DDR-1 — The Defensible Decision Record

Valid time	When the fact held in the world	Distinguishes a stale fact from a false one
Transaction time	When the system recorded the fact	Establishes what could have been known
Decision time	When the conclusion was issued	Fixes the coordinate for reconstruction

Collapsing these to a single timestamp is the most common and most damaging defect in deployed systems. A record MUST carry all three.

5. Required content

A conformant record MUST contain the following.

5.1 Identity

record_id — stable and unique. decision_time — when the conclusion was issued, with timezone.

5.2 Claim

claim — the conclusion, stated so that a non-specialist can evaluate it. disposition — the action recommended or taken. authority — the scope the decider was permitted to decide within.

5.3 Temporal coordinates

transaction_horizon — the latest transaction time of any evidence the decider could see. valid_window — the period in the world the claim concerns.

5.4 Evidence

For each item: a content-derived evidence_id; source; source_version; recorded_at; valid_from and valid_to where known.

Evidence MUST be addressable and MUST NOT be mutable in place. Where two items derive from a common upstream source, that relationship MUST be recorded — correlated evidence treated as independent inflates confidence without adding information.

5.5 Inference

rationale — the argument from evidence to claim, in language a reviewer can dispute. method — the deciding model or rule, with version and any parameters affecting output. load_bearing — which evidence items the conclusion depends on, distinguished from those that merely corroborate.

5.6 Alternatives

considered — conclusions examined and not adopted. rejected_because — the reason for each.

A record that reports only what was concluded, and never what was ruled out, gives a reviewer no way to assess whether the decider looked in the right places.

5.7 Falsifiers

would_change_if — the conditions under which this conclusion would not hold, stated at decision time rather than reconstructed afterward.

5.8 Confidence

confidence is OPTIONAL. Where present, it MUST carry calibration_reference identifying the measurement establishing what the value means: the population, the period, and the observed outcome frequency.

An uncalibrated confidence value MUST NOT be recorded. It is not an estimate, and its presence misleads.

5.9 Actor

decider — human, automated, or composite, with the delegation under which it acted. reviewed_by where a human affirmed, modified, or overrode the conclusion.

5.10 Supersession

Records are append-only. A correction is a new record carrying supersedes; the superseded record MUST remain retrievable. Retraction of evidence is a new assertion, never a deletion.

6. Conformance levels

L1 — Recorded.

Sections 5.1, 5.2, 5.4, 5.10. The decision, its evidence, and its immutability. A reader can see what was decided and on what.

L2 — Reconstructable.

L1 plus 5.3 and 5.5. An independent party can rebuild the knowledge state at decision time and re-derive the conclusion.

L3 — Contestable.

L2 plus 5.6, 5.7, 5.8, 5.9. A reviewer can argue with it — identify what was missed, what would change it, and who is accountable.

L2 is the minimum for any decision subject to regulatory review. L3 is the minimum for any decision that materially affects a person.

7. The reconstruction test

The single criterion by which conformance is judged:

Given only the decision record and the evidence store, an independent party who was not present MUST be able to rebuild the knowledge state as of decision_time and re-derive the recorded conclusion — without access to any evidence recorded after transaction_horizon.

If later-arriving evidence is required to explain the decision, the system is not conformant. If the reconstruction produces a different conclusion, either the record is incomplete or the method is non-deterministic; both MUST be disclosed.

8. Anti-patterns

The bare score. A record consisting of a number and a disposition. Not reconstructable, not contestable, not conformant at any level.
The single clock. One timestamp doing the work of three. Late-arriving evidence makes past decisions appear negligent.
Deletion on retraction. Removing discredited evidence, which silently falsifies every record that relied on it.
The moving model. A method field naming a model without a version, where the deployed model has since changed.
Independence by assumption. Multiple signals from one upstream source counted as separate corroboration.
Retrospective rationale. A justification composed after the outcome was known.

9. Open questions

Comment is invited on the following.

Whether rationale requires a structured form, or whether natural language is sufficient given that reviewers are human.
Whether L3 should require a stated confidence, or whether requiring calibration when present is enough.
How to represent decisions where the decider is a chain of automated agents, each conditioning on the last.
Whether would_change_if can be validated automatically, or is inherently a matter of judgment.
Whether non-determinism should bar L2 conformance or be disclosable within it.

DDR-1 is a working document and will change. It specifies requirements, not implementations, and no conformant implementation is described here. Comment to phil@philpierce.com.