The strong rivalReuse and platform scale still matter

Decision-specific qualification can create bespoke pipelines, duplicate definitions and block enterprise standardisation. If every product rebuilds identity, provenance, quality controls and service monitoring, the organisation loses leverage and produces conflicting facts. A central platform should make reliable components easy to reuse.

The answer is separation. The governed core owns stable entities, identifiers, event conventions, provenance, transformations, entitlements, controls, service levels and change notice. A thin decision adapter declares eligible population, exclusions, temporal rule, outcome, permitted inference and product evidence. Reuse increases below the adapter; decision specificity remains visible above it.

Use the simplest adapter the consequence requires. A reversible summarisation task may need bounded sources, current citations and access control rather than a multi-year remediation programme. A consequential eligibility decision may require effective-time reconstruction, subgroup evidence, validated outcomes and hard rights gates. Platform scale is preserved by sharing what is truly stable, not by pretending every decision asks the same question.

Original constructThe eight-test Decision-Conditioned Data Fitness Contract

The contract is this article's synthesis. It rejects one readiness score because hard failures cannot be averaged away.

Reusable core, variable edgeThe thin decision adapter

The governed core should publish semantic definitions, stable identifiers, source purpose, lineage, transformation, quality controls, entitlement metadata, service level, change history and owner. Documentation is evidence about the asset, not automatic permission or proof of suitability. Consumers still need to test the declared decision.

The adapter names user, affected party, consequence, action, eligible population, exclusions, event horizon, outcome, retrieval entitlement, prohibited inference, evaluation and expiry. It can be a versioned view, feature specification, temporal join, policy filter or context assembly. Its thinness refers to responsibility, not necessarily code length.

When an adapter requires extensive cleansing or new semantics, expose that work rather than relabelling the core as ready. Repeated adapters may reveal a missing shared data product, which Paper 082 addresses. A decision-specific exception should not silently redefine enterprise meaning for every consumer.

Version the core and adapter independently. A source field change can invalidate several decisions, while one population rule may affect only one product. Change notice should identify impacted receipts and force re-examination before production use continues.

Coverage and negative spaceClean tables can preserve selected worlds

Coverage begins with the eligible denominator, not the rows present. Record who or what could have entered, why cases were excluded and which channels or regions collect different evidence. A join can silently remove unmatched people and make the surviving table look more complete. Preserve join attrition by subgroup and decision consequence.

Repayment is observed for approved applicants. A complete repayment table cannot reveal how rejected applicants would have performed. Inferring a negative outcome from absence reproduces the prior policy. Use independent or counterfactual evidence where defensible, restrict the claim or reject the dataset for that prediction.

Missingness can carry business meaning. Blank income fields concentrated in one channel may reflect collection design, language, access or staff incentives. Generic imputation removes the visible symptom without repairing coverage. Diagnose the collection process, track missingness by cohort and test how the product behaves when the field is unavailable.

Overall completeness cannot compensate for a consequential subgroup gap. Show coverage, conflicts, uncertainty and outcome opportunity by cohort. If the affected minority lacks evidence required for the action, collect it, narrow the eligible population or reject the use. Do not let majority performance finance unsupported decisions about others.

Five clocksCurrent ingestion can carry stale truth

Event time records when something happened. Effective time records when a fact was valid in the world. Ingestion time records when a system received it. Observation time records when evidence became visible. Outcome time records when the consequence emerged. These clocks answer different questions.

A nightly pipeline can be fresh while the source fact has not been verified for months. A latest-status field can be operationally correct but unable to reconstruct the state at an earlier decision. A late-arriving correction can supersede a fact without erasing what an operator knew then. Preserve valid-time and system-time rules where the decision requires reconstruction.

Define freshness from the decision horizon and source process. A contact preference, inventory position, professional licence and long-term classification have different decay mechanisms. Record the last observation, effective period, confidence and supersession. Do not infer freshness from an ingestion timestamp alone.

Temporal joins must prevent future information leaking into historical evaluation. Align features and outcomes to what was available at the decision time. Document latency and late-arrival behaviour. If time cannot be reconstructed, restrict the use to current summarisation or reject retrospective claims.

Meaning survives systemsSemantic collision and provenance

Customer can mean legal entity, billing account, active relationship, person, household or user profile. A join across systems can appear technically valid while mixing these units and corrupting denominators. Units, currencies, status values and relationship direction create similar failures. Name semantic owners and test examples at boundaries.

Provenance records source, collection purpose, workflow, incentive, transformation, join, imputation, human edit and uncertainty. A lineage graph that lists tables but omits why a field exists cannot establish meaning. Human corrections need author, evidence, adjudication and effective time. Imputation must remain distinguishable from observed fact.

