Worked scenario

The answer that could not have existed

At 09:02, a credit assistant at the fictional Northmere Bank recommends a thirty-day extension for Aster Components. The rule in force permits the extension when annual turnover is at least £4 million and the review has no unresolved mandatory exception. The ledger available to the assistant reports £4.2 million. Policy version 6 is effective. The assistant’s service identity may read the financial pack for the purpose credit-review, but it may not read a restricted investigation note.

The day continues. At 10:00, policy version 7 becomes effective and raises the threshold to £4.5 million. At 13:40, Finance corrects Aster’s turnover to £3.7 million. The correction is valid from the beginning of the quarter because the original figure was wrong, but the bank did not record the correction until after the decision. Months later, a reviewer asks an agent to explain the 09:02 recommendation.

The agent queries the current ledger, current policy store and every document the reviewer may now access. It concludes that Aster was below the threshold, version 7 required £4.5 million, and a restricted note raised a concern. Every retrieved item is genuine. The citations resolve. The explanation is still false as an account of the original decision, because it contains evidence, rules and permissions that were not part of the decision-time world.

A second replay restores the ledger to 09:02 but leaves today’s policy and entitlements in place. A third restores the policy but uses the corrected ledger. A fourth reconstructs all data and rules yet silently runs a newer extraction routine that interprets an old covenant code differently. Each replay looks historical. Each answers a different question.

The central answer is precise: a decision-time context is the intersection of what was valid, what had been recorded, what rules applied and what the acting principal was permitted to use for that purpose. A historical snapshot of one database is therefore necessary in many systems, but it is not sufficient.

Here d is decision time, v is the business time about which the decision was made, p is the principal chain and q is the approved purpose. V contains assertions valid for the business time. K contains assertions recorded by the institution before the decision. A contains rules effective and applicable to that decision type. E contains resources the named principal was authorised to use for the named purpose. The output is not merely a prompt. It is a decision-time epistemic slice: an operational account of what the system could know and lawfully use then.

One timestamp cannot answer four questions

Database practice has long distinguished valid time, when a fact holds in the represented world, from transaction time, when that fact is present in the database. A system that supports both is bitemporal.[1] The distinction matters because a late correction may change what is now believed about an earlier period without changing what the institution knew at that earlier moment. The temporal database literature gives a particularly sharp contrast: “what was true in 1980 as known now” and “what was believed about 1980 at the time” are different queries.[2]

Governed decisions add two more histories. Rules have publication, approval, effective and retirement intervals. Identities, roles, delegations, resource classifications and purposes also change. A current policy repository can tell a reviewer what should happen now while hiding what governed then. A current identity provider can prove that a reviewer has access now while saying nothing about the original service principal’s rights.

SQL:2011 standardised system-versioned and application-time tables, giving implementations a durable foundation for temporal querying.[3] Products expose useful forms of this machinery. Microsoft SQL Server can query system-versioned state with FOR SYSTEM_TIME AS OF, while Db2 documents tables that combine system and application periods.[9][10] Those mechanisms recover rows. They do not automatically recover the purpose, delegated actor, policy bundle, external tool output, parser version or evidence exclusions that shaped a decision.

The mistake is to treat these histories as four timestamps on one object. They are often stored by different owners, changed by different processes and retained for different periods. The customer fact may live in a ledger, the policy in a bundle registry, the grant in an identity system, and the extraction lineage in a document service. Reconstruction is therefore a governed join across histories, not a special query against one warehouse.

Four review questions that must not collapse

A reviewer can ask at least four legitimate questions about the same event. First, what evidence caused or supported the decision then? This needs the decision-time epistemic slice. Second, was the decision compliant with the rules then in force? This uses the same historical evidence but may add independent control tests and approval requirements. Third, what is the best supported conclusion now? This uses current evidence, current corrections and the rule appropriate to the present action. Fourth, what should the institution do about the difference? This is a remediation decision with its own authority and policy.

A single “replay” endpoint encourages these questions to blend. The reviewer may intend a causal explanation while the system supplies a current reassessment. Or the system may faithfully recreate the old context when the real question is whether a customer must now be contacted. A governed interface therefore requires an explicit review_mode, such as decision_time, contemporaneous_compliance, current_evidence or remediation. Each mode has different temporal coordinates and admission rules.

