exactly as read.
- verified
- The excerpt is checked character for character against the retained copy, not against a summary of it.
- competing
- The pipeline page named HLD-118 on 6 Mar 2026. That value stays on the record, with its own sentence, its own date, and one line saying why it was not carried.
what you can hold us to
- Every value on a client-visible surface has an excerpt, a locator and an observation date.
- The document behind an excerpt is retained as it was read, and the excerpt is verified against it.
- Where sources disagree, the competing value and the grounds for not carrying it are shown, not suppressed.
Unknowns declared, never blank
Where there is no evidence, the record says so in words: not found, blocked, or not applicable, each with a reason and the record of what was searched and when. An empty cell is never emitted, because a blank reads as a negative.
The recess was cut deliberately, finished, and left empty. A declared unknown is made the same way: it is a thing the record did, on a date, with sources named, and not a cell nobody reached.
what it rules out
- A blank cell that a reader will take as a no.
- An empty query result exported as a negative finding.
- A licensed source the reader cannot open, silently omitted rather than named.
- A value inferred from an absence, such as reading no published headcount as a small company.
a worked example
Absence is not evidence
caseA registry publishes an estimated primary completion date. That is not a readout date; it is a different quantity. The record could have carried it and been approximately right most of the time. Instead the readout date reads not found, with the four sources searched and the date each was searched, and the registry's estimate stays where it belongs, as a different property. Separately, a characterisation held in a journal the reader is not licensed to open reads blocked, naming the source and the policy, so nobody mistakes a restriction for an absence.
the guarantee operating
a blank cell
primary readout date
A reader takes this as a no. Nothing in it distinguishes we looked and found nothing from nobody looked, and nothing records the day either happened. This is the cell the guarantee forbids.
a declared not-found
primary readout date
Not foundnot found
Four sources searched on 6 Mar 2026: the registry record at version 9, the investor presentation of 12 Feb 2026, and two journal indexes. None of the four contains a sentence asserting a readout date. The registry’s estimated primary completion date is a different quantity and stays on its own property.
a declared block
mechanism characterisation
Blockedblocked
The value is held in a journal this reader is not licensed to open. The source is named, the policy that withholds it is named, and the block is dated, so a restriction on the reader is never mistaken for an absence in the world.
what you can hold us to
- No client-visible cell is ever empty; each is a value or a named negative with a reason.
- A negative carries the sources searched and the date of the search.
- A value withheld under a source licence or a reader clearance is labelled as withheld and attributed, not omitted.
Any past state reproducible
Nothing is overwritten. Every value carries the date it was observed and the date it entered the record, so the record as it stood on any past day can be reproduced and read again, together with the sources that supported it that day.
Two casts of one object, both kept, one carrying a seam where it was changed. Neither was destroyed to produce the other, which is the only condition under which a past state can still be read.
what it rules out
- A value quietly replaced when a source is re-read.
- A corrected record that no longer shows what it said before the correction.
- An export that cannot be tied to the state of the record at the moment it was produced.
- A retained document rewritten to match a later rename.
a worked example
Three years later, the file still reads correctly
caseAn award was challenged three years after it was made. The supplier had moved twice, changed its registered name, and the registry page read at the time no longer existed. The file did not need the live registry. It carried the retained extract, the date it was read, and the value as of that date, and the reviewer could reproduce the record exactly as the awarding officer saw it, including the exclusion-list check that returned nothing and the version of the list it was checked against.
the guarantee operating
Neither state was overwritten to produce the other. The March entries are still in the record at their own dates, with the registry version and the deck each rested on that day; the August readings were entered beside them and say what they supersede.
what you can hold us to
- Every value carries both an observation date and the date it entered the record.
- A correction is an additional entry; the superseded value remains readable.
- Any export can be reproduced as of its date, with the sources that supported it on that date.
Lineage
Where each guarantee comes from
None of the four is new as an idea. Each takes a long-standing result from the research literature and makes it a property a reader can check on a record.
One canonical record per real thing rests on record linkage, which has treated sameness as a decision with stated error rates since the 1960s [1], and on the practitioner account of matching, comparison and classification [2].
A cited, verbatim, dated source behind every value is the data-provenance question of why and where a value came from [3], in the vocabulary the web settled on [4], with attribution defined as whether a statement is supported by the source attached to it [5].
