QILAHK™ / AUTHORITY & DECISIONS
The Anatomy of a Defensible Trust Decision
Capture the claim, criteria, evidence, authority, rationale, and limits behind a trust determination.
· QILAHK Journal
A status needs an explanation
An approved status answers what happened. A defensible decision also explains why it happened, who had authority to decide, and what the result covers. Without that context, another team may rely on a conclusion beyond its intended scope.
The QILAHK model connects claims, evidence, verification, authority, and decisions. Each connection matters when someone later asks whether the determination was justified.
Record the basis
Identify the subject and the exact claim. Reference the evidence reviewed and the criteria version applied. Describe any limitations, contradictory observations, or unresolved questions. Include the decision time and the period or conditions under which the result may be relied upon.
References should identify stable records. Linking only to a changing dashboard can make an earlier decision difficult to reconstruct after the displayed information changes.
Explain authority and judgment
Record the deciding role and the basis for its authority. Distinguish a tool’s assessment from an authorized determination. When judgment is involved, explain how the evidence was weighed and why the chosen outcome follows the criteria.
A conditional decision should identify the condition, responsible party, deadline where applicable, and consequence of noncompletion. An exception should have its own authorized basis rather than being hidden inside a general approval.
Make the decision reviewable
A second reviewer should be able to follow the reasoning without reconstructing it from informal messages. A compact decision record can answer: what was claimed, what was reviewed, which requirements applied, what was concluded, and what would trigger reconsideration?
Use this structure for an illustrative endpoint review: identify the device; state the boot configuration claim; reference observations; apply the approved criteria; document the outcome and limitations. The resulting status becomes useful because its meaning is accessible.
Continue exploring the foundations in Cybersecurity Has Security Controls. What It Lacks Is a Trust Layer.
← Back to the Trust Authority Blog