Glossary
Chain of custody
The continuous trail that demonstrates a piece of evidence came from where it is claimed to and was not altered at any point along the way.
- Evidence chain
Every step in the chain needs three things: an author, a date and a describable transformation. “Exported from the console”, “filtered to the audited period”, “electronically signed” are describable transformations. “The report was prepared” is not.
The chain breaks more easily than people expect. Downloading a log to a laptop, opening it in a spreadsheet, sorting columns and saving the result already introduces a point where nobody can distinguish an accidental edit from a deliberate one. Keep the original intact and treat any derivative as exactly that: a derivative.
Language models add a new problem, because they are not deterministic and the step cannot be reproduced by running it again. The practical rule is that the model may read and propose, but evidence is always generated in the source system — and who reviewed the proposal, and what they changed, is recorded.