METHOD
Built to be checked.
KnightGrid does not ask you to trust a score. It records which company was assessed, what evidence was tested, what the rules computed and who approved. Someone who wasn't in the room can then check the approval.
DECISION PROPERTIESKG-2026-04-1184
01EntityResolved to registered companyconfirmed
02EvidenceTested against scoped controls20 of 22
03SignalComputed by fixed rulesamber
04ApprovalSigned by a named ownerA. Morgan
05RecordFrozen and hashed7f4a…91c2
Illustrative record · KG-2026-04-1184
THE DISTINCTION
Activity is not a decision.
Sending a questionnaire, collecting documents and clicking approve are all activities. They show that work happened. They don't show that the approval was justified. A decision is defensible only when someone else can reconstruct why it was made from the record alone.
A questionnaire was completed
Each answer was tested against evidence
A vendor name was entered
The registered legal entity was confirmed
An approver clicked approve
A named person signed, with conditions, on a frozen record
The file was saved
The record was sealed and can be replayed
FOUR CONDITIONS
Four conditions of a defensible decision.
An approval that meets all four can be explained to an auditor, a regulator or a successor. One that misses any of them has to be pieced together later from memory.
01 / ENTITY
The right company, by registration.
Assessments attach to a registered legal entity, confirmed by company number against Companies House, not to a trading name. Evidence issued to a different entity is flagged, not quietly accepted.
AUDITOR ASKSWhich company did you actually assess?
RECORD SHOWSThe registered name, the company number and how the match was confirmed.
ENTITY RESOLUTIONKG-2026-04-1184
CANONICAL LEGAL IDENTITY
- Registered nameCastor Payments
- Company number12947013
- Match methodBy company number
02 / COVERAGE
Evaluated evidence, not collected evidence.
Each piece of evidence is recorded with two things: what kind of assurance it gives, and which required controls it actually covers. A strong certificate says nothing about controls outside its scope. Both are visible, so a gap can't hide behind one good document.
AUDITOR ASKSWhat supports this control?
RECORD SHOWSThe evidence linked to each control, its type, and any control with nothing behind it.
EVIDENCE COVERAGE22 CONTROLS SCOPED
EVIDENCE · CONTROLS COVERED
- SOC 2 Type IIIndependent · 14
- Signed DPAContractual · 3
- Independent penetration testIndependent · 2
- IR plan and exerciseTested · 1
- Not evidenced2 controls
03 / RECORD
Frozen at the moment of approval.
When the approval is signed, the inputs, the computed signal, the reviewer's actions and the conditions are frozen together and sealed with a SHA-256 hash. Later changes create a new record. They never edit the old one.
AUDITOR ASKSIs this what you knew at the time?
RECORD SHOWSA sealed record with its timestamp and hash, unchanged since signing.
SEALKG-2026-04-1184 · v1
- Sealed22 APR 2026 · 14:32 UTC
- Signed byA. Morgan · SMF24
- SHA-2567f4a…91c2
- StatusINTACT
04 / DERIVATION
An outcome you can derive again.
The signal is computed by fixed rules from the recorded inputs. Run the same inputs through the same rule version and you get the same result, regardless of who runs it or when.
AUDITOR ASKSWould you reach the same result again?
RECORD SHOWSThe rule version used, and a replay that reproduces the signal.
REPLAYKG-2026-04-1184 · v1
- Rule versionr-2026.04
- Original signalAmber
- Replayed signalAmber
- ResultMATCH
DETERMINISM
Rules compute. People decide.
Determinism here is a legal requirement, not a technical preference. If the same facts could produce different outcomes on different days, no one could defend the outcome to a regulator. So the part that computes is fixed, and the part that judges is named.
COMPUTED BY RULES
- Tier, from the exposure profile
- Required control scope
- Control outcomes
- The computed signal
DECIDED BY A PERSON
- Accepting evidence
- Setting conditions
- Overriding a gate, with a reason
- Signing the approval
The signal is never edited by hand. Disagreement with it is recorded as a decision, not hidden as a correction.
HARD GATES
Some gaps cannot be averaged away.
A small number of conditions act as gates. If one fails, strong results elsewhere don't offset it, and the signal can't clear. An unconfirmed legal entity is one example.
A gate can be overridden, but only as a structured decision: a named owner, a stated reason and a review date, all written into the record.
GATE CHECKEXAMPLE
Legal entity confirmedFAILED
↓
SignalCANNOT CLEAR
↓
OVERRIDE REQUIRES
- Named owner
- Stated reason
- Review date
WHERE APPROVALS FAIL
Three ways an approval stops being true.
Entity Identity Mismatch
The assessment is attached to a name, and the name is attached to the wrong company.
ADDRESSED BY · 01 ENTITY
Coverage Illusion
One strong document makes a vendor look assessed on controls it never covered.
ADDRESSED BY · 02 COVERAGE
Timestamp Decay
The approval was right when signed. The evidence behind it has since expired or changed.
ADDRESSED BY · LIFECYCLE
REGULATORY FRAME
Written for the questions supervisors ask.
KnightGrid does not make a firm compliant. It produces the record that shows how a third-party decision was reached.
FAQ
Questions we expect from auditors.
Is the computed signal an approval?
No. It's an input to the decision. Only a named reviewer can approve.
Can a sealed record be changed?
No. New facts open a new assessment with its own record and hash, and the original stays as it was.
Can our auditors check a decision independently?
Yes. Auditors get read-only access to the record and can replay the signal.
What happens when a rule changes?
Each record keeps the rule version it was computed with, so earlier decisions replay under their original rules.
Does AI make the decision?
No. Document analysis helps extract facts and flag issues. It does not compute the signal or approve anything, and a reviewer accepts each piece of evidence.
Can we see the full rules?
Yes, under NDA, during due diligence.
Read first. Talk later.
Start with the whitepaper. When you're ready, we'll walk through a Decision Record on one of your own vendors.