This separation also prevents an ethical mistake. Preserving an obsolete or incorrect assertion for historical explanation does not grant it continuing authority. The record should be marked superseded, excluded from current decisions and retained only under the applicable evidence and retention controls. Historical availability is not current validity. The purpose of keeping the old state is to explain institutional action and diagnose process failure, not to perpetuate the error.

The historical decision time-lens

The lens prevents two opposite errors. The first is historical presentism: judging an earlier decision only with later truth. The second is historical insulation: pretending that later corrections do not matter at all. A good review produces at least two views. The decision-time view explains what could support the original action. The current-evidence view states what is believed now and whether remediation is required. They may disagree without either being defective.

This distinction is especially important when a correction is backdated. In a bitemporal grid, the corrected row can cover the same valid interval as the original row while entering the database later. Querying only the business date returns the correction. Querying only the system state at 09:02 may return the original row, but still miss which rule and entitlement applied.

flowchart LR
  A["The answer that could not have<br/>existed"] --> B["One timestamp cannot answer<br/>four questions"]
  B --> C["The historical decision time-lens"]
  C --> D["A reconstruction kernel, not a<br/>forensic search prompt"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#007D68,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

A reconstruction kernel, not a forensic search prompt

A retrospective prompt such as “find everything relevant to this decision on 18 June” delegates the hardest controls to semantic similarity. It can retrieve a superseded procedure because the words still match. It can include a later correction because the document refers to the same period. It can broaden access under the reviewer’s identity. It can omit a failed source query and still produce fluent prose.

The safer pattern is deterministic until the evidence boundary is fixed. A reconstruction request names the decision identifier, decision time, business-time target, decision type, principal chain, approved purpose and required source classes. The kernel resolves four predicates before a language model sees content:

1. Temporal predicate: select the version whose valid and recorded intervals contain the requested coordinates.
2. Applicability predicate: select the policy revision effective for the entity, jurisdiction, product, channel and decision type.
3. Authority predicate: evaluate historical access for the original requester, agent, delegate and purpose, with default deny.
4. Evidence contract: require named source classes, reject silent partial assembly and record every exclusion or unresolved conflict.

Attribute-based access control formalises authorisation in terms of subject, object, operation and environment attributes evaluated against policy.[5] That model helps define the entitlement predicate, but a current policy decision is not a historical grant record. The system must preserve either the decision receipt and policy revision or enough historical attributes and policies to recompute the result. Delegation also matters. RFC 8693 distinguishes a service acting as itself on behalf of a user from impersonating that user, and composite tokens can carry both subject and actor.[8] A replay that records only the end user erases who actually exercised authority.

Policy engines already expose useful ingredients. Open Policy Agent decision logs can include a decision identifier, input, result, timestamp and policy bundle revision.[6] Cedar separates policy from application code and supports validation and formal analysis of policy behaviour.[7] Neither tool can infer a missing historical customer record, a deleted entitlement or an unrecorded purpose. A policy receipt proves what the evaluator decided from supplied inputs; it does not prove that the inputs were complete or historically correct.

Provenance is the connective tissue. W3C PROV models entities, activities and agents, including use, generation, derivation and responsibility relations.[4] A reconstruction system can use those concepts to say that a claim came from a particular source version, through a named extraction activity, under a specific parser and schema, before entering a context. This does not require RDF everywhere. It requires the equivalent semantics to survive in the evidence ledger.

The kernel should preserve claims as typed assertions rather than detached text. Each assertion needs a subject, predicate, value, valid interval, recorded interval, source version, classification, derivation and confidence or status where relevant. A policy clause is another versioned entity. An authorisation decision is an activity with a principal, resource, action, purpose, environment and result. The reconstruction itself is an activity that consumes exact versions and generates a manifest.

