Arguments about evidence, before they were a product.
StromaOS exists because of a set of conclusions about how data reaches a decision, what happens when the assumptions behind it are challenged, and who ends up holding what an organization learned. The first of these were written before the platform was built. They are published here unchanged.
Where the data came from, and what you can still prove about it.
A dataset is bought from an aggregator, normalized into a vendor's own schema, and resold with a headline row count. Each step replaces a technical guarantee with a contractual one, and the normalization is what makes leaving expensive. By the time a model acts on it, the assumptions are no longer verifiable - and the volume being advertised is not the thing that decides whether a decision can be defended.
How Many Times Has Your Data Changed Hands?
Buyers ask how many patients a dataset covers. Almost nobody asks how many times it changed hands - and that number, not coverage, is what determines whether a decision can be defended.
Where Did Anonymization Actually Happen?
De-identified is treated as a yes or no. It is really a question of location: anonymization at the source and anonymization at the presentation layer produce the same label and completely different risk.
What Happens When AI Decisions Depend on Post-Hoc Anonymization?
Masking an output cannot repair an assumption made upstream. If identity-derived relationships shaped the model, removing identifiers from the answer does not remove their influence on it.
Why Provenance Matters More Than Volume
Volume solves statistical problems. It does not solve governance problems - and when lineage is unclear, more data multiplies the consequences of a flawed assumption rather than diluting them.
Why Decision Infrastructure Treats Data as Replaceable
Data is volatile; decisions persist. A system that assumes its inputs are permanent is assuming its decisions will never be questioned - and that assumption no longer holds.
What the record has to survive.
The first series asked where the data came from. This one starts after the system has acted, and asks what it owes anyone who questions the result. A trail assembled afterwards is an argument rather than a record; a control that leaves no artifact cannot be shown to have worked; and a method's standing does not travel with it from one use to the next.
An Audit Trail Assembled After the Fact Is an Argument, Not a Record
Every regulated organization can produce an audit trail. Almost none produces it while the work happens - it is assembled afterwards, from logs and memory, by the same people managing the inspection. A record states what occurred; a reconstruction argues that it probably did.
A System That Can Prove What It Refused to Do
Logs show what was done. Almost nothing can show what was correctly declined - which control stopped an action and why. A refusal that leaves no artifact is indistinguishable from a request nobody made.
“Validated” Is Not a Permanent Property
A method is not validated the way a bridge is built. Qualification holds against a stated intended use, in a stated context, under stated assumptions - and none of that travels automatically to the next use.
What a Signature Means
Systems capture that someone clicked approve. They rarely capture what was being approved, which authority the person held, or what they were shown at the time. Identity proves who; only the record proves why.
Execution Goes to the Data
Most analytical systems begin by assembling data somewhere. That single assumption is what makes entitlement, residency and consent properties of a copy rather than of a source - and it is a design choice, not a law.
Why the Third Study Costs Less Than the First
The second study rarely inherits anything from the first except files. Artifacts accumulate; structure is what compounds, and most organizations never get it because they treat the loss as a staffing problem.
Shorter pieces.
Stanford HAI recently published an important piece on why zero-shot clinical predictions are risky.
A note on Stanford HAI's work on zero-shot clinical prediction: their point is calibration, and we take it one step further, to irreversibility.
The platform these arguments led to.
StromaOS applies them: inputs are replaceable, provenance is a design constraint, and every run leaves a record that can be read without the system that produced it.