// FRAMEWORK · v1.1
The FDE Evidence Ladder
The FDE Evidence Ladder is my checklist for reviewing evidence in a deployed AI system: retrieved sources, citation checks, numerical verification, abstention and operating controls. Each rung asks for an artifact that another engineer can inspect. It is not a certification or a legal compliance assessment.
By Adam Boudjemaa · v1.1 · Published 2026-07-21 · CC BY 4.0
The nine rungs
A system earns a rung with a verifiable artifact, not a promise. Rungs 2 to 5, markedSPINEcover the verification sequence from my deployment. The other rungs cover supporting practices. Check the artifacts and their test coverage; a checklist cannot cover every risk.
- Rung 8Documented controls & ownershipSTANDARD PRACTICE
The team documents applicable controls, supporting evidence, unresolved gaps and the person responsible for each decision.
A control register, named owners and review records. NIST AI RMF can organize the discussion; using it does not certify a deployment.
- Rung 7Governed & operableSTANDARD PRACTICE
Access is scoped, the system is observable, cost is capped, and failures have a defined recovery path.
Access control + data-scope limiting, audit trail, cost caps / model routing, human escalation.
- Rung 6Evaluated & red-teamedSTANDARD PRACTICE
An offline eval suite and a reference dataset gate regressions; adversarial cases are covered.
A regression eval harness plus prompt-injection / adversarial coverage. Standard practice.
- Rung 5Abstention-capableVERIFICATION
On insufficient or conflicting evidence, the system declines or escalates instead of guessing.
An evidence-gated abstention path. The honesty rung: saying 'I don't have enough to answer.'
- Rung 4Numerically consistentVERIFICATION
Every figure is reconciled against the source numbers.
A numeric-consistency check. Decisive in finance, where a wrong number is a real problem.
- Rung 3Faithfulness-checked (NLI)VERIFICATION
A natural-language-inference model checks whether the cited span supports the claim; this probabilistic check can itself be wrong.
A natural-language-inference check that blocks contradiction and neutral matches.
- Rung 2Verified citation (byte-level)VERIFICATION
Every claim maps to an exact, retrievable source span the reader can open.
Byte-level citation links, not a vague 'sources' footer. Open the span, see the sentence.
- Rung 1Grounded retrievalSTANDARD PRACTICE
Answers are grounded in retrieved sources, and retrieval quality is measured.
A RAG pipeline plus a retrieval eval (recall/precision on a reference set).
- Rung 0Demo-gradeSTANDARD PRACTICE
Plausible answers, no grounding guarantee.
A working demo on a clean, curated sample. Record what has and has not been tested.
Where this checklist comes from
I assembled this checklist from the citation, faithfulness, numerical and abstention checks I used in a production deployment. Retrieval evaluation, access control and operational ownership are established engineering practices. The checklist helps make those decisions reviewable; it does not establish that a system is safe in every situation.
For wider risk-management work, consult the NIST AI Risk Management Framework. Its use is voluntary; this checklist is not an assessment under NIST or ISO standards.
Use it
Use the score to organize a review of your own system. Record gaps and test results alongside it. Reuse is licensed under CC BY 4.0, which requires attribution (see "cite" below).
Cite this framework
Boudjemaa, Adam. "The FDE Evidence Ladder," v1.1. adam-boudjemaa.com, 2026-07-21. https://adam-boudjemaa.com/fde-evidence-ladder. Licensed CC BY 4.0.
Changelog
- v1.1 (2026-09-06) - Clarified probabilistic checks, control ownership and the limits of self-assessment. No certification or legal-compliance claim.
- v1.0 (2026-07-21) - First public release: 9 rungs (0-8), self-assessment, and machine-readable spec.