Evidence graph · LendEasy Docs

Every decision is stored beside the exact facts, rule versions, and approvals that produced it, so a chain of causes can be replayed instead of reconstructed from timestamps.

An audit log says events happened. An evidence graph explains why one event caused another and which exact inputs supported it.

Every edge is an ID or a hash, never an adjacent timestamp. An examiner asked to accept an ordered list is being asked to guess; this shape answers why was this call allowed with the rule version and the facts it read.

Temporal proximity is never causation

Two records a second apart are a coincidence until something names the link.

Linked evidence does not become readable evidence

{
  "decisionId": "dec_CONTACT_81",
  "caseId": "case_HBR_COL_51",
  "action": "send_interaction",
  "outcome": "allowed",
  "facts": [
    {
      "name": "loan.daysPastDue",
      "value": 22,
      "source": "authoritative_core",
      "asOf": "2027-05-01T10:11:56-07:00",
      "freshness": "fresh"
    }
  ],
  "rules": [
    {
      "ruleId": "contact-time-CA-v4",
      "jurisdiction": "US-CA",
      "outcome": "pass",
      "effectiveVersion": "2027-01-01"
    }
  ],
  "requestedBy": "worker_ANA_4",
  "recordedAt": "2027-05-01T10:11:58-07:00"
}

Each fact carries its source, its asOf time, and its freshness, because a decision defended two years later has to show what was known at the moment it was made rather than what is true now. Sensitive values are referenced or masked according to export permission: linking a record into the graph does not make it readable to everyone who can traverse the graph.

Corrections add records, never edit them

Records are never edited and carry content digests. Evidence packages include a manifest of record IDs, versions, artifact SHA-256 values, generation time, and package digest, and any changed or missing item breaks verification. A package that still verified after a record was quietly removed would prove nothing at all — the point of the manifest is that a gap is loud. Corrections and supersessions are therefore added beside the original, which stays.

An exception never overwrites the block

An approval links actor, role, decision, reason, request hash, evidence, time, and separation-of-duties result. If policy permits an exception, the graph preserves both the original outcome and the approved exception scope. Replacing “blocked” with “allowed” would leave a record showing an action nobody ever had to justify, and the justification is the part worth keeping.

Evidence exports

The implemented GET /v1/servicing/cases/{caseId}/evidence-export returns an audited JSON examination bundle reconstructed from the retained causal records. GET /v1/servicing/customers/{customerRef}/evidence-export does the same across the customer’s visible cases.

POST /v1/servicing/cases/{caseId}/evidence-export produces asynchronous multi-format packages. A useful package contains:

case and workflow versions;
tasks, reservations, outcomes, and service-level times;
interactions and provider delivery evidence;
compliance decisions, where each fact came from, and rule versions;
promises, action requests, approvals, and acknowledgements;
document metadata and permitted artifacts;
reconciliation items and resolution evidence;
a manifest and integrity digests.

Exports are point-in-time snapshots with expiry and audit. They do not silently include restricted documents the requesting actor cannot read.

Tamper-evident does not mean infallible. The graph proves which records were preserved and linked; operational controls must still ensure source facts and human classifications are accurate.