The context receipt records inclusion and refusal

A traditional audit log says that a request occurred. A governed context receipt says what evidence entered the decision interface, why it was admitted, what was excluded, what failed to load and which versions controlled those decisions. Exclusion is evidence. Without it, a reviewer cannot distinguish “the source contained nothing” from “the source was not queried”, “the principal lacked authority”, “the item was superseded” or “the connector timed out”.

Hashing a receipt makes later alteration detectable, but a hash does not establish truth. It proves that the recorded bytes have not changed, assuming the digest and anchoring process are trustworthy. It does not prove that the source was complete, the clock was correct, the policy was lawful or the principal attributes were genuine. Tamper evidence protects a claim about history; it does not manufacture the missing history.

Completeness is relative to the decision claim

No context can contain everything. Completeness must therefore be defined against a typed claim and a versioned evidence contract. To explain a temporary limit extension, the contract may require current exposure, approved turnover, covenant state, policy version and exception authority. It may treat a marketing preference as irrelevant. For a vulnerability decision, the required classes would be different. The receipt should identify the contract revision so that a later reviewer can tell whether the reconstruction satisfied the standard that governed at the time.

This turns missingness into a testable property. If a mandatory ledger query times out, the kernel refuses to certify a complete slice. If an optional source is absent, the receipt states why the defined claim remains decidable without it. If sources conflict, the system preserves both assertions and invokes the conflict rule rather than choosing whichever text ranks first. An empty result is never silently converted into “no issue”. It may mean no matching assertion, no authorised assertion, an unavailable source, an expired record or an unexecuted query.

The completeness contract should itself evolve under change control. Adding a new mandatory source changes the evidence necessary for future decisions, but should not be projected backwards as though earlier decisions had violated a rule that did not yet exist. A contemporaneous-compliance review uses the historical contract. A present control-gap assessment may compare it with the current contract and record the delta.

Two thought experiments and a negative control

Thought experiment one: move only the correction

Keep the customer, policy, principal, evidence content and decision fixed. Vary one feature: the correction’s recorded time. In world A, the £3.7 million correction enters at 08:55. In world B, it enters at 13:40. The correction has the same valid-from date in both worlds. A valid-time-only query returns £3.7 million for both. A governed reconstruction returns £3.7 million in world A and £4.2 million in world B.

The experiment isolates institutional knowledge. If a system returns the same historical context in both worlds, it cannot explain what was knowable at decision time. If it always returns the older value, it cannot incorporate a correction that was already known. The correct selection depends on both coordinates.

Thought experiment two: lend the reviewer’s key

Now hold all data and times fixed. Vary only the principal. The original credit assistant may read the financial pack but not an investigation note. The audit reviewer may read both. The reviewer asks, “Why did the assistant recommend the extension?” A reconstruction executed under the reviewer’s current identity will retrieve more information than the assistant could use. That may help the reviewer assess present risk, but it cannot be inserted into the causal account of the earlier recommendation.

The solution is not to hide the note from the audit. It is to separate views. The decision-time context is evaluated under the original principal chain and purpose. A second reviewer context may contain additional authorised evidence, clearly marked as review-time information. Audit authority may widen inspection; it must not rewrite historical admissibility.

Worked example: the smallest useful reconstruction

Consider one fact and one rule. A customer’s turnover is recorded as £4.2 million at 08:15. At 09:02, policy version 6 requires at least £4 million. At 13:40, the ledger records a correction to £3.7 million, valid from the start of the quarter. At 10:00, version 7 raises the threshold to £4.5 million. The decision-time query must select the original row and version 6. A current-state query selects the correction and version 7.

The two defensible results are not a contradiction. They serve different decisions. The historic result may show that the assistant acted consistently with then-known evidence. The current result may require the bank to withdraw or reassess the extension. The hybrid result is dangerous because its components are individually accurate yet temporally incoherent.

Negative control: when a snapshot is enough

Full reconstruction is not automatically superior. Suppose a service counts signed, append-only payment acknowledgements for operational analytics. Events are immutable, corrections arrive only as new events, one public rule has remained unchanged, all analysts share the same read permission, and no action is authorised from the count. A system-time snapshot plus event hashes and a versioned query may reproduce the relevant state without separate policy and entitlement histories.

