The graph, the probabilities, and the values.
Three layers plus the record of what was done with them. Kept separate on purpose, because the questions an auditor asks are about the boundaries — which part of this was measured, and which was asserted.
Most tooling that does this merges the layers into one artifact, and it is tidier until somebody asks which part of the answer was an assumption. The separation is what makes that question answerable at all.
Four layers
Each is a stored object with its own routes, its own revision history and its own failure modes.
- 01
Structure
Holds
Directed edges between named variables, with the source of each edge and a flag for contested ones.
The graph. It can be elicited from a description, a document, a table or a stored dataset, and every edge records where it came from. Screening finds pairs that stay dependent however they are conditioned; direction then comes from an ordering, which is an assumption the response states rather than hides. The layer keeps a revision history, so a question about a specific edge resolves to an event.
Why it is its own layer: Because the graph is the assumption and the probabilities are the evidence. A graph can be right while every number in it is wrong, and the reverse. Mixing them makes it impossible to say which one is being challenged.
What this does not establish: Structure here is elicited or recovered from conditional independence tests, not learned by a structure-learning algorithm over a large observational dataset. Where the structure is genuinely unknown rather than unstated, that is a different and better-suited tool.
- 02
Probabilities
Holds
One conditional probability table per variable, each row carrying a provenance tag and each cell attributable to a count or an assertion.
The tables are fitted from counts where counts exist, elicited where they do not, and overridden by hand where somebody knows better than both. Every row is tagged — elicited, expert, fitted or mixed — and the tag survives into every answer computed from it, so a result can be projected onto the largest sub-network where every row is backed by a fit.
Why it is its own layer: Because provenance has to attach to a row rather than to a model. Provenance at the model level cannot support the calibrated-only projection, since the average of three kinds of support is the one thing none of them is.
What this does not establish: A row may have no observation behind it at all, in which case it keeps the uniform prior and the table says so rather than interpolating. And a tag records where a number came from, not how good it is: a careful workshop and a hurried meeting produce the same tag.
- 03
Values
Holds
A value model per network: what each outcome state is worth, and what a unit of action costs.
Ranking actions by their effect answers a question about the outcome variable's own units, which is rarely the question the business is asking. A registered value model turns the effect into an expected value, so the ranking is against the thing being optimised — and it can be replaced without touching the causal model, because a change in what a claim costs is not a change in how the world works.
Why it is its own layer: Because the causal layer should not contain a number that a finance team can change on a Monday. Mixing them means every value revision invalidates the model's revision history for no causal reason.
What this does not establish: A value model is a business input, and nothing here validates it. The product can tell you which action has the highest expected value under the values you registered; it cannot tell you the values are right, and it will not pretend the ranking survives a different value model.
- 04
The record
Holds
Interventions, the approvals taken on them, exposures, reconciled outcomes, and a fingerprinted evidence pack per decision.
The layer above the model. An intervention is framed, an option is approved against a specific stored analysis, what was assigned is recorded separately from who was actually reached, and the measured outcome is reconciled against the design-time claim. The evidence pack assembles one decision self-contained and fingerprinted, so it can be read by somebody without access to the system that produced it.
Why it is its own layer: Because a decision outlives the model that motivated it. If the record lives inside the model, then editing the model edits the history of a decision that was already taken.
What this does not establish: A fingerprint proves the pack has not been altered and says nothing about whether its contents were correct. That distinction is the most available misreading of the field, which is why it is stated rather than left to the schema.
Why merging them is the wrong simplification
One file holding nodes, edges, probabilities and costs is easier to read, easier to version and easier to explain. It is also the shape that makes the governance question unanswerable, and the loss is specific rather than philosophical.
- Provenance becomes a property of the whole model, so "which of these numbers was an assumption" has no answer more precise than "some of them".
- A hand override and a refit become the same kind of change, so the record cannot distinguish somebody correcting a number from the data changing under it.
- A value revision invalidates the causal revision, which means the audit trail reports revisions that changed nothing about the causal claim.
- The calibrated-only projection becomes impossible, because it is defined as a sub-network of rows and there is no row identity to project onto.
How a question moves through the layers
The same path every time, which is what makes the record comparable between decisions.
- 01
Frame
The decision is stated as an action, an outcome and a unit — the treatment, the response, and what is being counted. This is stored, not just used as a parameter.
- 02
Identify
Whether the question is answerable at all, and by which route. The answer may be no, and no is a first-class result with a reason attached rather than an error.
- 03
Estimate
Exact arithmetic over the tables, with a band that names its own basis. No model is called and nothing is fitted at this point; the counts are already the evidence.
- 04
Attack
The refutation battery runs and reports each check individually, including inconclusive, which is never counted as a pass.
- 05
Decide
Actions are ranked by expected value under the registered value model, and subgroups are ranked under a stated capacity.
- 06
Reconcile
What was assigned, who was actually reached, and what was measured — compared against the design-time claim rather than against a memory of it.
The layers are not an implementation detail. They are the reason a reviewer can ask which part of an answer was an assumption and get a specific row back.