In an Admiralty Code rating like B2, what do the letter and the number each grade?

## Two characters, two different jobs The Admiralty Code (the NATO system, also reproduced in US Army FM 2-22.3) is the oldest and still the most widely borrowed way of tagging incoming reporting in an intelligence function. Every item gets two characters, and the whole value of the scheme is that they are assessed **separately**. **The letter — source reliability.** A property of the *source*, accumulated over everything it has ever sent you: | Grade | Meaning | |---|---| | A | Completely reliable | | B | Usually reliable | | C | Fairly reliable | | D | Not usually reliable | | E | Unreliable | | F | Reliability cannot be judged | **The number — information credibility.** A property of *this particular report*, judged against the rest of what you know: | Grade | Meaning | |---|---| | 1 | Confirmed by other sources | | 2 | Probably true | | 3 | Possibly true | | 4 | Doubtful | | 5 | Improbable | | 6 | Truth cannot be judged | ## Why they must not be merged Reliability is a bet on a track record. Credibility is a bet on a claim. They move for different reasons, and a single blended "trust score" destroys the information you most need at 07:00 when someone asks what you actually know. - `B6` — a vendor you rely on has published something genuinely new that nothing else you hold speaks to. Honest, common, and not a criticism of the vendor. - `F1` — an anonymous tip, sender unknown and unassessable, whose *content* you then independently confirmed in your own telemetry. The claim stands even though the source does not. - `A4` — a source that has never been wrong is, this time, saying something your own logs contradict. The letter does not rescue the number. The failure this prevents is reputational laundering: a well-regarded name attached to a claim it did not verify. A vendor writing up an intrusion it responded to is reporting first-hand observation; the same vendor summarising somebody else's blog is repeating, and repetition is not confirmation. ## Reliability is access and competence, not just honesty A source can be entirely honest and still unreliable *for your question*. A telemetry-rich endpoint vendor may have excellent visibility into a Windows estate and none at all into the SaaS tenants and identity provider that are the whole of your environment. Grade the source for the domain you are asking about, and be prepared to give the same organisation different letters for different subjects. ## The number's top grade has a hidden requirement `1 — confirmed by other sources` only means anything if those other sources are **independent**. Three write-ups that all trace back to one original blog are one source wearing three hats, and a credibility grade of `1` awarded on that basis is simply wrong. Before you award corroboration, ask of each supporting report: what did *this* author observe first-hand, and would they have written it had the first report never existed? ## How the grade is actually used The two characters are inputs to the judgement you publish, not the judgement itself. A stack of `C3` and `B6` material supports a low-confidence assessment and an explicit statement of what would change it; it does not support telling an executive "we are fine" or "we are breached". The grade is also how you keep your own reasoning auditable later: when an assessment is overturned, you can see whether you over-trusted a source, over-read a claim, or both. Keep it lightweight. In a small team a two-character tag in the intake note, plus one line on *why*, is enough. Two habits ruin it: grading the **feed** rather than each report inside it, and letting a letter become a permanent label nobody ever revisits after the source is wrong twice.