This negative control matters. It shows that the proposed architecture earns its cost only when at least one omitted history can change admission or interpretation. If a team cannot construct a paired test in which a correction, policy revision, principal change or transformation version alters the answer, the full kernel may be unnecessary. The baseline is the cheapest mechanism that preserves the decision distinction, not the most elaborate ledger.

stateDiagram-v2
  [*] --> Claim
  state "Four review questions that<br/>must not collapse" as Claim
  state "Completeness is relative to<br/>the decision claim" as Test
  state "Thought experiment one: move<br/>only the correction" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Executable artefact: a bitemporal reconstruction harness

The following standard-library Python harness implements the four-way test on synthetic data. It selects assertions by business-valid and recorded intervals, selects the policy effective at decision time, applies purpose-bound entitlement with default deny, records exclusion reasons and hashes the resulting context receipt. The positive test proves that a late correction does not rewrite the 09:02 evidence state. The negative test proves that valid and known evidence is still excluded when the original purpose lacked permission.

The harness deliberately does not call a language model. Its job is to establish a deterministic evidence boundary that a model may later summarise or reason over.

"""A minimal governed context reconstruction harness.

The data are synthetic. The harness separates:
1. business validity,
2. institutional knowledge (recorded time),
3. policy applicability, and
4. historical permission for a named principal and purpose.

Run with: python3 bitemporal_reconstruction.py
"""

from __future__ import annotations

from dataclasses import asdict, dataclass
from datetime import datetime
from hashlib import sha256
import json
from typing import Any, Iterable

UTC_SUFFIX = "Z"
FAR_FUTURE = "9999-12-31T23:59:59Z"


def ts(value: str) -> datetime:
    """Parse the compact ISO-8601 form used by this synthetic example."""
    if value.endswith(UTC_SUFFIX):
        value = value[:-1] + "+00:00"
    return datetime.fromisoformat(value)


def contains(start: str, end: str, point: str) -> bool:
    """Return True for a half-open interval [start, end)."""
    return ts(start) <= ts(point) < ts(end)


@dataclass(frozen=True)
class Assertion:
    assertion_id: str
    subject: str
    predicate: str
    value: Any
    resource_class: str
    source_version: str
    valid_from: str
    valid_to: str
    recorded_from: str
    recorded_to: str = FAR_FUTURE


@dataclass(frozen=True)
class Policy:
    policy_id: str
    threshold: float
    effective_from: str
    effective_to: str
    recorded_from: str
    recorded_to: str = FAR_FUTURE


@dataclass(frozen=True)
class Grant:
    grant_id: str
    principal: str
    purpose: str
    resource_class: str
    allowed: bool
    effective_from: str
    effective_to: str
    recorded_from: str
    recorded_to: str = FAR_FUTURE


@dataclass(frozen=True)
class ReconstructionRequest:
    decision_id: str
    principal: str
    purpose: str
    decision_time: str
    business_time: str


def known_and_valid(assertion: Assertion, request: ReconstructionRequest) -> bool:
    return contains(assertion.valid_from, assertion.valid_to, request.business_time) and contains(
        assertion.recorded_from, assertion.recorded_to, request.decision_time
    )


def applicable_policy(policies: Iterable[Policy], request: ReconstructionRequest) -> Policy:
    candidates = [
        p
        for p in policies
        if contains(p.effective_from, p.effective_to, request.decision_time)
        and contains(p.recorded_from, p.recorded_to, request.decision_time)
    ]
    if len(candidates) != 1:
        raise ValueError(f"Expected exactly one policy, found {len(candidates)}")
    return candidates[0]


def permitted(
    assertion: Assertion,
    grants: Iterable[Grant],
    request: ReconstructionRequest,
) -> bool:
    candidates = [
        grant
        for grant in grants
        if grant.principal == request.principal
        and grant.purpose == request.purpose
        and grant.resource_class == assertion.resource_class
        and contains(grant.effective_from, grant.effective_to, request.decision_time)
        and contains(grant.recorded_from, grant.recorded_to, request.decision_time)
    ]
    # Default deny. An explicit deny dominates an allow.
    return bool(candidates) and all(grant.allowed for grant in candidates)


