Evidence and decisions
Find out why an AI-related decision was made
A technical log may show that a request occurred. It does not necessarily explain why a route was allowed, why an action was refused or who approved an exception.
Current DUBSAR status
The principle is exercised in the private journey
The private DUBSAR flow already links human decisions to evidence and limitations. A continuous governance register supplied by production Gateway traffic remains under development.
Evidence and decisions
Retain what explains the decision
Useful evidence links a decision to the calling system, policy version, route, reason, time and available references. It also states missing information and scope limitations.
This makes a later review possible without suggesting that every prompt and response should be kept forever.
- System, workflow and responsible owner
- Policy and rule version
- Decision, reason and timestamp
- Human reviewer and unresolved limitations where applicable
Evidence and decisions
Evidence integrity is more than a long log
A larger log is not automatically better evidence. Records need stable identifiers, controlled access, clear provenance and integrity checks appropriate to the risk.
DUBSAR aims to produce decision records that can be exported and examined, while keeping the difference between observed fact, inference and human conclusion explicit.
Evidence and decisions
Minimise sensitive content by design
Traceability should not create a second uncontrolled copy of customer files or secrets. Metadata, digests, redacted excerpts and retention rules can often prove the decision without retaining the full payload.
The organisation remains responsible for deciding what must be kept, for how long and who may access it.
Frequently asked questions
What to know before going further.
Does traceability mean storing every prompt and response?
No. The evidence model should retain what is necessary to explain the decision and apply the organisation's retention and access rules.
Does a DUBSAR record prove legal compliance?
No. It can support a review by organising evidence, but it is not a certification or legal conclusion.
Read next
Continue with another DUBSAR guide.
The portal remains in private testing. These guides explain what DUBSAR is proving — and what it does not yet claim.