Evidence Object
An Evidence Object is a single, tamper-evident record of a control-relevant event — a deploy, access request, test run, policy attestation — captured at the source, timestamped, attributed to an actor, and linked to the specific controls it satisfies.
Explanation
An Evidence Object is the atomic unit of Trust Infrastructure. Instead of screenshots assembled after the fact, Evidence Objects are generated as a byproduct of normal work — a GitHub merge, Okta login, or Playwright test execution creates the object automatically.
Each Evidence Object has: provenance (where it came from), integrity (tamper-evident storage), attribution (who/what created it), timestamp (when it happened), and control mapping (which controls it satisfies).
Why it matters
Evidence captured at the source cannot be backdated or reconstructed incorrectly — exactly what regulators (CBN, NDPC) and auditors require.
Atomic Evidence Objects enable mapping-once, reusing across many frameworks — the same object can satisfy a SOC 2 control, ISO 27001 control, and CBN AML requirement simultaneously.
How StackWeaver applies it
StackWeaver instruments engineering and operational systems to emit Evidence Objects automatically, then stores them in a tamper-evident way and maps them to controls.
Evidence Objects are combined into Evidence Packages for audits, regulators, investors, and partners.
Key points
Atomic unit of trust
Every Evidence Object is a single, verifiable record.
Source-captured
Generated automatically by the systems that run the business.
Tamper-evident
Alteration is detectable, not prevented — integrity is auditable.
What this relates to
- Evidence PackageA scoped, auditable collection of Evidence Objects mapped to a specific framework, engagement, or stakeholder request.
- Evidence ArchitectureThe three-layer model for how compliance evidence is created, connected, and consumed: Created & Captured → Stored & Connected → Verified & Consumed.
- Evidence-Native SystemsSystems where compliance proof is a property of how they operate — captured at the source — not a document produced under deadline.