The principle

Verity may say "we found nothing" only where it actually looked. Absence of a finding is not a finding of absence.

Nearly every non-obvious design decision in the product follows from this one rule. It is worth stating explicitly because the failure it prevents is comfortable: a system that quietly reports "clear", "0 matches", or "low risk" when the truth is "nobody checked" looks healthy, reads well, and is wrong in the direction that gets merchants onboarded who should not have been.

What it rules out

A default that looks like a verdict. entities.risk_level has a database default of low. For months nothing wrote the column, so every merchant displayed a confident green "Low risk" — the largest signal on the page. The band is now written only by an assessment, always with its timestamp, and every surface gates on that timestamp.

An empty list read as a clean result. Screening returns [] for both "screened, found nothing" and "never screened". Reading that as clear meant simply opening a review — which runs no checks — flipped the most decision-critical gate to green. Gates now return not evaluable until a screening run exists.

A count of none where there is no answer. A provider that has not answered yet has no match count, not a count of zero. Zero means we looked.

A verified flag derived from the absence of an error. Elm Digital ID reported a person as identity-verified for any response without an error field — an empty body, a truncation, a shape change at the provider. A positive claim now requires a positive signal.

A neutral fallback treated as conservative. A missing factor scores 3, which sits below the top of every factor's range — so deleting a merchant's data used to improve their score. Above 40% of weight resting on fallbacks, an assessment now publishes no band at all. See Evidence threshold.

A weak source lowering risk. Something self-declared may raise a score freely but can never pull it below neutral. See Provenance.

A permission that is decorative. If a screen renders material a permission is supposed to govern, either the check is real or the permission is a fiction. Verity chose to make the check real and grant the permission widely.

What it costs

Honesty is less comfortable than reassurance, and the interface says "not assessed", "could not be read" and "no rule configured" more often than a competing product would. That is the intended trade: an operator who knows what was not checked can go and check it. An operator shown a green tick cannot.

How it is enforced

Not by discipline. test/invariants/ states these rules as executable assertions that walk the real registries — every gate, every provider adapter, every provenance value — so a component added later is covered without anyone remembering to come back. The reason is uncomfortable but instructive: during one review pass, five tests were found asserting the bug they covered, because when a case has no obviously right answer, the value the code produced gets written down as the expectation.

See Testing.