In July we ran a one-line census on the permanent record behind our brand knowledge store, the system that decides what our AI tools are allowed to treat as true about a brand. Every action ever taken on a fact in that store is one permanent row: who acted, what they did, when. Grouped by actor and action, the store's entire history fits on a napkin:
propose — system: 90
propose — operator: 19
propose — human: 4
confirm — operator: 19
confirm — human: 7And then there's the row you will never find in that log: confirm — system.
The machines that run this thing (audit pipelines, enrichment loops, document miners) have proposed ninety facts. They have confirmed zero. Not because they lack confidence. Models are nothing but confidence. Because there is no route through the system from "the model is sure" to "the business asserts this." The two are different species of statement, and the entire system is built around refusing to let one quietly become the other.
A fact, in our system, is not something a model said. A fact is something a model said that a person signed.
If you're a brand operator watching AI tools write more and more of what your customers read, that distinction is the one to interrogate before any feature list. Here's how ours works, what it cost us to learn, and the question it should teach you to ask of anything you buy.
A fact moves through five statuses
Every candidate fact lives in a ledger with exactly five possible statuses: proposed, confirmed, rejected, superseded, needs_reconfirmation.
When a machine detects something (say, an audit run catches an AI engine claiming a brand was founded in the wrong year), it writes a proposed row. The row carries the verbatim claim, the evidence that triggered it, and a deliberately empty answer slot.
Getting from proposed to confirmed runs through a single step that either completes entirely or not at all: it locks the brand, verifies the fact actually belongs to that brand (our note on it: never trust the fact's identifier alone), retires any prior active fact for the same claim, stamps who approved it and when, and adds the event to the permanent record. Guards stand on either side so there can only ever be one active fact per claim and one proposed fact per claim at a time.
There's even a status for institutional doubt, needs_reconfirmation, where a fact keeps its seat while flagged for a fresh look, with the notes on that part of the system admitting, in writing, that the automatic staleness detection to drive it is future work.
The note we wrote on that slot is the whole philosophy in seven words: "corrected_truth stays null until a human confirms." The machine states the problem. It does not get to state the truth.
The allowed status changes are a closed list, enforced by the store itself: every move not explicitly permitted is refused.
Underneath all of it sits the permanent record, and the permanent record cannot be edited. Any attempt is refused automatically, with a message stating that the record is append-only, and the note above that rule is explicit that it applies to everyone, our own systems included. We can't rewrite history either. That refusal is what makes the signature worth anything. An approval you can quietly edit later is a draft with better posture.
The bug that taught us
We didn't design this from principle. We designed it from a loss.
The first version of human verification lived attached to audit findings. A person reviewed a detected falsehood, confirmed the correction, done. Then the next audit run came along and did what audit runs do: regenerated everything. The change that replaced that design states the failure flatly, in its own notes: that chain, report to finding to review, is "the BUG this ledger fixes." A confirmation was attached to a finding; the finding was thrown away on the next audit run; so the confirmation went with it, and "the same fabrication re-flags every cycle." The claim persists. The report that surfaced it does not.
Sit with what that means operationally. A person looked at an AI fabrication about their brand, said "this is wrong, here is the truth," and the system forgot the conversation ever happened. Then it re-surfaced the same fabrication next cycle and asked again. We were losing signatures, which is worse than losing data, because a signature is the one thing in the pipeline a machine can't regenerate.
The fix is that facts are attached to the durable claim itself, not to whatever report happened to surface it. Reports are disposable. Ratification is not.
The intake is disciplined about what's worth a signature, too. Only claims graded outright wrong get proposed. The rule draws the line precisely: "Weak/Missing are accuracy-shading, not corrections a human asserts a truth against." Your attention is the scarcest resource in the loop; the machine's job is to spend it only where a person can meaningfully assert something.
What a signature buys
So a person confirms a fact. What actually happens?
