{"id":"pattern.evidenced-trust","slug":"trust-should-be-evidenced","type":"pattern","version":"0.1.0","maturity":"hypothesis","status":"published","title":"Trust should be explicit and continuously evidenced","summary":"Permit consequential action from current, scoped evidence rather than role, location, reputation, or a one-time approval alone.","audiences":["security","architect","agent-builder"],"relationships":{"supports":["pattern.boundaries-increase-agency","pattern.separate-access-experience-execution"],"contradicts":[],"depends_on":["pattern.source-of-truth-before-automation"]},"disclosure":"green","approved_by":["chrisleeddotcom"],"license":"CC-BY-4.0","created":"2026-08-21","updated":"2026-08-21","canonical_url":"https://intentarium.com/patterns/trust-should-be-evidenced/","source":{"repository":"https://github.com/Intentarium/canon","commit":"a8b303818e72c20505bd9ef56f5fb2d0448aa6f3","path":"patterns/trust-should-be-evidenced.md"},"body_markdown":"## Context\n\nA human, service, or agent requests access or authority in a system where conditions can change after initial authentication or approval.\n\n## Problem\n\nTrust becomes dangerous when it is inherited indefinitely from identity, network position, organizational status, or past behavior. The system cannot distinguish a still-valid decision from a stale assumption.\n\n## Forces\n\n- Rechecking every signal adds latency and dependency.\n- Static trust is simple to operate but ages silently.\n- Signals can be wrong, unavailable, or manipulated.\n- Different actions require different confidence.\n\n## Pattern\n\nDefine trust as a set of named signals with source, freshness, scope, and required confidence. Evaluate only the signals relevant to the requested action. Produce evidence of the evaluation and fail into a bounded state when confidence is insufficient.\n\n## Apply it\n\nFor each consequential action, list the identity, device, policy, approval, data-quality, or environmental signals required. State how recently each must be observed and what happens when it is missing. Separate authorization from the user experience used to request it.\n\n## Failure modes\n\n- More signals are treated as automatically better.\n- A missing signal silently becomes approval.\n- Trust policy cannot explain a denial.\n- Evidence is logged but cannot be associated with the exact action.\n\n## Evidence needed\n\nObserved reduction in unauthorized or unsafe execution without unacceptable increases in false denial, delay, or operator override."}