Separate dimensions
Agency / behavior
What did the agent actually do, and across which boundary?
Evidence
How strongly is the qualifying behavior established?
Authorization
What was explicitly or reasonably permitted, and what exceeded that scope?
Consequence
What real-world effect occurred? Harm does not silently raise the agency level.
Safety response
Prevention, detection, containment, termination, auditability and disclosure are recorded separately.
Audit context
Independent access, source completeness and redaction status are recorded because external review may still be constrained.
Evidence grades
| Grade | Working definition |
|---|---|
| E0 — Unverified | A claim or signal exists, but authenticity, attribution or load-bearing facts are not sufficiently established. |
| E1 — Plausible | At least one credible source supports the event, but material facts remain single-source, disputed or weakly attributable. |
| E2 — Corroborated | Multiple credible sources, an affected-party investigation, or a strong first-party technical report supports the event, but independent auditability remains incomplete. |
| E3 — Observatory Verified | All four verification conditions below are met. Only E3/E4 records may advance the public Agency Level. |
| E4 — Independently auditable / reproducible | E3 plus enough artifacts, logs, methods or reproducible evidence for meaningful third-party audit or reproduction. |
E3 verification rule
- Event identity. Event, system, time window and affected environment are sufficiently identified.
- Qualifying behavior. The behavior required by the proposed Agency Level is directly supported by primary technical evidence, an affected-system operator, or mutually corroborating high-quality sources.
- Authorization boundary. The record establishes what was permitted and why the qualifying behavior exceeded that scope.
- Alternative explanations. Plausible explanations that would negate the classification have been considered and do not better explain the evidence.
Normally, at least one of the following should also be present: affected-party confirmation, independent forensic review, public technical artifacts/logs, or independent evaluator confirmation. A company statement alone can establish E2 but should normally not establish E3 when the company is the sole holder and interpreter of the evidence.
Record types
REAL_WORLD_INCIDENT — qualifying behavior affected a real external system or party.
INTERNAL_TRAINING / EVALUATION INCIDENT — behavior exceeded intended internal or evaluation boundaries.
DEMONSTRATED_CAPABILITY — a behavior was deliberately elicited or benchmarked; it is not evidence of spontaneous real-world occurrence.
DISCLOSURE / GOVERNANCE RECORD — institutional response, policy, notification or evidence-governance development.
PROVISIONAL NOTICE — a credible report exists, but material attribution or outcome is not yet established.
Public clock rule
Safety-response dimensions
The earlier single 0–10 total remains unvalidated. Public assessment should show components separately: prevention, detection, containment, termination/pause, auditability, disclosure/incident response, governance, and international coordination.