Unknowns declared, never blank refuses the closed-world convention that whatever is not stored is false [6], and keeps what fact-verification benchmarks call not enough information apart from a settled no [7].
Any past state reproducible uses the distinction temporal databases draw between the time a fact holds and the time it is recorded [8], which the SQL standard adopted in 2011 [9].
Limits
What none of the four promise
Four guarantees are worth having only if their edges are drawn. Each of the following is something a reader might reasonably expect from the list above and will not get, and each is a property of the world rather than a gap we intend to close.
- 01that the source was right
A guarantee binds a value to what a named document says, not to whether that document is correct. A registry can publish an error and the record will carry it, quoted and dated. What you gain is the ability to see precisely which document to disbelieve, and on what day it said so.
- 02that the search was exhaustive
A declared not-found names the sources searched and the day each was searched. It does not claim that no source anywhere holds the value. A search is bounded by the sources your own policies admit, and the record states those bounds rather than quietly implying there were none.
- 03that a value is current
Every value carries the date it was observed, and that date is the only currency claim being made. A figure read in March is a March figure in September. The record will tell you when it was last read and by what route; it will not pretend that nothing has moved since.
- 04that the record is complete
A record holds the properties somebody defined, each with evidence behind it. A property nobody asked for is simply not there, and not there is not the same as none. Coverage is a decision your organization makes and can read back; it is not something the four guarantees supply.
A guarantee that covered any of the four would be a claim about the world rather than a property of the record, and we would have no way to let you check it. These are the limits that make the other four worth stating.
References
References
The works named under Lineage, each linked to its published record.
- [1]
Ivan P. Fellegi and Alan B. Sunter
Journal of the American Statistical Association 64(328), 1969, pages 1183-1210. https://doi.org/10.1080/01621459.1969.10501049
- [2]
- [3]
Why and Where: A Characterization of Data Provenance
Peter Buneman, Sanjeev Khanna and Wang-Chiew Tan
International Conference on Database Theory (ICDT), 2001. https://doi.org/10.1007/3-540-44503-X_20
- [4]
Luc Moreau and Paolo Missier, editors
W3C Recommendation, 30 April 2013. https://www.w3.org/TR/prov-dm/
- [5]
Measuring Attribution in Natural Language Generation Models
Hannah Rashkin, Vitaly Nikolaev, Matthew Lamm, Lora Aroyo, Michael Collins, Dipanjan Das, Slav Petrov, Gaurav Singh Tomar, Iulia Turc and David Reitter
arXiv, 2021; Computational Linguistics 49(4), 2023. https://arxiv.org/abs/2112.12870
- [6]
Raymond Reiter
In Logic and Data Bases, Plenum Press, 1978, pages 55-76. https://doi.org/10.1007/978-1-4684-3384-5_3
- [7]
FEVER: a Large-scale Dataset for Fact Extraction and VERification
James Thorne, Andreas Vlachos, Christos Christodoulopoulos and Arpit Mittal
NAACL-HLT, 2018. https://aclanthology.org/N18-1074/
- [8]
Developing Time-Oriented Database Applications in SQL
Richard T. Snodgrass
Morgan Kaufmann, 2000 (author-hosted copy). https://www2.cs.arizona.edu/~rts/tdbbook.pdf
- [9]
Krishna Kulkarni and Jan-Eike Michels
ACM SIGMOD Record 41(3), 2012. https://doi.org/10.1145/2380776.2380786
Further reading
Articles on this page’s subject.
Merge or Relate? A Framework for Organization Records
A decision tree for when organization records share one identity and when they need a typed link instead, tested on five synthetic cases.
Minimum Data Provenance Requirements for Defensible Values
Fifteen minimum provenance fields and five audit questions, mapped to PROV-O, with temporal rules, declared unknowns and validation tests.
Open World Assumption: Why Unknown Is Not False
Open-world negation, explicit negative knowledge and five epistemic states, with the evaluation protocols that keep an unknown from being scored as false.
Bitemporal Data vs Temporal Knowledge Graphs: A Guide
Bitemporal records against temporal knowledge-graph research: snapshot replay versus link prediction, their benchmarks, and when to combine them.
Next
The guarantees are checkable. Check them.
Each of the four is a property of a record you can read, not a claim about a roadmap. The fastest way to test one is to bring an entity your own teams describe inconsistently and read what comes back.