An answer that cannot be found again cannot be attributed to anything. Every analysis is stored with the terms it was computed under, and every decision is stored against the analysis it rested on.
Most of this record exists because it cannot be reconstructed later. A comparator nobody wrote down, an exposure nobody measured, a claim nobody kept beside the result — each of those is unrecoverable six months on, and the person who could have supplied it will not remember.
Recorded as rows rather than as a narrative, because the fields that look bureaucratic are the ones that decide whether a later evaluation means anything.
The change you intend to make, the comparator you are judging it against, the outcome and the window it will be measured over, and the unit that gets assigned. The mechanism and the hypothesis are recorded before any data arrives, which is what makes them falsifiable afterwards.
What this does not establish: It records what was intended. An intervention written down carefully is still a plan, and a plan is not evidence.
Who accepted this model, and against which stored analysis. Append-only, so a revised decision is a second row rather than an edit — an approval is a fact about a moment, and changing it would change history rather than correct it.
What this does not establish: It records that someone accepted the analysis. It does not record that they were right, and the record is deliberately silent on whether the model was good.
What was assigned to each unit, and separately what was actually reached — with the unit key scoped to its intervention, so an identifier that repeats across facilities cannot silently merge two people.
What this does not establish: It records what the source systems reported. An exposure recorded from an incomplete feed is an incomplete record, and the source is stored beside it so that can be judged later.
What was measured, kept beside what was claimed at design time, along with whether the money is cashable and which other initiatives are claiming part of the same improvement.
What this does not establish: It reconciles a claim against a measurement. If the measurement is confounded, the record shows the comparison without repairing it.
Both are cheap to record while the work is happening and impossible to reconstruct afterwards.
A unit assigned to treatment that never received it is not a unit that was treated. Recording only one of the two makes the intention-to-treat question and the per-protocol question indistinguishable.
Store both and you can ask either question later. Store one and you have silently chosen, without knowing which one you chose.
The design-time effect and the reconciled outcome live in the same record, because the difference between them is the most useful thing the record contains. It is also the thing that gets quietly dropped from a slide.
A decision that came in below its claim is a finding. A decision whose claim was never written down is a story.
The evidence pack gathers a single decision into one document: every analysis behind it, the provenance of the rows those analyses read, who approved what and when, and what was measured. It exists so that a reviewer does not need access to the system to audit the decision — which is what makes it usable by an auditor, a regulator or a committee.
The pack is fingerprinted, so a chart in a deck can be checked against the run that produced it and any change to the inputs changes the fingerprint.
It is tamper-evident, not unforgeable — a fingerprint shows that content changed, not that it was never altered by someone with access. And it is signed only when the deployment has a signing key configured. When it does not, the pack says so rather than carrying a signature that means nothing.
If you have a decision to make and a number someone will hold you to, the question is not whether we can produce a number. It is whether you can say where it came from.