The OpsCom Methodology

OpsCom evaluates whether an incident report can survive structured scrutiny — from auditors, insurance carriers, plaintiff's counsel, or oversight reviews. This page describes how.

The methodology has three layers: an evidence graph, a contradiction taxonomy, and a defensibility score. Each is grounded in established academic work and aligned with the standards under which incident documentation is actually evaluated.

The Operational Truth Graph (OTG)

Every incident report makes claims. Officer arrived at 14:02. Backup was on scene before the takedown. The suspect reached toward the duty belt. These claims rest on something — body-worn camera footage, badge logs, CAD records, witness statements, supervisor sign-offs. The report and the evidence live in separate places. The report is a narrative document. The evidence is scattered across systems with different timestamps, different formats, different access permissions.

The Operational Truth Graph is the structure that holds them together.

OTG represents an incident as a typed graph. Every claim in the report becomes a node. Every piece of evidence becomes a node. The relationships between them — supports, contradicts, occurs before, verified by — become typed edges.

This is not a database. A database stores records side by side. OTG models how every claim depends on every other claim and every piece of evidence. When OpsCom evaluates an incident, it traverses the graph to identify which claims have evidence backing them, which evidence chains are intact, and where the structure breaks.

Node types

The OTG has five distinct node types, each representing a category of entity that appears in operational evidence:

• Evidence — raw artifacts. CCTV clips, report excerpts, access logs, audio records. Each carries metadata about its source, its timestamp, and its chain of custody.
• Claim — propositions made by an actor about events, actors, or states. Each claim is linked to the evidence that supports it, or flagged when no support exists.
• Event — discrete occurrences in time. Events have temporal intervals and references to the actors involved.
• Actor — agents performing or involved in events. Each carries role, credentialing level, and organizational position.
• Verification — review actions, sign-offs, corrective actions. The audit trail becomes part of the structure, not a footnote.

Edge types

Six edge types capture how nodes relate:

• Supports — an evidence node corroborates a claim node
• Contradicts — an evidence or claim node conflicts with another claim node
• Temporal — events ordered using Allen's interval algebra (before, after, during, overlaps, meets, equals, and converses)
• Provenance — chain of custody linking evidence to its source
• Attribution — who said what; which actor produced which claim
• Verified-by — which review action covered which claim

What becomes visible

Once an incident is represented in OTG form, three properties become observable that were invisible in a flat report:

• Whether every claim has supporting evidence, or whether some claims float without backing
• Whether the timeline is internally consistent across all sources, or whether sources contradict each other
• Whether critical claims have been verified by documented review, or whether they sit unverified

OTG is the substrate. The contradiction detection and the defensibility score both operate on top of it.

The Contradiction Modeling Framework (CMF)

A report is not made indefensible by a single missing fact. It is made indefensible by contradictions — places where one source disagrees with another, where a claim has no supporting evidence, where a chain of custody breaks, or where a verification step was never recorded.

CMF classifies these contradictions into five formal types, each derived from a structurally distinct failure mode observed in real-world investigative and legal challenges.

Five contradiction types

κ_temp — Temporal contradictions. Actions reported out of sequence, or impossible within the stated timeframe. An officer who reports securing a perimeter at 02:00 while the access control log shows a door propped open at 02:05. Detection is deterministic: timeline cycles, ordering violations, and impossible durations can be evaluated against Allen interval algebra constraints.

κ_fact — Factual contradictions. Two claims, drawn from independent sources, that are logically incompatible. A use-of-force report describing a suspect reaching toward a duty belt, while body-worn camera footage shows the suspect's hands at their sides until the takedown. Detection requires semantic comparison — currently via natural language inference models, with known limitations on specialized operational vocabulary.

κ_prov — Provenance contradictions. Evidence from unverified, discredited, or untraceable sources. A compliance form attributed to a credentialed reviewer who never conducted the evaluation. An evidence item whose chain of custody has an unexplained gap. Detection is structural: every evidence node must trace through an unbroken chain to a verifiable source.

κ_ver — Verification contradictions. Claims asserted but not corroborated by documented review. A use-of-force claim with no supervisor sign-off. An incident closure with no documented review. Detection is structural: every critical claim must have at least one verification node connected by a verified-by edge.

κ_comp — Completeness contradictions. Critical evidentiary elements absent from the record. A parking-lot assault report with no documentation of lighting conditions. An audit trail missing a required step. Detection is inferential: a domain-specific schema defines which elements are required for which incident types.

Severity

Not all contradictions are equal. A minor timestamp discrepancy and a fundamental factual reversal are different in kind. CMF assigns each contradiction a continuous severity score derived from four factors:

• Centrality — how central the contradicting node is in the evidence graph, measured by betweenness centrality
• Reliability differential — the difference in source reliability between the two contradicting nodes
• Recoverability — whether the gap can be resolved through additional evidence, or whether it is structurally unresolvable
• Impact — whether the contradiction affects a material claim in the decision chain or a peripheral detail

The four factors are combined into a normalized severity in the range 0 to 4. Aggregation uses a max-dominance term: a single fatal contradiction can collapse the overall defensibility regardless of how clean the rest of the record is. This reflects how reviewers — and plaintiff's counsel — actually evaluate evidence. The worst flaw is what determines the outcome.

The Defensibility Index (DI)

The Defensibility Index is a single score from 0 to 100, decomposed across six dimensions. Each dimension corresponds to a structurally distinct failure mode and is grounded in an established theoretical tradition.

