- No fee contingent on a pass
- No fee contingent on suppressing a finding
- No discount for a more favorable result
- No success fee tied to the assessed vendor closing its deal
Independence
The party being tested pays for the test.
That conflict is controlled, not denied. This page lists the controls, says plainly which of them are not in place yet, and states what we will not accept a fee for. It is here so you can hold us to it.
The controls
Seven rules on the conflict.
The company being tested paying the tester is how all assurance works — and it is also how it goes wrong. These seven rules are how we handle that. One of them is not in place yet, and it is marked.
One of these is not in place yet. Agent Factfile is one person today, so the person who sells the work is also the person who signs the result. We would rather tell you that than pretend a process exists. It is also why what we sell today is a private dry run — the results go to you and to nobody else, so nothing rests on our signature. When the team grows, selling and signing get separated.
Fees
What we will not be paid for.
- Every artifact carries a paid_by field
- Related-party interests are disclosed with it
- The severity, evidence-grade, limitation, and conflict rules are published
- Whether an outside reviewer was used, and why, is stated
The fee does not move with the answer. The same fee applies to a supported, limited, not-supported, and insufficient-evidence conclusion. There is no version of this work where we are paid more for telling you what you wanted to hear. What the fee is, is a matter for the statement of work — it is not something this page can usefully quote.
Disclosure
Who paid is part of the record.
Every artifact carries a paid_by field. It is required by the manifest schema, so an assessment cannot be produced without it, and it travels with the evidence rather than sitting in a covering email. A reader who wants to discount the result because of who funded it has what they need to do that.
Disclosure is not a substitute for independence. Naming the payer does not neutralize the conflict; it makes the conflict visible so a reviewer can weigh it. The controls above are what constrain the conflict. The disclosure is what lets you check that they were applied.
Appeals
The only way to change a conclusion is evidence.
The subject gets a factual review window for configuration, version, policy, and evidence errors. It cannot negotiate severity or remove a valid finding. Beyond that window, an appeal has to rest on one of four grounds.
History is kept. Failed, incomplete, expired, withdrawn, and superseded states are preserved, never deleted. A corrected artifact retains a link to the version it supersedes and a plain-language record of what changed. If a result had to be walked back, the walk back is part of the record too.
Hold us to it
Tell us where this is not good enough.
These rules are published so they can be checked, and they are worth less than the paper they are on if nobody checks them. If you are reviewing a vendor and something here does not meet your bar, we would rather hear it than not.
What this page deliberately does not claim
- That paying for your own assessment is not a conflict
- That a single operator is structurally independent
- That any of this makes an agent safe