QILAHK™ / AUTHORITY & DECISIONS
Use Cases to Keep Trust Reviews Accountable
Connect unresolved questions, supporting evidence, review actions, and final decisions in one case history.
· QILAHK Journal
Give the question a home
A trust review often begins with a discrepancy: changed evidence, an incomplete submission, or a result that conflicts with another source. A case provides a stable place to define that question and track its resolution.
The case should identify the subject, affected claim, triggering event, and relationship to any existing determination. That context prevents a reviewer from treating a narrow issue as an assessment of the entire account or system.
Keep actions distinct
Evidence submission, verification, recommendation, and decision are different actions. Record who performed each action and when. Attach evidence references to the review step that used them, and preserve earlier versions when a submission is corrected.
Comments can explain context, but an informal discussion should not be the only record of an authoritative outcome. The decision needs a clearly identifiable record and an authorized actor.
Make the next step visible
Each unresolved case should have an owner and a specific next action. “Needs review” is less actionable than “confirm whether the replacement device retains the required identity binding.” Where policy sets a deadline or escalation path, record it.
A handoff should explain the remaining uncertainty. The receiving reviewer needs to know which evidence is missing, which criteria are disputed, and which facts have already been established.
Close with a traceable result
Closing a case should record its disposition, rationale, decision reference, and any remaining follow-up. If the case affects a registry entry, certificate, or TrustMark, reference the authorized workflow action and resulting record.
For an illustrative material-change case, retain the original observation, new observation, applicable rule, reviewer findings, and final determination. The case then becomes a reviewable explanation of the transition rather than a collection of disconnected messages.
Continue exploring the foundations in Cybersecurity Has Security Controls. What It Lacks Is a Trust Layer.
← Back to the Trust Authority Blog