Censio, explained

Censio is the layer between a machine judgment and the decision made on it. Machines now make judgments that matter: whether a payment clears, whether a claim is paid, whether a name is a match, whether a vehicle proceeds. For every judgment it produces a record that states what was concluded, on what evidence, by which method and with what confidence. The record is sealed, so any later change to it shows, and anchored so that anyone can verify it later without asking us. TIP also specifies an inline gate, which can hold or redirect an action whose evidence falls below a threshold you set.

Censio never originates a decision; your model or your people do. But it is not only a witness. TIP specifies an inline gate. Deployed, it sits in the operational path and measures each judgment against the rules you have set. Then it acts: allow, flag, hold or redirect. A judgment whose evidence is thinner than your threshold does not proceed until someone with authority says it does.

In a machine-to-machine setting, that is the difference between a decision that was merely logged and one that was governed. Autonomous agents transacting with one another, fleet systems, a drone acting on a perception model: the same rule holds. On your rules, at your discretion, and recorded either way.

A log says that something happened. A Censio record says what was concluded, from what, by what method, at what confidence, at what moment. It says so in a form anyone can prove has not been altered since. The difference is the difference between an incident report and evidence.

When the evidence genuinely moves, the record is superseded rather than edited: a new record links to the one it replaces, and the old one stays readable and stays verifiable. History here is append-only, including our own.

The desk, the figures and the ids below are a specimen; the mechanics are the protocol’s. A payments desk screens every outbound transfer against sanctions lists. A model flags a beneficiary name as a possible match to a listed individual. The match is not exact — a transliteration, a middle name absent — and the model puts its confidence at 0.71.

Without Censio: the model’s output goes to a queue, an analyst clears or blocks it, the outcome is logged. Fourteen months later a regulator asks why that payment cleared. The desk produces a log line, a screenshot of the list version if someone kept one, and an analyst’s recollection.

With Censio inline: the policy for this desk requires 0.90 for an automatic clear. At 0.71 the payment is HELD and routed to review; the hold itself is sealed. The analyst resolves it. The resolution is a second record superseding the first, carrying the list version in force, the aliases considered, the evidence that resolved the near-match, the method version and the exact moment. Both records commit to that day’s epoch anchor.

Fourteen months later the regulator asks the same question. The desk produces a CensioCert. The regulator recomputes its seal against the anchor, on their own machine, and reads what the desk concluded then, on what, by what method, and that nothing has changed since. The desk did not have to be trusted. It had to be checked, and it could be.

It is not a model, and it does not compete with yours. It is not a dashboard, though there are surfaces. It is not a decision-maker, though inline it can stop one. It is the layer that makes a machine judgment measurable, explainable and independently verifiable — and, when you ask it to, enforceable against your own rules.