Answer the Question, Keep the Evidence

1. The bargain RSM refuses

The sources are explicit that participants will go on running their own systems. A producer may keep agronomic history in a farm-management platform, a laboratory its analytical records in a laboratory system, a processor its operational data, a financial institution its underwriting. RSM does not ask any of them to migrate. Independently operated systems participate through federation, each maintaining its own authoritative information while exposing selected, compatible capabilities to the wider network.

That decision has a consequence that runs through every layer of the model. If the records stay where they are, the network cannot work by gathering everything and then deciding what to do with it. It has to work by asking. The discovery question the conceptual reference proposes for a federated participant is therefore not "what do you hold?" but "what questions can this system answer, and what capabilities can it credibly contribute?" A participant becomes discoverable by stating what it can answer, not by publishing everything it knows.

Two distinctions keep this from being merely a matter of etiquette. The protocol requires that a conforming implementation distinguish between possessing evidence and having authority to disclose it, and between permission to evaluate evidence and permission to redistribute it. A system may legitimately hold a copy of something it is not entitled to pass on. An evaluator may be authorized to look at evidence for one purpose without acquiring any right to share it. Without those two distinctions, every act of help would quietly become an act of transfer.

2. Move the question to the evidence

The mechanism that makes asking work is a short chain of distinct objects, and it is one of the places where the distinctions described in Distinctions That Must Not Collapse stop being abstract. A requirement is expressed as a predicate: an explicit, evaluable proposition about an entity, a condition or an outcome. The predicate is the bridge between what one system requires and what another knows; it lets a system ask a precise question without unrestricted access to the underlying data. An authorized evaluator applies the predicate to the relevant evidence under policy, in a defined context. The result is an assertion, a governed conclusion that can be communicated to the party that asked. The evidence itself can remain under the governance of whoever holds it.

The RSM documents use an illustrative scenario to show the shape of this. A buyer requires a particular soil condition. Wellzai asks whether the farm can have that requirement evaluated. The farm authorizes evidence for that purpose to an evaluator it accepts. The evaluator evaluates the predicate and returns an assertion that the condition is satisfied. The buyer learns what it needed to decide; the soil records do not leave the farm's governance. The runtime architecture states the principle in a single sentence: the preferred design moves the question toward the evidence rather than automatically moving the evidence toward the requester.

The pattern also protects something beyond privacy. Because the buyer receives an assertion about a predicate, its requirement is evaluated against evidence rather than being turned into an ecological fact. The protocol notes that this lets market requirements be assessed without becoming statements about the land. What the market values and what is true of a soil remain different objects, a point the Seednote The Market Does Not Decide What Is True About Soil develops further.

3. The disclosure ladder and purpose binding

An assertion is not the only possible answer; it is the least revealing one that may be sufficient. The runtime architecture describes disclosure as a ladder. Asked whether a field satisfies a given predicate, a participant might disclose only that it is satisfied. One step up, it might add who evaluated it and how long the result is valid. Above that come the details of the evaluation, then the underlying evidence, and finally the complete source records. Policy determines which level is appropriate for a given requester and purpose. The architecture adds a sentence that inverts a common assumption: the protocol does not assume that deeper disclosure is inherently better.

Minimum necessary disclosure is the rule that follows. The runtime should collect, replicate and disclose only what legitimate network functions require. A discovery index may need to know that a participant has a capability without storing any detailed operational evidence. Wellzai may need an assertion that a requirement is satisfied without receiving the private records behind it. Sensitive evidence should stay at or near its authoritative source wherever practical, with evaluation happening inside the governed boundary.

Disclosure is also bound to a purpose. Information shared for one Outcome Context should not automatically become available for unrelated ones. The sources give a plain example: a farm may authorize a lender to evaluate financial eligibility and, separately, authorize a buyer to evaluate production requirements. Those permissions remain distinct even when both pass through the same runtime. That is why purpose binding is part of the authorization model rather than descriptive metadata, and why the runtime lists among its invariants that disclosure is not ownership transfer: receiving information for one purpose does not grant unrestricted future use. Revocation follows the same logic. A participant may withdraw permissions and future disclosures, but revocation does not erase the legitimate history of what was shared and done.

4. Answers more honest than yes or no

An architecture built on asking has to be precise about what an answer means, because federated systems are often unable to answer at all. The protocol therefore requires a richer vocabulary than success and failure. An evaluation may return satisfied or not satisfied, but it may also return indeterminate, unauthorized, not applicable, unavailable or stale, and implementations must preserve the difference between negative evidence and the absence of evidence. If a farm has not disclosed what is needed to evaluate a predicate, the correct result may be unauthorized or indeterminate, never not satisfied. In a network where sovereignty and incomplete information are normal conditions rather than failures, treating silence as a negative answer would punish exactly the participants who keep control of their records.