def reconstruct(
    assertions: Iterable[Assertion],
    policies: Iterable[Policy],
    grants: Iterable[Grant],
    request: ReconstructionRequest,
) -> dict[str, Any]:
    included: list[Assertion] = []
    excluded: list[dict[str, str]] = []

    for assertion in assertions:
        if not contains(assertion.valid_from, assertion.valid_to, request.business_time):
            excluded.append({"assertion_id": assertion.assertion_id, "reason": "not_valid"})
        elif not contains(assertion.recorded_from, assertion.recorded_to, request.decision_time):
            excluded.append({"assertion_id": assertion.assertion_id, "reason": "not_known"})
        elif not permitted(assertion, grants, request):
            excluded.append({"assertion_id": assertion.assertion_id, "reason": "not_permitted"})
        else:
            included.append(assertion)

    policy = applicable_policy(policies, request)
    context_payload = {
        "request": asdict(request),
        "policy": asdict(policy),
        "included": [asdict(item) for item in included],
        "excluded": excluded,
    }
    canonical = json.dumps(context_payload, sort_keys=True, separators=(",", ":"))
    context_payload["context_sha256"] = sha256(canonical.encode("utf-8")).hexdigest()
    return context_payload


def evaluate_turnover(context: dict[str, Any]) -> bool:
    turnover = [
        item["value"]
        for item in context["included"]
        if item["predicate"] == "annual_turnover_gbp_m"
    ]
    if len(turnover) != 1:
        raise ValueError(f"Expected exactly one turnover assertion, found {len(turnover)}")
    return float(turnover[0]) >= float(context["policy"]["threshold"])


ASSERTIONS = [
    # Original value, valid for the quarter and known before the 09:02 decision.
    Assertion(
        "turnover-original",
        "Aster Components Ltd",
        "annual_turnover_gbp_m",
        4.2,
        "credit-financial",
        "ledger-v41",
        "2026-04-01T00:00:00Z",
        FAR_FUTURE,
        "2026-06-18T08:15:00Z",
        "2026-06-18T13:40:00Z",
    ),
    # A late correction is backdated in business time, but was not known at 09:02.
    Assertion(
        "turnover-correction",
        "Aster Components Ltd",
        "annual_turnover_gbp_m",
        3.7,
        "credit-financial",
        "ledger-v42",
        "2026-04-01T00:00:00Z",
        FAR_FUTURE,
        "2026-06-18T13:40:00Z",
    ),
    # This note existed before the decision, but the credit-review purpose could not use it.
    Assertion(
        "restricted-note",
        "Aster Components Ltd",
        "investigation_note",
        "Unverified linked-party allegation",
        "investigation-restricted",
        "case-v9",
        "2026-06-18T07:50:00Z",
        FAR_FUTURE,
        "2026-06-18T08:20:00Z",
    ),
]

POLICIES = [
    Policy(
        "credit-extension-v6",
        4.0,
        "2026-01-01T00:00:00Z",
        "2026-06-18T10:00:00Z",
        "2025-12-15T12:00:00Z",
    ),
    Policy(
        "credit-extension-v7",
        4.5,
        "2026-06-18T10:00:00Z",
        FAR_FUTURE,
        "2026-06-18T08:30:00Z",
    ),
]

GRANTS = [
    Grant(
        "grant-financials",
        "agent:credit-assist-7",
        "credit-review",
        "credit-financial",
        True,
        "2026-01-01T00:00:00Z",
        FAR_FUTURE,
        "2025-12-20T00:00:00Z",
    ),
    # Explicit deny is retained to make the negative case visible in the manifest.
    Grant(
        "deny-investigation-note",
        "agent:credit-assist-7",
        "credit-review",
        "investigation-restricted",
        False,
        "2026-01-01T00:00:00Z",
        FAR_FUTURE,
        "2025-12-20T00:00:00Z",
    ),
]

HISTORICAL_REQUEST = ReconstructionRequest(
    "decision-0902",
    "agent:credit-assist-7",
    "credit-review",
    "2026-06-18T09:02:00Z",
    "2026-06-18T09:02:00Z",
)

