Provenance

Every observed value records where it came from, and that source constrains what the value is allowed to do to the score.

The trust order

Provenance	Source
registry	Wathq, ZATCA — the registry itself
government_id	Yakeen, Nafath
provider	Focal, Neotek, domain intelligence
internal	Verity's own portfolio graph
self_declared	The onboarding form, or an operator typing a value in
absent	Nothing to read

The rule

A weak source may raise risk freely. It may never lower risk below neutral.

Neutral is 3. self_declared and absent are capped: if either would produce a score below 3, the score becomes 3 and the item is marked capped. Every other source applies at full strength in both directions.

The asymmetry is the point. A merchant saying "we are low risk" should not lower their score. A merchant saying something alarming about themselves is worth listening to.

Capped against what produced the score

The cap keys on what produced the score, not on where the observation came from. Those differ more often than they sound:

• The country was read from the registry — provenance registry
• But no configured row matched it, so the score came from the no_input fallback

Scoring that at full strength because the observation was registry-sourced was a real bug: it let a below-neutral fallback through in exactly the case the cap exists to cover. The cap now reads matched_no_input.

Two separate facts

Each assessment item records both:

Field	Records
provenance	Where the observation came from
matched_no_input	Whether the score came from the fallback

Collapsing them into one field lost "we observed this". A row can honestly say Saudi Arabia · Registry and still be marked no rule configured — we did read the country from the registry, and there is no configured score for it.

In the interface

• Each factor row shows its source
• A capped row says Capped at neutral: a self-declared source cannot lower risk
• A fallback row says Fallback score — no evidence stood behind this and renders in slate rather than a risk colour

Declared values elsewhere

The same idea appears outside the risk engine. A date of birth an operator types in is recorded as self_declared and labelled declared, not verified wherever it appears — it is the claim an identity check tests against the government record, not evidence in itself. A later authoritative answer overwrites it.