The same honesty applies to who is answering. An assertion should identify the evaluator and the authority under which it evaluated, because different predicates call for different qualifications: a laboratory may be the right evaluator for a measurement, while a lender remains authoritative for its own underwriting. RSM deliberately imposes no universal hierarchy of evaluators. It preserves enough authority and provenance for the requester to judge whether an assertion is acceptable for its purpose. Evaluations should also remain traceable, recording the predicate version, method, evidence references, evaluator, time and result, without that traceability implying access to the protected evidence. And because predicates evolve, an assertion must continue to refer to the version under which it was produced; replacing a predicate's definition must not silently reinterpret earlier conclusions.

What emerges is a particular account of trust. The runtime architecture does not assume that taking part makes every claim trustworthy. Trust, it says, emerges from identity, authority, provenance, evidence, relationship history, assertions and observed behaviour, and the runtime preserves that underlying evidence "rather than assigning one universal trust score". Wellzai may derive confidence from those signals for a particular decision. The network itself keeps the signals, so that confidence can always be traced back to what it was built from.

5. Projection, federation and the place of Wellzai

If the evidence stays with its holders, something still has to make the network navigable, and here RSM is careful about the standing of every copy. The runtime distinguishes authoritative state, maintained under the authority responsible for the information, from projected state, a derived or replicated representation used for discovery, reasoning or presentation. A processor may remain authoritative for its available capacity while Wellzai may keep a local projection of that capacity for reasoning about configurations. That projection, the architecture says, must not become authoritative merely because it is locally available.

The runtime's federation invariants read like a charter for this restraint. Identity is independent of location. Authority is independent of possession: holding a copy does not make a system authoritative. Projection is not canonical state, whether it is a search index, a graph or an Outcome Context. Federation is not centralization. Evaluation is not evidence extraction. And, most directly, Wellzai is not the system of record: it is designed to reason over the federation while authoritative state remains where governance assigns it. Even the registry that lets participants find one another should hold only enough for discovery and routing, never become a warehouse for biographies or evidence, and once two participants have found each other and are authorized, nothing requires Wellzai to stand between them.

Aggregation follows the same principle. A cooperative can expose aggregate production capacity without exposing each farm's records, and a discovery process can resolve progressively, from region to cooperative to aggregate capability, and only then, under authorization, to individual participants and their commitments. Detail is reached by authorized descent, not assumed at the start.

Most of the evaluation and disclosure machinery described here is specified in the runtime architecture rather than running today. The principles themselves have already met practice. When Wellzai first consumed the reference RSM kernel only through its public protocol, it found that even showing a person their own capabilities, offers and authority grants is a disclosure: it has to be an authorized, current-state read from the canonical source, not a second copy kept by the application. Discovery, by contrast, returns only discovery-safe facts. The same work surfaced a question the sources still leave open, whether a person's or an organization's name should count as discoverable information at all. The first finding is recorded in the Fieldnote Reading Your Own Records Is a Disclosure; the open question is the subject of Is a Name Discoverable?.

6. What sovereignty makes possible

It would be easy to read all of this as a list of things Wellzai is not allowed to do. The more important reading is about what the restraint makes possible. Purpose-bound access is what allows the same participant to take part in many regenerative systems at once without everything disclosed in one context becoming available in all of them. Minimum disclosure is what makes it reasonable for a laboratory, a lender or a buyer to join a network in which their competitors also participate. And leaving authoritative state where governance assigns it is what keeps Wellzai a layer that reasons across the network rather than one that owns it.

The reference implementation's specification states the goal in terms that summarize the argument. Independently governed regenerative systems must become mutually intelligible without becoming centrally owned. Participants must be able to expose capability without exposing everything they know, express demand without defining ecological truth, and evaluate requirements without surrendering evidence. The network asks; the participant answers; the evidence stays home. Coordination built that way does not concentrate power in whoever holds the most records, and for systems meant to last across many seasons and many formations, that restraint is part of what makes them worth joining.

Sources

• RSM Concept Paper v3.0, §9 Sovereignty, Authority, and Trust.
• RSM Normative Conceptual Reference v1.1, §7.4 Predicate; §13 Sovereignty and Disclosure; §18.3 Capability Discovery.
• RSM Canonical Model and Protocol Specification v1.0, §9.3 Assertion and Selective Disclosure; §15 Sovereignty, Authority, and Policy; §17.1 Federated Participation; §18.3 Versioning; §20 Error and Indeterminate Semantics.
• RSM Runtime and Federation Architecture Specification v1.0, §4.1 Authoritative and Projected State; §8.2 Federation Registry; §9 Recursive Federation; §10 Policy and Disclosure Architecture; §11 Predicate and Evaluation Runtime; §15.1 Trust as Evidence; §16 Privacy and Data Minimization; §23.1 Federation Invariants.
• RSM Reference Implementation and Acceptance Specification v1.0, §30.1 What the Reference Implementation Must Prove.