CURRENT_STATE_REQUEST = ReconstructionRequest(
    "naive-current-replay",
    "agent:credit-assist-7",
    "credit-review",
    "2026-06-18T14:00:00Z",
    "2026-06-18T14:00:00Z",
)


def main() -> None:
    historical = reconstruct(ASSERTIONS, POLICIES, GRANTS, HISTORICAL_REQUEST)
    current = reconstruct(ASSERTIONS, POLICIES, GRANTS, CURRENT_STATE_REQUEST)

    historical_ids = {item["assertion_id"] for item in historical["included"]}
    historical_exclusions = {item["assertion_id"]: item["reason"] for item in historical["excluded"]}

    # Positive case: the late correction must not rewrite what was knowable at 09:02.
    assert "turnover-original" in historical_ids
    assert "turnover-correction" not in historical_ids
    assert historical_exclusions["turnover-correction"] == "not_known"
    assert historical["policy"]["policy_id"] == "credit-extension-v6"
    assert evaluate_turnover(historical) is True

    # Negative case: valid and known is still insufficient when the purpose lacked authority.
    assert "restricted-note" not in historical_ids
    assert historical_exclusions["restricted-note"] == "not_permitted"

    # A current-state replay reaches a different answer for legitimate temporal reasons.
    assert current["policy"]["policy_id"] == "credit-extension-v7"
    assert evaluate_turnover(current) is False

    print("Historical reconstruction")
    print(json.dumps(historical, indent=2))
    print("\nDecision under historical context: ELIGIBLE")
    print("Decision under current-state replay: NOT ELIGIBLE")
    print("Negative case: restricted-note excluded as not_permitted")


if __name__ == "__main__":
    main()

The code exposes three design choices that prose can hide. First, all intervals are half-open, so a version ending at 10:00 and a successor beginning at 10:00 do not overlap. Second, missing grants deny access. Third, the manifest contains exclusions, not only included records. A production harness should add clock provenance, policy scope resolution, source completeness, cryptographic signing, retention controls, schema evolution and evidence conflict handling.

Reconstruction can fail honestly or succeed falsely

The most important failure boundary is simple: the system cannot reconstruct state that was never captured or was overwritten without history. A current-only customer table cannot reveal the row an agent saw last year. An identity platform that retains only today’s group membership cannot prove a historical grant. A policy wiki without effective intervals cannot distinguish publication from applicability. A remote API whose response was neither retained nor reproducible leaves an evidential hole.

When evidence is missing, the output should not be a best-effort historical narrative. The reconstruction should carry one of four statuses:

• Reconstructed: all mandatory histories and lineage checks passed.
• Partial: named optional evidence is missing, but the defined decision claim remains testable.
• Indeterminate: missing or conflicting evidence could change the decision.
• Impossible: a required history was overwritten, deleted or never recorded.

These statuses are stronger than a generic confidence score because they identify the type of epistemic defect. A model may be highly confident while reasoning over an impossible reconstruction. Conversely, a fully reconstructed context may still support an uncertain substantive decision.

Clock quality is another boundary. If event time, ingestion time and policy effective time use unsynchronised systems without known offsets, precise ordering may be impossible. Use an interval or partial order rather than inventing precision. If two events can only be ordered as “possibly before the decision”, the context must preserve that ambiguity.

Schema and transformation drift can also create false success. A stored document may be intact while a new parser extracts a different value. A code list may be redefined. A model may normalise an entity differently. Therefore the receipt should bind not only source bytes but the transformation chain used to turn them into assertions. W3C provenance provides a vocabulary for that chain, while model-risk guidance in banking emphasises data relevance, inputs, assumptions and testing against intended use.[12]

Finally, context reconstruction does not reproduce the model’s output. Exact behavioural replay may additionally require the model version, weights or provider release, prompt, decoding parameters, tool responses, runtime, seeds where meaningful and non-deterministic dependencies. Even then, external services or changed hardware can prevent bit-for-bit reproduction. This paper reconstructs the admissible input context. Trajectory and counterfactual replay are broader problems.

