Integrity, provenance and evidence
Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.
Three verification questions
Hash/fixity: do bytes match recorded values? Provenance/custody: who originated, processed and transferred them? Approval: who authorized which action? Timestamps support time evidence under the chosen service, not approval by themselves.
Evidence package
Manifests, object/version references, policy/model versions, validation/QC, decisions/actors, custody/lineage and verification reports. Add signatures/timestamps/eSeals only with verified services, configurations and purposes.
Value and limits
OCR does not authenticate provenance; scans do not automatically replace originals. Hash checks establish integrity relative to reference values. Legal status depends on origin, creation/conversion methods, authority and applicable law.
Start with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment