An input screen and an output screen both logged allow for a turn in which the assistant obeyed an encoded span — what does that record prove?

## Read the record for what it is A screening verdict is a score on a string. Written out as an evidentiary claim, an `allow` from an input screen says: *the characters this model was handed scored below the configured threshold on the labels this model carries.* Every word of that is load-bearing. It is not a statement about the request's intent, about the reconstruction the generator later produced, or about anything that happened after the score. The output verdict is the same kind of claim about a different string — the emitted response — and it inherits the same asymmetry: it scores the surface that was produced, while whatever consumes the response resolves it. ## What the pair is silent about | Artefact | Proves | Does not prove | | --- | --- | --- | | input screen: allow | the input surface scored low on that screen's labels | that the input carried no directive | | output screen: allow | the emitted surface scored low | that the turn's effect was benign | | a tool call in the log | which call ran with which argument values | who chose those values | | a field's provenance | which session and account wrote it, and when | that anyone meant it as an instruction | | no sampled review | nothing was flagged for review | that there was nothing to review | The row people most often over-read is the tool call. A call record is strong evidence of *what happened* and no evidence of *why*: the arguments were emitted by the generator, and the generator's reason for choosing them is not in the log. A call whose arguments do not correspond to anything in the user's turn is the anomaly worth chasing precisely because the log cannot explain it. ## Where the span came from, and where you stop being able to tell If the span arrived in a field of a tool's return value, the provenance you can obtain is the host product's, not the assistant's: some account wrote that note at some time, long before this turn, and no one classified it as input then. For an assistant feature a vendor embeds inside other companies' products, that trail usually stops at the tenancy boundary. The vendor holds its own screen verdicts, the prompt it assembled and the calls it made; it does not hold the host product's data flow. "Where did this text come from" becomes a question only the tenant can answer, and answering it requires the tenant to accept that one of its stored fields was an input path — which is exactly the framing the record does not prompt anyone to adopt. ## The clean record as the payoff It is worth naming plainly that the absence of an incident is part of what was obtained. Review capacity is finite and is spent on flagged material. A turn that both screens allowed, that carries no label and that no sampler selected is a turn with nothing pointing at it. The moderation log and the tenant's audit trail will both, quite truthfully, report that no policy label fired — and a reader will hear that as *nothing happened*, which is a far stronger statement than the records support. Whoever placed the span gets the behaviour and the silence together, and the silence is often the more durable half, because it determines whether anyone looks again. ## How to triage the turn anyway The useful moves all bypass the verdicts: - **Start from effects, not scores.** Enumerate the calls the turn made and compare their arguments with what the user asked for. Divergence between the two is the signal the screens cannot give you. - **Enumerate the context sources.** List every span that entered the window and the path it came in on. The one that no stage treats as input is the one to look at first. - **Ask what the surface was.** If a span in the context is in a representation the pipeline never expands, the input verdict was scored on that representation, and the score is uninformative by construction. - **Be honest about reproduction.** Getting the same behaviour once tells you the construction worked once against one deployment. With a probabilistic generator, report attempts alongside successes; a single reproduction is an existence proof and a rate is a different claim. ## What the finding should say The defensible finding is about the asymmetry and the path: which component scored which surface, which component resolved it, and how the span reached the context window. That is the part with a long shelf life. The particular representation used is the part that gets covered first and teaches a reader least, and a finding that leads with it invites a fix that closes one form and leaves the structure untouched.