REAL-WORLD INTERPRETIVE
Access is not proof
Who could reach an object is a legitimate scoping question. It does not establish who copied, changed, disclosed, or directed the act. Shared accounts, automation, delegated work, supply-chain compromise, credential misuse, logging defects, and framing remain competing hypotheses.
REAL-WORLD INTERPRETIVE
Use specific behavior with context
Potentially relevant indicators include unauthorized access attempts, unexplained transfer of restricted data, deliberate audit disabling, false statements about a documented action, or evidence of coordination. Each requires time, mandate, technical context, benign explanations, provenance, and corroboration.
REAL-WORLD INTERPRETIVE
Forbidden suspicion inputs
Race, ethnicity, nationality, religion, language, gender, sexual orientation, disability, neurodivergence, diagnosis, lawful political belief, union membership, migration status, class, family origin, diaspora contact, or foreign friendship cannot raise a suspicion score. The system cannot use proxies designed to recreate those traits.
REAL-WORLD INTERPRETIVE
Distress calls for support, not a guilt presumption
Fatigue, trauma, anxiety, depression, psychosis, medication, burnout, grief, and help-seeking may affect capacity or support needs in an individual context. They do not predict espionage or violence. Security and care records remain separated with strict access and anti-retaliation rules.
REAL-WORLD INTERPRETIVE
Escalation requires gates
Passive validation precedes intrusive action. Higher-impact steps require behavior-specific justification, legal authority, proportionality, minimization, conflict review, evidence preservation, and independent approval. Exculpatory evidence and alternative hypotheses remain visible.
REAL-WORLD INTERPRETIVE
False accusation has institutional consequences
Tunnel vision can ruin careers, isolate teams, freeze information sharing, expose sources, and allow the true cause to persist. The game therefore tracks investigative harm, appeal, exoneration, trust loss, and remediation rather than treating an innocent suspect as disposable content.