Logs are obligations, not the whole design

Some regulated settings require logs to be generated or retained. The consolidated EU AI Act, for example, sets logging and retention duties for high-risk AI systems within the control of providers and deployers.[11] Such requirements strengthen the case for durable records, but they do not prescribe this architecture or guarantee that a log captures historical policy, purpose and entitlement. Legal applicability and retention periods must be assessed separately.

Recent agent-auditability research similarly treats action recoverability, policy checkability, responsibility attribution and evidence integrity as distinct conditions rather than one undifferentiated log.[13] The engineering consequence is practical: do not wait for an incident and then discover that the trace stored prompts but not source versions, or actions but not the authority that admitted them.

A decision instrument for adopting reconstruction

The architecture should be chosen by causal need, not by the prestige of the term “bitemporal”. For each consequential decision, run five paired tests. Change one historical dimension while holding the others fixed. If the decision, explanation or authority boundary can change, that dimension needs versioned evidence.

Use the result to select one of three patterns. A signed current snapshot is enough for immutable, public, low-consequence evidence with stable rules. A temporal evidence snapshot adds source and policy versioning when corrections or rule changes matter but entitlements do not vary. A governed decision-time reconstruction adds historical principal, purpose, policy, provenance and completeness when the action is regulated, disputed, irreversible or materially affected by access boundaries.

Production-shaped worked example

A bank implementing the full pattern for credit decisions would not copy every enterprise table into an audit store. It would define a reconstruction contract for each decision type. For a temporary limit extension, the contract might require the facility state, exposure, approved financial assertions, covenant status, policy bundle, exception authority and human approval state. Each required assertion points to the source version and transformation. The identity receipt records the requesting colleague, acting service, delegation and purpose. The policy receipt records the bundle and evaluation. The completeness manifest proves that every mandatory source either returned or caused the decision to stop.

At decision time, the platform stores the compact receipt and durable references, not necessarily all source content. Retention and privacy rules determine whether referenced content is preserved, rehydratable or tokenised. For fragile external sources, the system may need a content-addressed evidence capture because the URL or API can later change. For sensitive data, the architecture may retain a hash and controlled vault reference rather than replicate plaintext into broad logs. OPA itself supports masking selected input fields in decision logs, illustrating the need to balance auditability with data minimisation.[6]

During review, the reconstruction service verifies the receipt, resolves versions, re-evaluates historical applicability and authority where possible, and compares the rebuilt context hash. It then produces two outputs: the decision-time epistemic slice and a current-evidence delta. A human reviewer can see that the 09:02 recommendation was consistent with version 6 and £4.2 million, while the later correction and version 7 require a different current action. The system preserves accountability without confusing hindsight with foresight.

sequenceDiagram
  participant Q as Question
  participant M as Mechanism
  participant E as Evidence
  participant D as Decision
  Q->>M: The answer that could not have existed
  M->>E: Four review questions that must not collapse
  E-->>M: compare rival explanations
  E->>D: Make the knowable state a first-class product
  D-->>Q: revise scope or act

Make the knowable state a first-class product

Historical explanation fails when “as of” is treated as a cosmetic timestamp. A decision is situated inside several changing worlds: the world described by facts, the institution’s recorded knowledge, the rules that governed, and the authority held by a particular actor for a particular purpose. Querying today’s state can produce an accurate account of the present. It cannot, by itself, explain the past.

The architecture change is concrete. Define a reconstruction contract beside every consequential decision contract. Version assertions on valid and recorded time. Preserve policy revisions and their effective scope. Bind requester, actor, delegation and purpose. Record admission and exclusion reasons. Fail closed when mandatory evidence is missing. Generate a context receipt whose integrity and lineage can be checked later.

Then test the design adversarially. Move a correction across the decision boundary. Roll the rule version. Borrow the reviewer’s key. Substitute a parser. Remove one mandatory source. If the system returns the same historical context when the decision distinction should change, it is not reconstructing. If a negative control shows no meaningful difference, keep the cheaper snapshot.

The decision that changes is no longer “How long should we keep the prompt?” It is “Which histories must remain independently reconstructable for this action to be defensible?” That question moves context from transient model input to governed operating evidence.