Verify one exact claim
Bind the subject, claim, verifier, method, freshness requirement, expiry, and Action revision. Re-run verification when any bound field changes.
Use the strongest appropriate source
Prefer a provider attestation or scoped retrieval over user-entered prose. Show the verifier and what will be checked before collecting sensitive evidence.
Preserve truthful outcomes
- Distinguish verified, not verified, expired, inconclusive, and unavailable results.
- Never turn missing or censored evidence into a negative claim.
- Do not accept arbitrary response text as proof.
- Re-read the same Action after an out-of-band provider flow.
Minimize and isolate evidence
Keep raw documents, biometrics, one-time codes, credentials, and unrelated provider data out of prompts, Action results, logs, traces, analytics, and ranking. Retain only the minimum attestation and audit metadata required by policy.
Do not widen authority
A verification result does not sign the user in, create an account, approve work, or authorize payment. Route those needs to Authenticate, Onboard, Approve, or Pay.
Test uncertain and stale evidence
Test expired evidence, provider timeout, subject mismatch, unsupported method, partial match, duplicate callback, revoked attestation, and a verification that becomes stale before the Action continues.Last modified on September 22, 2026
