Behavioral integrity and appeals

Status: Proposed / Not authorized
Operational monitoring: Not active
Employment decision authority: None

1. Control objective

The integrity system is intended to make large-scale abuse expensive at the corroboration boundary while avoiding geographic, prestige, and protected-class proxies. It routes questionable activity for proportionate review; it does not decide whether a person is capable, honest, employable, or entitled to a result.

2. Permitted reason-code families

The proposal schema allows only versioned reason codes:

Reason code	Contestable observation	Not an authorized conclusion
`submission_velocity_anomaly`	Unusual submission volume under the declared window.	Automation, fraud, or identity multiplicity.
`device_cluster_anomaly`	Multiple synthetic records share a minimized device-cluster token.	Common ownership or collusion.
`network_velocity_anomaly`	A minimized network token crosses a declared velocity condition.	Location, nationality, or fraud.
`template_similarity_cluster`	Independent submissions exceed a versioned structural-similarity condition.	Plagiarism or common authorship.
`credential_identifier_reuse`	A credential reference is claimed by multiple subject references.	Which claim is false.
`repository_claim_collision`	An artifact or contribution range is attributed to multiple subject references.	Fraud or authorship.
`referral_graph_anomaly`	A referral subgraph meets a predeclared anomaly pattern.	Knowing collusion by any member.
`automation_timing_pattern`	Interaction timing resembles a predeclared automation pattern.	Lack of understanding or prohibited assistance.
`assessment_interaction_anomaly`	A declared interaction-integrity condition is observed.	Capability or intent.
`claimed_demonstrated_inconsistency`	A reviewed demonstration materially conflicts with a scoped claim.	General dishonesty or global incapability.

Geography, nationality, national origin, name, language variety, accent, age, sex, race, disability, school, employer prestige, fame, social following, and compensation are prohibited signal families. Accessibility technology, translation, approved assistance, atypical response timing, and privacy tools must not be treated as adverse signals without construct-relevant evidence and an accommodation-aware review.

3. Permitted proposed restrictions

Automated detection may only propose one of:

request_additional_corroboration
progression_rate_limit
route_to_human_integrity_review
quarantine_specific_evidence_item
no_restriction

It may not reject a person, lower a capability estimate, revoke a result, notify an employer, penalize a voucher, or create an adverse employment action. A final restriction requires a trained human reviewer who can inspect the contestable basis, applicable accommodations, counterevidence, conflicts, and policy version.

Every proposal restriction is non-operative, expires automatically, has a maximum duration of 30 days, and carries a review deadline no later than its expiry. The machine relational gate requires observed_at <= proposed_at < review_due_at <= expires_at, bounds elapsed time by maximum_duration_days, and binds the restriction, review, appeal, and policy digests. Merely supplying correctly formatted timestamps is not enough.

4. Data minimization

The proposed event contract records an opaque synthetic subject reference, reason codes, qualitative signal strength, policy binding, a controlled contestable-summary template ID, restriction proposal, and appeal state. It contains no free-form submission or public copy. It deliberately excludes raw device fingerprints, IP addresses, precise timestamps of interaction sequences, payment details, biometric information, message content, and geographic coordinates.

Any future operational feature store requires a separate privacy impact assessment, lawful-purpose decision, retention schedule, security review, access policy, vendor review, and deletion verification. Tokenization is not anonymization.

5. Human review and appeal contract

Before a restriction can take effect, the subject must receive:

the restriction and its practical consequence;
the applicable reason-code label and a plain-language contestable basis;
the evidence categories considered, without revealing controls in a way that defeats them;
an opportunity to correct identity or attribution errors and provide counterevidence;
an accommodation and alternate-demonstration route;
the policy version and relevant event date;
a private appeal channel and response target; and
confirmation that the restriction is not a capability or employment result.

The original reviewer cannot decide the appeal. Appeals require a non-conflicted reviewer, access to the complete decision record, written reasons, and append-only disposition. Material detector or policy defects must trigger impact analysis, re-review of affected cases, notice, and a non-sensitive correction publication.

6. Referral safeguards

Referrals are useful corroboration signals but especially vulnerable to collusion and retaliation. A proposed referral graph must:

record the fact and scope vouched for, not a general endorsement;
limit vouching velocity and disclose responsibility before acceptance;
distinguish close working knowledge from social connection;
avoid rewarding dense in-group networks;
monitor false-positive and subgroup effects;
never automatically change the voucher's capability, trust, or result state; and
require evidence of knowing abuse, notice, independent review, and appeal before any consequence.

The behavioral-risk-event proposal schema makes appealability and human review mandatory while making geography, prestige proxies, protected attributes, sole automation, and employment-action authority structurally false.

referral_association is mandatory even when its value is present: false. The relational gate requires it to be present exactly when referral_graph_anomaly appears, requires the restriction reason set to equal the observed reason-basis set, and keeps capability, employment, and automatic voucher-penalty authority false at the restriction, referral, and safeguard boundaries. These proposal records remain design_only_not_operational; an actual reviewer or appeal service does not exist in this package.