From that moment, the fact outranks the model everywhere. Every place our AI tools assemble brand truth before they write (content assets, remediation playbooks, grading) adds the confirmed facts through one shared step, framed by a preamble that is worth quoting in full because it's the trust layer talking in its own voice:
Then one line per fact: the words "Verified truth," the field it corrects, and the corrected value. The machine-extracted brand profile above it can say whatever it says; on conflict, the signed facts win. And they win without rewriting anything: the design note is emphatic that the stored profile "is NEVER mutated". The override happens at the moment of reading, so the machine's layer and the human's layer never bleed into each other. For a brand with no verified facts, the rule is that the output is "BYTE-IDENTICAL" to its input. Until a human has actually signed something, the trust layer is provably invisible.
Notice the tail of that preamble: "not as instructions to follow." The one channel that outranks everything else the model reads is exactly the channel you defend hardest, because a confirmed value that secretly contains an instruction would be obeyed with full authority. So confirmed values pass through a cleaning step that strips invisible characters and hidden text-direction tricks, and caps the length of everything, in our own words "bounding a prompt-injection / runaway-value blast radius at write time." A value that can't be cleaned becomes a visible placeholder, [verified correction unavailable], never raw text. Privilege and paranoia scale together, or the privilege becomes the attack surface.
What the gate costs
Now the part the pitch decks would leave out.
The same census that shows zero machine confirmations shows the price of that zero: at census time, eighty-seven proposals were sitting in the queue, waiting for a person. All-time, across the store's whole life: 113 proposals, 26 confirmations. In one product's local ledger the picture is starker still: the audit machinery had proposed fifteen corrections and all fifteen were still waiting; the only three facts ever confirmed there came through the human path, typed and signed in a single gesture by a person filling a gap themselves.
| Proposed | Confirmed | |
|---|---|---|
| The machines | 90 | 0 |
| The store, across its whole life | 113 | 26 |
| One product's local ledger | 15, all still waiting | 3, all through the human path |
That's the deal.
The gate's throughput is human attention, and human attention doesn't autoscale.
Some of those proposals will get confirmed. Some will sit there for a long time. Possibly forever. We accepted that, on purpose, because the alternative is a knowledge base that fills itself — and then every downstream product is generating customer-facing copy from claims nobody ever looked at. Gate the approval point, not the intake: the machine can surface everything it finds, and a rejected claim stays rejected rather than re-queueing itself. But nothing crosses into "the business asserts this" on cadence alone.
One more honesty note, because the mechanism deserves precise description. Humans can skip the queue — there's a propose-and-confirm-in-one-gesture path for an owner asserting a truth directly. What nobody can skip, human or machine, is the signature. Every confirmed fact in the store carries the identity of the person who confirmed it and the moment they did, forever.
The signature is the product
We've spent real effort making our models better at knowing things about brands. Sharper extraction, better audits, wider mining. All of it matters. None of it is the trust layer.
The trust layer is a short list of statuses with a human at the only door, writing to a record that can't be edited. It's boring. It's mostly database rules. And it's the reason a downstream product can put a claim in front of a customer and I can tell you exactly who stood behind it and when.
If you're building — or buying — AI that speaks for your brand, here's the question that cuts through every demo: what, structurally, separates "the model said it" from "the business asserts it"? Ask to see the boundary.
Ask who can write to memory, and who can only nominate.
If the answer is a confidence threshold, there is no boundary. There's a dial, and the model is on both sides of it.
Our answer is a zero in a permanent record. Ninety proposals, zero confirmations, and no route through the system that will ever change that number. The model gets smarter every quarter. The signature stays human.
Can a machine confirm a fact?
There is no route through the system from "the model is sure" to "the business asserts this." The two are different species of statement, and the entire system is built around refusing to let one quietly become the other.
What happens once a person confirms a fact?
From that moment, the fact outranks the model everywhere. The override happens at the moment of reading, so the machine's layer and the human's layer never bleed into each other. For a brand with no verified facts, the rule is that the output is "BYTE-IDENTICAL" to its input.
What does the gate cost?
Some of those proposals will get confirmed. Some will sit there for a long time. Possibly forever. We accepted that, on purpose, because the alternative is a knowledge base that fills itself — and then every downstream product is generating customer-facing copy from claims nobody ever looked at.
Can anyone skip the queue?
Humans can skip the queue — there's a propose-and-confirm-in-one-gesture path for an owner asserting a truth directly. What nobody can skip, human or machine, is the signature. Every confirmed fact in the store carries the identity of the person who confirmed it and the moment they did, forever.