Documentation can be stale or incomplete. Validate it against records, source owners and current workflow. A data card improves transparency but does not authorise a new purpose or prove population coverage. The receipt links documentation to tested decision evidence and a change trigger.

When semantics conflict, repair the mapping or preserve separate identities. Do not force a canonical field merely to make integration easy. Some distinctions are decision-relevant and should remain. If ambiguity affects consequential action and cannot be resolved, reject the dataset for that use.

Access is not permissionRights, entitlement and operational service

Engineers may be able to query a dataset while its collection purpose, contract, confidentiality or applicable law does not permit the proposed use. Technical access is an implementation fact. Permission requires a scoped purpose, role, affected-party analysis, entitlement and retention decision. Retrieval must preserve user-specific access rather than flattening source controls.

Record permitted use and prohibited inference in the adapter. A support transcript may help resolve one case without becoming general training material. A contract may allow service delivery but restrict model improvement. Consent, where relied on, needs context and may not be valid under power imbalance. Seek appropriate legal and privacy review for the actual jurisdiction and processing.

Operational fitness includes availability, latency, schema stability, identifier quality, incident route, cost and support. A semantically ideal source that cannot meet the decision window is not fit for live use. A change notice that arrives after an incompatible schema is deployed is not a control. Define service evidence and a safe response to failure.

Entitlement and service can change independently. Recheck receipts when a user role changes, a source purpose expires, a vendor term changes, a pipeline degrades or a new cohort enters. Restrict retrieval while rights or provenance are unresolved; do not convert uncertainty into broad access.

Qualification in practiceTest the relationship, not the table

A useful examination begins with a sentence that joins data to action: for this user, acting on this population at this time, these fields support this outcome and consequence. Each noun and verb becomes testable. If the sentence cannot name the action, the team is still discussing a capability rather than a decision. If it cannot name the affected population, a completeness measure has no valid denominator. If it cannot name the time, freshness has no operational meaning. The sentence is deliberately narrower than a catalogue entry because the same source may be fit for one sentence and unfit for another.

Start with semantic ownership

Assign an owner for each decision-bearing entity, event, state and unit. Ask that owner to supply accepted examples, counterexamples and boundary cases. A status called active might mean a valid contract in one system, recent use in another and an unpaid balance in a third. Mapping all three to one boolean makes integration easy while destroying the distinction the decision needs. Test the mapping against real records from each source, including nulls, legacy values and transitions. Record whether an apparent synonym is exact, conditional or unsafe. Where two meanings must remain separate, preserve separate fields and make the adapter choose explicitly.

Semantic checking should follow relationships as well as columns. A customer identifier might represent a person in one system and a household in another; a claim may be attached to a policy at creation but to a legal entity at settlement. Confirm cardinality, direction and valid period before joining. Reconcile totals at the source grain and the decision grain. Investigate unexplained duplication rather than deleting it. The result is a tested semantic mapping with named ownership, known ambiguity and a rule for change, not a glossary that merely repeats field labels.

Reconstruct the eligible denominator

Define who or what could have received the proposed action before looking at the available rows. Trace every filter, source channel, consent route, join and operational exclusion between that denominator and the modelling table. Report how many cases survive each step, split by the cohorts that matter to the consequence. A high final completeness rate can coexist with a large initial loss if unmatched cases disappeared before the metric was calculated. Preserve those losses as evidence. If the denominator cannot be reconstructed, the team may still support a narrower descriptive task, but it cannot claim population fitness for the original decision.

Coverage is also about situations, not just people. Rare failures, new products, seasonal peaks, policy changes and exceptional workflows may be sparse even when every ordinary customer appears. Identify which situations could change the action or harm, then inspect their representation and outcome opportunity. The answer need not be exhaustive for a low-consequence, reversible aid. It must, however, match the declared boundary. For material action, a consequential cohort gap calls for targeted collection, a restricted population or rejection. Weighting cannot create observations for a process that never recorded the necessary event.

Treat missingness as process evidence

For each important field, compare missingness by source, channel, role, location, cohort, time and outcome opportunity. Ask when the field is requested, who can supply it, who may decline, what staff incentives apply and whether a default value hides absence. A blank can mean not applicable, unknown, refused, not yet observed, lost in transfer or deliberately suppressed. These meanings should not share an imputation rule. Carry missingness indicators and reason codes where they are legitimate, but do not let them become covert proxies for protected or disadvantaged groups. Test the product with unavailable fields and define a safe fall-back action.

Repair begins at the collection process when that process creates the pattern. A statistical fill may stabilise a model input while leaving the real exclusion untouched. Compare the proposed repair with the source workflow and affected-party burden. Collecting more data may itself create privacy, access or participation costs. Prefer the smallest evidence that resolves the decision uncertainty. Record observed, inferred, imputed and human-corrected values separately so later reviewers can see which facts were present and which were manufactured by the pipeline.

