Model Assumption Register¶
Document — instantiates Agentic Control Loop Design
A living list of every assumption the agent's world model rests on, each with an owner, a confidence, and a stated trigger for when it must be revisited.
The Model Assumption Register is a maintained document that makes an agent's world model auditable by writing down the beliefs it silently depends on — "customer demand is roughly stable," "the supplier ships in fourteen days," "this sensor is calibrated" — and giving each one an owner, a confidence level, and a revisit trigger: the specific observation that should force it to be re-examined. Its defining move is separating a belief from its warrant: an assumption held at 90% confidence with a clear falsifier is a different object than the same words held on habit, and the register forces that distinction onto the page. It is a standing artifact of what we currently assume and when we agreed to doubt it — not a review, and not the act of updating, but the ledger those depend on.
Example¶
A consumer-goods company runs a demand-forecasting model that drives factory orders. When forecasts miss, arguments go in circles because nobody can say which of the model's beliefs actually broke. The planning team builds a Model Assumption Register. Entries: "promotional lift averages 20%" (owner: marketing analyst; confidence: medium; revisit if two consecutive promotions land outside 10–30%). "Supplier lead time is 14 days" (owner: procurement; confidence: high; revisit on any shipment past 18 days). "Last year's seasonality still holds" (owner: forecasting lead; confidence: low; revisit each quarter).
The next quarter, two promotions land at 6% lift. Because that assumption carried an explicit trigger, it does not slip by as noise — the register flags it as tripped, names its owner, and routes it to be re-examined. The register did not recompute the forecast or decide the new lift number; it made one specific, previously-invisible belief the thing under review, so the model gets revised where it actually broke rather than being globally distrusted.
How it works¶
- Surface the load-bearing beliefs. Walk the model and write down the assumptions its outputs actually depend on — the ones that, if wrong, would change the answer — not every incidental parameter.[1]
- Attach a warrant to each. For every assumption record its owner, its confidence, and the evidence it currently rests on, so a shaky belief cannot masquerade as a settled fact.
- Write the revisit trigger. State the specific, checkable observation that should force re-examination — a threshold, a date, a contradicting result — turning "we'll revisit if things change" into a falsifier someone can actually test.
- Keep it living, not archived. The register is edited as beliefs are added, retired, or tripped; a version frozen at project kickoff is a fossil, not a control.
Tuning parameters¶
- Assumption granularity — how finely beliefs are itemized. Finer registers catch a narrow assumption that breaks alone but grow long and unread; coarser ones stay maintained but bury the specific belief that failed.
- Confidence scheme — qualitative bands versus explicit probabilities. Numbers sharpen comparison and stress-testing but invite false precision; bands are honest about vagueness but blur which belief is really the weakest.
- Trigger strictness — how sensitive each revisit condition is. Tight triggers re-examine beliefs early and often, at the cost of churn; loose triggers stay quiet and let a stale assumption drive decisions longer.
- Ownership granularity — one custodian for the register versus a named owner per line. Per-line owners create real accountability for each belief but add coordination; a single custodian is simpler but diffuses who must actually check.
When it helps, and when it misleads¶
Its strength is converting a model's tacit commitments into explicit, ownable, falsifiable ones — so when the model fails, the argument is about which named assumption broke rather than whether the whole thing is untrustworthy. It is the artifact that lets a team update a belief surgically, and it quietly resists the confident-error failure mode by keeping each belief's warrant visible.
Its failure modes are those of any register. It goes stale: written once, admired, and never edited, it documents last year's beliefs while today's decisions run on unlisted ones. It breeds false comfort — a thorough-looking register implies the model is well-understood even as the assumption that actually matters sits unrecorded because no one thought to doubt it. And confidence labels can be theater, high numbers assigned to protect a belief rather than to describe the evidence. The guarding discipline is the living clause paired with real triggers: a register earns trust only when tripped assumptions visibly get re-examined and unlisted surprises get added.
How it implements the components¶
The register realizes the archetype's model-legibility slice — the belief structure behind the loop and the written rule for when it must change:
world_model— it externalizes the model's load-bearing assumptions into an inspectable ledger, so the actor's belief about its situation is auditable rather than tacit.model_update_rule— each entry's revisit trigger is a written rule for when the model must be re-examined: the specific observation that should overturn the belief.
It records assumptions and their triggers but performs no review — applying an update from real outcomes is After-Action Learning Cycle's recurring work; the live effect_feedback_loop that would trip a trigger is Agency Health Dashboard's, and proportional_accountability_frame belongs to the after-action ritual. The register is the standing list of what we assume and when to doubt it; the cycle is the meeting that actually revises the model.
Related¶
- Instantiates: Agentic Control Loop Design — it makes the loop's world model auditable and its update conditions explicit.
- Consumes: Agency Loop Map supplies the model node this register details.
- Sibling mechanisms: Agency Loop Map · Agency Health Dashboard · After-Action Learning Cycle · Briefback or Intent Confirmation · Safe Action Menu · Graduated Autonomy Ramp
Editorial Notes¶
Form Classification¶
Form family: Record, Log & Register
Rationale: Model Assumption Register operates as a durable record, ledger, register, or trace whose value depends on preserving actual state or history because it a living list of every assumption the agent's world model rests on, each with an owner, a confidence, and a stated trigger for when it must be revisited.
Independent corroboration: The frozen evidence defines Model Assumption Register as 'A living list of every assumption the agent's world model rests on, each with an owner, a confidence, and a stated trigger for when it must be revisited', so its operative form is Record, Log & Register.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Security Studies & Intelligence Analysis
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: The CIA Key Assumptions Check directly establishes the enumerate-and-revisit assumption lineage; engineering registers and organizational ownership make it standing and operational. This establishes security_intelligence as the primary origin lineage rather than merely a domain where the mechanism is now applied.
Related originating lineages:
- Engineering & Design (beyond software) — Explicit assumption registers with owners and review triggers descend from systems-engineering requirements and risk practice.
- Organizational & Management Science — Risk and project governance materially developed assumption registers with owners and review triggers.
Review resolution: Authoritative/primary-source research resolves the conflicting primary-origin claims in favor of security_intelligence: The CIA Key Assumptions Check directly establishes the enumerate-and-revisit assumption lineage; engineering registers and organizational ownership make it standing and operational. Retained alternate origins (engineering_design, organizational_management) are limited to independently formative or materially shaping lineages supported by the reviewer evidence; downstream adoption alone was not promoted to origin. The breadth of present-day use is recorded separately as domain_reach=multi_domain. origin_mode=cross_disciplinary_synthesis, confidence=medium, and encyclopedia_synthesis=true reflect the surviving provenance evidence and the encyclopedia's generalization.
Attribution caveat: The mechanism turns a one-time analytic check into a living operational register.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; medium confidence.
Sources consulted:
- CIA Tradecraft Primer: Structured Analytic Techniques — Describes Key Assumptions Check as an intelligence-analysis technique for exposing and revisiting assumptions supporting judgments.
Notes¶
The register stores the written update rule — the trigger — while the After-Action Learning Cycle is the recurring ritual that acts on a tripped trigger. Keeping the two separate is what lets a team improve its list of assumptions without turning every edit into a review meeting, and lets a review revise the model without first having to reconstruct what was assumed.
References¶
[1] Central Intelligence Agency. “A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis”. Central Intelligence Agency (2009). Directs analysts to record the assumptions their conclusions depend on, especially those whose failure would materially change the analysis. withdrawn registry ↩