RESEARCH
From AI security claims to bounded assurance.
Research examines whether technical and operational records can carry a defensible chain from requirement and control through evidence, provenance, verification and finding.
ODA3 / EVIDENCE SYSTEM↗
SOURCE → CLAIM
01
ORIGINPrimary, secondary, proxy or unverified
02
CHECKVerification against defined criteria
03
STATESupported · Partial · Gap · Unknown
A source tier is not an assurance conclusion.
RESEARCH PURPOSE
Make the evidence chain examinable.
A research question is defined by system, context, claim and available evidence. Findings should show what was observed, what was checked against defined criteria, and where the record stops supporting a conclusion.
01
Requirement
The obligation or question to be addressed.
02
Control
The operational condition or safeguard.
03
Evidence
The records offered for examination.
04
Provenance
Origin, context, system state and time.
05
Verification
Evidence checked against defined criteria.
06
Finding
What the examined record supports or leaves unresolved.
07
Bounded Assurance
A conclusion confined to the stated scope and limitations.
EVIDENCE SOURCING
Source tier describes origin, not usefulness.
Each publication should state the source basis appropriate to its claims. A tier does not by itself determine relevance, integrity or sufficiency for a particular assurance question.
SOURCE CLASS
T1 · Primary Verified
Primary material examined and verified against defined criteria.
SOURCE CLASS
T2 · Secondary Verified
A secondary record with attributable source and documented verification state.
SOURCE CLASS
T3 · Controlled Simulation / Academic Proxy
A controlled or proxy environment; generalization to deployment must be bounded.
SOURCE CLASS
T4 · Anecdotal / Unverified
Reported material whose underlying claim has not been verified against defined criteria.
Where the source tier cannot be established, default to T4 until the underlying basis is documented.
FINDINGS
Separate mapping state from assurance conclusion.
Supported, Partial, Gap and Unknown can describe an examined relationship under stated criteria. A report-level result may also be Inconclusive. None of these labels alone certifies a system or proves compliance.
Supported
The stated relationship is sufficiently evidenced for its scope.
Partial
Some elements are supported; material parts remain outside the evidence.
Gap
The necessary relationship or evidence is absent under the criterion.
Unknown
The available record cannot responsibly determine the state.
FROM RESEARCH TO SPECIFICATION
A supported finding can inform a versioned control.
Research publications identify the source window and evidence cutoff where relevant, the basis for a finding, its limits and the resulting implementation question. A proposed control or mapping change then receives its own rationale, review and versioned publication record.
RELATED ANALYSIS
Explore evidence-based analysis.
Selected Insights with a publication ID and a documented evidence basis. News and Viewpoints remain in the publication archive.
The FCC Just Made Robot Hardware a National-Security Question — Here’s the Assurance Gap Behind It
5 Aug 2026 · Primary regulatory documents, primary vulnerability-disclosure records, secondary reportingIntroducing the ODA3 EU AI Act Article 50 Transparency Toolkit
5 Aug 2026 · Primary EU legal and Commission sources; final ODA3 toolkit releaseWhere Risk Mapping Ends and Assurance Begins
5 Aug 2026 · Public SAIF materials and the paired ODA3 Technical & Compliance Report and Executive BriefWhen AI Controls a Drone: What Physical AI Security Requires Beyond Model Safety
4 Aug 2026 · Primary disclosure (Anthropic), analytical framingRESEARCH ENQUIRIES
Bring a bounded research question.
A useful starting note identifies the system or method, the specific question, available records, authorization and the material limits known at the outset.
NOTABLY ABSENT
A study does not become assurance by description.
Publication status, source tier, verification, finding state and assurance conclusion remain separate. A controlled reproduction does not establish behavior in an unexamined deployment; an absent record is not evidence of a non-event.