Align the five clocks

Build a decision-time reconstruction for representative cases. For every feature, show the event time, world-valid effective period, system ingestion time and first observation available to the product. Show the outcome time separately. Then replay the record as it would have appeared at the moment of action. This catches future leakage, late corrections, backfilled histories and latest-value tables that overwrite earlier knowledge. A training extract should reproduce what the live system could have known, including delays and missing records, rather than an ideal history assembled months later.

Translate freshness into an expiry rule tied to the source process. An inventory count can decay within minutes, a licence may remain valid until a recorded change, and a customer preference may require confirmation after a particular interaction. Measure the delay distribution, not only its average, and define how the product responds when a source breaches it. Options include waiting, using a bounded prior value, presenting uncertainty, escalating to a human or refusing the action. The receipt should name the chosen response and the evidence that it is safe.

Validate outcomes and selective observation

Describe how the target comes into existence, who is observed, who adjudicates it and which prior policy controls observation. Approved borrowers reveal repayment; investigated cases reveal confirmed fraud more often; contacted customers reveal response; treated patients reveal a treatment-specific outcome. A label can therefore encode a previous decision rather than the condition the new system intends to predict. Compare observed and eligible populations, identify delayed or contested outcomes and keep policy-generated labels distinct from independently established facts.

When outcomes are selective, choose an honest route. Collect a rights-aware random or exploratory sample where appropriate, use an independent measurement, narrow the claim to the observed population, redesign the action or reject the dataset. A proxy is acceptable only when the product statement names it and evidence connects it to the bounded purpose. For example, a low-risk tool may rank documents by a reversible relevance signal while a consequential eligibility decision cannot quietly replace the required outcome with staff attention or historical approval.

Trace provenance through transformations

Reconstruct the exact version from source extraction through filters, joins, deduplication, normalisation, enrichment, imputation and human amendment. For each transformation, record its owner, rationale, input version, output version, validation and known information loss. Row counts and reconciliation totals help expose silent attrition, while sampled lineage explains why individual values changed. Provenance should extend to external data and annotations, including contractual source, collection instructions, annotator population, disagreement and adjudication. A pipeline diagram alone cannot show whether the transformation preserved the meaning required by the decision.

Make corrections appendable and time-aware where audit or reconstruction matters. Overwriting a value may improve the current record while corrupting historical evaluation. Preserve the former value, reason, evidence, author and effective time according to the retention boundary. When complete lineage cannot be recovered, state the gap. A restricted experiment may remain possible, but the product should not present unexplained derived facts as observed truth. For a material decision, missing provenance that prevents validation is a gate.

Separate rights from availability

Create a purpose and entitlement matrix for each source and derived field. It should identify the permitted processing, prohibited inference, authorised roles, affected users, territorial or contractual limits, retention and deletion route. Test retrieval as several users rather than only as an administrator. Confirm that derived stores, caches, vector indexes, exports and logs do not broaden access or outlive the source rule. When purpose or entitlement is disputed, restrict the source while the accountable legal, privacy and business owners resolve it. Product urgency does not turn technical reach into permission.

Qualify the data service

Exercise the data under production conditions. Measure availability and latency at the decision deadline, schema and identifier stability, late arrivals, duplicate delivery, repair time and change notice. Simulate a missing source, a stale partition, an incompatible value and a revoked entitlement. Verify that the product detects each condition and enters its declared fall-back instead of producing a confident answer from partial context. Name the service owner and escalation route. Evidence from a one-off extract does not establish that a continuously changing service will support the same decision tomorrow.

Close the loop with decision evidence

Evaluation should mirror the declared population, timing, information availability, action and consequence. Report cohort coverage, abstention, override and data-failure behaviour alongside task performance. In production, monitor source distributions, missingness reasons, join attrition, clock delays, entitlement failures and outcome opportunity. Connect each signal to a threshold, owner and response. Some change requires repair; some requires collecting evidence; some restricts use; some invalidates the dataset for that decision. Monitoring is useful only when it can change the route.

Set an expiry even when no alarm fires. Business definitions drift, workflows change and populations enter through new channels. At expiry, compare the current source, adapter and decision with the version named on the receipt. Re-run the affected tests and product evaluation, then renew, narrow or retire the use. This keeps the contract proportional: a bounded, reversible use can rely on lighter evidence and a shorter review; a severe or irreversible action needs stronger reconstruction, subgroup evidence, rights assurance and operational proof. In both cases, the claim remains about a relationship, never about a permanently ready dataset.

The review meeting should end with named evidence and ownership rather than a general endorsement. Record which test passed, which condition made it pass, who can attest to that condition and what event would invalidate it. Include unresolved source conflicts, excluded cases and unresolved uncertainty instead of moving them into private notes. A product owner can then decide whether to narrow the action, fund a repair, collect evidence or abandon the source. A reviewer can reproduce the route without relying on the original team's memory.

