Three states, and the distance between them is the product
The reason to name the states is that the collapse between them is where identity systems cause harm. A signal is not a person; a hypothesis is not a finding. Keeping those separate is an architectural decision, not a policy document.
| State | What it means |
|---|---|
| Observed | A raw signal with source attribution, timestamp and the collecting sensor recorded. A fact about a sensor reading, never, at this stage, a fact about a person. |
| Evidence weighting | Observations carry weight rather than being counted, with clustering and scoring deciding when a candidate has enough behind it. |
| Candidate | A hypothesis under evaluation, with merge and split as evidence changes, and contradictions surfaced rather than averaged away. |
| Human gate | An approval gate over the quarantine decision. Crossing a threshold produces a proposal, not a promotion. |
| Canonical | A promoted entity that has crossed its thresholds and passed its compliance profile, carrying its evidence chain with it. |
Evidence weighting
Observations carry weight rather than being counted. A bounded observation buffer, clustering and scoring decide when a candidate has enough behind it, and the weighting is inspectable rather than implied by a single confidence number.
Contradiction detection
Evidence that conflicts is surfaced as a contradiction rather than averaged away. A candidate supported by two sources that disagree is a different situation from one supported by two that agree, and the system distinguishes them.
A human gate before promotion
An approval gate stands over the quarantine decision. Crossing a threshold produces a proposal, not a promotion, which is the control an oversight body actually asks about.
A provenance chain
A Merkle provenance chain with continuity verification runs from the physical capture through observation, evidence accumulation, candidate modelling and promotion. Every step is attributed and timestamped.
Entity signature packages
A portable representation carrying identity attributes, confidence and evidence-chain hashes, but not the raw source observations. A receiving party can verify the package without being handed the sensor data behind it.
Forensics and compliance profiles
A compliance profile binds an engagement to the rules that govern it, and forensic tooling reconstructs how a given identity came to be asserted, which is the question that gets asked afterwards, under oath.
The controls sit on the path, not beside it
Identity work inherits the platform’s enforcement plane rather than re-implementing it. That is the difference between a policy a system reports on and a policy a system is subject to.
Compartments and clearance
Clearance labels with dominance comparison, a compartment registry and per-compartment key derivation. A denial says which rule refused it, using a typed refusal code rather than a generic error.
Minimisation on the write path
Personal-data detection runs where records are written, sensitivity labels propagate downstream through lineage, and masking is applied by the engine rather than by the application that happens to be reading.
Retention and legal hold
Retention enforcement, legal-hold records and classification-aware lifecycle rules, with a classification floor that refuses to move sensitive material automatically and fails closed on a label it does not recognise.
A hash-chained record, with gaps counted
Every operation writes into a tamper-evident chain, and a failed append is recorded as a first-class gap event, so a verifier can distinguish a known append failure from a removed row. An append-only file's absence proves nothing; a counted gap proves something.
Reads are audited too
A single read-audit chokepoint records observations into per-database trails with stable identifiers, so a retry is idempotent. Who looked is a first-class question here, not a log-parsing exercise.
Detections and forwarding
Identity operations land in the same detection engine as everything else, normalised to an open event schema, and can be forwarded to Splunk, syslog or a webhook behind a fail-closed gate, so a misconfigured forwarder stops rather than leaks.
Content provenance, stated by direction
Provenance claims are easy to overstate, so this one is split into the half that runs and the half that does not.
Runs today
Verification of inbound captures
Every sensor capture is authenticated against its signing certificate before it is trusted, reached from the sensor handler, the capture persister and the edge gateway. Unverified or altered content is quarantined rather than ingested.
Not claimed
Signing of outbound content
The manifest builder and encoders exist but nothing in production calls them, so we do not say we sign every observation. The exception is the edge: capture on a device feeds a tamper-evident hash chain with frame-level provenance signing at the moment of capture.
Sharing across cells and jurisdictions, without pooling the data
The hard requirement in multi-agency identity work is not sharing. It is sharing while every party keeps authority over what they contributed. Cross-organization traffic is authenticated with a key derived from the trust edge between the two parties, so revoking a partner means dropping an edge rather than rotating a cluster.
Originator control
Sharing is explicit rather than federated by default. The originating party's constraints travel with what they shared, in a signed envelope, rather than being re-implemented by the recipient.
Local gates on receipt
A receiving party applies its own compliance profile before ingestion. Nothing arrives pre-approved because it came from a trusted peer, arriving is not the same as being trusted.
Reaching the disconnected site
Where there is no link, signed offline bundles carry catalog, policy, model and intelligence material and are verified on import, never trusted because they arrived. The edge agent collects and reasons locally and reconciles when a link returns.
What we will not tell you
This capability is described, not graded. Nothing in System9 has completed the acceptance programme, and nothing is deployed, so there is no operational track record behind these mechanisms and we will not imply one. What we offer instead of references is verifiability: the mechanisms above are demonstrable in a room, and the ones with open gaps are named on this page rather than found during your evaluation.
For the domain packs that bind this capability to the rules that actually govern it, criminal intelligence systems, custody, intelligence dissemination, campus safety, emergency management. See public-sector capability packs.