The six dimensions

The six are minimally sufficient. Together they account for every known category of evidentiary challenge documented in operational practice and legal evidentiary theory. Removing any one dimension would leave at least one known failure class undetected.

Score interpretation

Scores below 70 are the threshold at which active remediation is recommended before documentation is finalized, submitted to a client, or shared with an insurance carrier.

Formal properties

The DI is designed to satisfy four properties that follow from the semantics of defensibility:

• Bounded between 0 and 100, regardless of input scale
• Monotone non-increasing under new contradictions. Adding evidence that introduces a contradiction can only lower the score, never raise it
• Decomposable. Every score is accompanied by a breakdown showing which dimension contributed what, and which specific contradiction triggered which penalty
• Explainable. Every output produces a traceable reasoning path from the score down to the evidence-node level

The score is not a black box. It is an audit-grade decomposition of structural integrity, accompanied by the evidence trail that produced it.

Non-compensability

A critical property: severe contradictions cannot be fully offset by strength in other dimensions. A report with catastrophic cross-source inconsistency (X approaching 0) or zero verification coverage (V approaching 0) is not considered defensible regardless of how strong the other dimensions are. This is enforced through the aggregation function. The reasoning is operational: a report where the named reviewer never conducted the evaluation is indefensible regardless of its temporal consistency or completeness elsewhere.

Standards Alignment

OpsCom's methodology is aligned with the standards under which incident documentation is actually evaluated.

ISO 18788:2015 — Management System for Private Security Operations

The international standard for security operations management. Mandates that organizations demonstrate accountability to law and produce consistent, defensible documentation. OpsCom operationalizes the standard's defensibility requirement, providing the quantitative metric the standard mandates but does not itself define. Alignment is strongest on R (Source Reliability), V (Verification Coverage), and A (Audit Traceability) dimensions.

ANSI/ASIS PSC.1 — Quality Management for Private Security Company Operations

The American national standard extending ISO 18788 into procurement and contractual frameworks. OpsCom's dimensions map directly onto the standard's evidence requirements for contracted services. Particularly relevant for security firms whose clients require demonstrable quality management.

NIST IR 8354 — Digital Investigation Techniques

The National Institute of Standards and Technology's scientific foundation review for digital investigation. Frames investigation as artifact extraction, narrative construction, and competing-hypothesis evaluation under uncertainty. OpsCom's three-stage methodology — graph construction, contradiction detection, scored aggregation — corresponds directly to NIST's framing.

Federal Rule of Evidence 707 / Daubert Standard

The federal rule governing admissibility of expert testimony based on machine-generated analysis. The Daubert standard, established in Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993), requires testable methods, peer-reviewed grounding, known error rates, and methodological soundness. OpsCom's methodology is designed to meet each criterion.

CALEA — Commission on Accreditation for Law Enforcement Agencies

CALEA-accredited agencies require documented evidence handling and review processes that OpsCom's V and A dimensions directly support. Particularly relevant for sheriff's offices and police departments operating under or pursuing CALEA accreditation.

A detailed standards-alignment matrix mapping specific clauses to specific DI dimensions and CMF detection logic is available on request.

Limitations and Scope

The methodology is decision-support, not decision-replacement.

OpsCom evaluates structural defensibility — whether a narrative is internally consistent, supported across sources, provenance-secure, and verifiable against documented review. It is not a truth-detection system. A narrative may be structurally defensible and still factually inaccurate. A narrative may be factually accurate and still structurally indefensible. These are distinct properties.

The operational value is in the second case. In legal proceedings, audits, regulatory reviews, and contract disputes, decisions are not made by accessing ground truth — they are made by evaluating whether accounts can withstand structured challenge given available evidence.

OpsCom does not detect coordinated fabrication where all evidence sources are controlled by a single malicious actor. No evidence-based system can detect fabrication from fabricated evidence alone — this is an epistemological limit. The methodology provides partial resistance through provenance checking on independently generated system records, but complete adversarial robustness requires external forensic investigation.

OpsCom outputs are diagnostic tools intended for use by trained operations, compliance, and legal professionals. They are not designed for direct submission as legal evidence and do not substitute for expert human review.

References

[1] Lyle, J.R. et al. Digital Investigation Techniques: A NIST Scientific Foundation Review. NIST IR 8354, 2022.

[2] International Organization for Standardization. ISO 18788:2015 — Management System for Private Security Operations. ISO, Geneva, 2015.

[3] ASIS International. ANSI/ASIS PSC.1-2022 — Management System for Quality of Private Security Company Operations.

[4] Allen, J.F. "Maintaining knowledge about temporal intervals." Communications of the ACM, vol. 26, no. 11, 1983.

[5] Wigmore, J.H. The Principles of Judicial Proof as Given by Logic, Psychology, and General Experience. Boston: Little, Brown and Company, 1913.

[6] Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993).

[7] Dung, P.M. "On the acceptability of arguments and its fundamental role in nonmonotonic reasoning." Artificial Intelligence, vol. 77, no. 2, 1995.

[8] Carrier, B. and Spafford, E.H. "Defining event reconstruction of a digital crime scene." Journal of Forensic Sciences, vol. 49, no. 6, 2004.

[9] Shafer, G. A Mathematical Theory of Evidence. Princeton University Press, 1976.

[10] Phillips, P.J. et al. Four Principles of Explainable Artificial Intelligence. NIST IR 8312, 2021.

[11] National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, 2023.

[12] Breitinger, F., Studiawan, H., Hargreaves, C. "SoK: Timeline based event reconstruction for digital forensics." Forensic Science International: Digital Investigation, vol. 53, 2025.

Full bibliography available on request.