Decision Control vs. Evidence Control
A new wave of enterprise platforms emphasizes evidence: trace-native observability, signed artifacts, and runtime guardrail records. Evidence is essential—but it is one phase of control, not the whole architecture. A signed record of an unauthorized action is still a record of an unauthorized action. DecisionHypervisor begins where evidence layers end: with a deterministic pre-execution determination of whether the action may proceed at all, followed by cryptographic evidence of that determination.
What Evidence Control Layers Does Well
- Trace-native telemetry and signed artifacts
- Runtime guardrail records
- Audit-ready evidence packaging
- Provenance for model and data lineage
- Enterprise distribution and installed base
Where the Category Stops
- Evidence is retrospective: it proves occurrence, not authorization
- Guardrail records show a check ran—not that a deterministic authority decision gated execution
- No decision states: nothing is escrowed, modified, or denied at the authority level
- Evidence of a bad action does not prevent the next one
| Dimension | Evidence Control Layers | DecisionHypervisor |
|---|---|---|
| Primary question answered | Can we prove what the system did? | Can we prove it was authorized—and stop it if it wasn't? |
| Position of evidence | The end product of execution | The byproduct of a pre-execution decision |
| Unauthorized action outcome | A signed record of the incident | No incident: the action never executes |
| Evidence contents | Traces, artifacts, guardrail outcomes | Decision Object, authority lineage, policy version, context snapshot, signatures, outcome verification |
| Replay capability | Review of recorded traces | Bit-exact reconstruction and counterfactual simulation of the decision |
The DecisionHypervisor Difference
- Every evidence package begins with a pre-execution authorization decision
- Six explicit resolution states govern the action before it can execute
- Evidence includes authority lineage, policy version, context snapshot, and reviewer signatures—not just traces
- Deterministic replay can reconstruct and re-simulate the decision behind any evidence record
- Fail-closed design: missing authority produces denial, not a signed log of an unverified action
Evidence platforms remain valuable downstream consumers: DecisionHypervisor's signed decision records, intervention logs, and replay outputs feed directly into evidence, audit, and GRC pipelines.
"Thesis: Evidence proves what happened. Decision control determines whether it may happen."
Request Enterprise Briefing