An operator can recognise when a live incident is a data-fitness failure rather than a model defect. This practical trace also improves reuse: another team may adopt the governed core and its verified controls, while seeing immediately which population, timing, outcome and permission claims must be established again for its own decision.

Interactive instrumentAI Data Fitness Examiner

Set the proposed decision and actual data conditions. The Examiner returns one of five routes with the failed test and required evidence. It does not calculate readiness.

Five routesWhat the data decision permits

Use within the declared decision boundary

Permit only the specified population, time, action and purpose. Preserve the adapter, monitoring, prohibited inference and expiry. New decisions require new qualification.

Repair semantics, quality or temporal rules

Use when meaning, mapping, missingness treatment, joins, freshness or service controls can be corrected without new outcome evidence. Re-run evaluation after repair.

Collect, label or enrich the missing evidence

Use when population, outcome, rare cases or selective observation prevent a valid decision. Design collection with rights and affected-party burden in view.

Restrict use until rights, entitlement or provenance are resolved

Stop retrieval or reuse when purpose, contractual rights, user access, lineage or retention is uncertain. Technical availability does not authorise use.

Reject this dataset for the proposed AI decision

Reject when meaning contradicts the decision, consequential coverage is unknowable, outcome is invalid, service cannot meet the horizon or prohibited use cannot be controlled.

Route testsTen cases the Examiner distinguishes

Fit for decision: a governed core and adapter declare population, time, entitlement, provenance, gaps, evidence and expiry.

Billing status: the latest accurate status cannot reconstruct the earlier decision. Repair effective-time logic or reject retrospective use.

Selective label: repayment exists only after approval. Collect independent evidence rather than labelling rejection as failure.

Semantic collision: legal entity and active relationship share one name. Repair identities and denominators before joining.

Missingness signal: blanks cluster by channel. Repair collection and preserve the signal before imputation.

Stale source: ingestion is current, but the fact lacks effective time and has aged beyond the decision horizon. Repair or reject.

Access without rights: engineers can query the source, but the proposed purpose is not permitted. Restrict use.

Cohort gap: average completeness is high while an affected minority lacks necessary evidence. Collect or narrow the action.

Low-risk summary: current, entitled sources with citations support reversible summarisation without enterprise-wide remediation.

Reject dataset: wrong meaning, prohibited use and absent decision evidence make further cleansing irrelevant to the proposed action.

Versioned decision recordIssue and retire the fitness receipt

The receipt records decision, user, affected party, consequence, action, population and exclusions; sources, owners and purposes; semantic mapping; coverage and missingness; five time rules; outcome mechanism; selective-observation risk; lineage and uncertainty; rights and retention; service level; permitted use; prohibited inference; repair owner; change triggers and expiry.

Do not report a readiness percentage. Show each gate and its evidence. A dataset can pass service and fail rights, pass completeness and fail population, or pass source accuracy and fail semantics. Leadership needs the failing relationship and route, not a reassuring average.

Receipts expire when the decision, workflow, collection purpose, population, source semantics, timing, transformation, entitlement, model interaction or outcome changes. Production monitoring should link anomalies and incidents to the active receipt. Repair can renew it only after the affected tests and product evaluation pass.

Retire a receipt when the use ends or evidence can no longer support it. Remove derived access and decision adapters, address retained data by purpose and preserve required audit evidence. A once-fit dataset does not remain authorised or meaningful forever.

Evidence boundaryData quality, documentation and scoped duties

Data-quality research establishes that quality is multidimensional and contextual to consumer tasks. Data-cascade and data-centric work shows how upstream choices and maintenance affect downstream systems. Dataset, data-card, data-statement and readiness-report sources support structured documentation for different audiences. Documentation remains evidence, not permission or proof.

Selective-label research establishes the problem of outcomes observable only after prior decisions. Dataset-shift work supports caution about calibration and uncertainty outside evaluation conditions. Neither supplies a universal repair. NIST AI RMF sources provide lifecycle, context, data, population, privacy and monitoring guidance; AI RMF 1.0 remains the published framework while revision is in progress.

ISO/IEC 25012:2008 was last reviewed and confirmed in 2025 and remains current; its general characteristics vary in importance by context. ISO/IEC 5259-1:2024 and 5259-4:2024 provide ML data-quality terminology and process context. EU AI Act Article 10 applies within the Act's relevant high-risk-system, role, provision and timing scope. Standards and regulation do not certify a specific dataset as fit.

The eight-test contract, governed-core adapter, receipt and Examiner are this article's synthesis. Source accuracy, data quality, decision fitness, technical access, permission and legal compliance remain distinct. Prove fitness through the declared decision and keep the result bounded and expiring.