The problem statement asserts a gap: no existing mechanism lets a receiving owner determine whether the evidence behind a claim is sufficient for the action they intend to take. An assertion is not a finding. Until each candidate mechanism has been read in its own specification and shown not to close the gap, the claim is unproven, and the question the project turns on, whether such a discipline can be built, is not yet licensed. One cannot defensibly ask whether a thing can be built before establishing that nobody has built it. This is the plan for that work.
Two jobs, and only two
The review does two things. Everything it contains serves one of them; anything serving neither is a survey reflex, and is left out.
Evidence the gap. Confront the established mechanisms that come nearest to the problem, each from its own primary specification, and show precisely where each stops short of action-relative admissibility. This is the load-bearing half.
Establish the mechanism. Warrant False Determinism as a real, structural failure mode rather than an asserted one: that generation produces basis-free assertion by design, and that the transfer layer has no way to represent the basis of what it carries.
The review is deliberately not a survey of the field. The problem statement already settled the comparison class and argued why the safety and assurance literature is the domain in which consequences land rather than a rival to the contribution. This review evidences that decision; it does not reopen it.
The stance: testing a position, not discovering one
The argument against each near-neighbour has already been made in outline. The review's task is therefore not to find a position but to test one already taken against what the specifications actually say. Two outcomes are acceptable and both are progress: the source confirms the claim, and the gap holds; or the source forces the claim to soften, and it is revised.
The discipline that matters here is to resist confirmation, reading each specification only for the sentence that supports a conclusion already reached. For every candidate, the reading looks instead for the strongest version of "but it does do this," because that is the objection a serious reader will raise, and the review is where it is met or the claim is corrected.
Evidencing the gap: the near-neighbours
Each candidate is examined against the same four questions, so they are compared on common axes rather than each on its own terms: what does it actually establish; at what point does it operate; does it represent a claim's basis and adjudicate fitness for an intended action; and where, by its own scope, does what it offers end.
Provenance and lineage
W3C PROV and its descendants record where a claim came from: the entities, activities, and agents involved in its production. The claim to test is that this is descriptive and retrospective, that a complete provenance graph can faithfully record that a value was generated by a model and still offer no answer to whether that value may now be acted upon. Provenance can say a value was generated by a model; it has no notion of what that licenses. The canonical objection, "isn't this just provenance," is met here first, because dispatching it sets the pattern for the rest.
Attestation and supply-chain integrity
in-toto and SLSA establish who produced an artefact and that it was not altered in transit. Their guarantees are authenticity and integrity. The claim to test is that a perfectly signed, verifiably unaltered claim may still be a hallucination, because the signature attests to custody, not to basis. The sharpest form of the objection is that an attestation framework can carry an arbitrary structured predicate, so an admissibility predicate could simply be defined within it. Meeting that directly is instructive: such a framework can transport an attestation of basis, but it supplies no model of basis, no inheritance semantics, and no adjudication. That marks it as a candidate integration point, a transport layer, rather than a mechanism that closes the gap.
Policy languages
Policy engines such as Open Policy Agent evaluate rich conditions over whatever attributes they are given. The claim to test is that they presuppose the very thing that is missing: a principled, portable representation of a claim's evidentiary basis and of the actions that basis can and cannot warrant. The natural objection is that one could simply write a policy that checks basis. To do so, one would first have to define the claim taxonomy, the basis representation, the inheritance rule, and the mapping from basis to permitted action. That definitional work is the contribution; the policy engine is where it would be executed, not a competitor to it.
A precedent, not a rival: firewalls
Network firewalls warrant a place, carefully bounded, because they are the architectural precedent the contribution rhymes with rather than a member of the comparison class. They make no admissibility claim, so they do not belong in the rival set, but they establish two things worth stating. First, an interposed, default-deny, versioned enforcement point at a trust boundary is not a novel architecture but one the field has trusted for decades. Second, a firewall's policy is indexed by flow properties, source, destination, service, and never by what the recipient will do with the payload; action-relative admissibility is exactly the index firewalls lack. The precedent lends its maturity to the enforcement point, and no further: it says nothing about how a claim's basis should be represented, which is where the actual difficulty lies.
The convergent finding
Each of these solves a genuinely adjacent problem, and the union of them still leaves action-relative admissibility unaddressed. Two integration points surface along the way, an attestation framework as transport and a policy engine as enforcement, which pre-figures the design and shows the work is not reinventing what already functions. The gap sentence, asserted in the problem statement, is restated here as the conclusion of the review rather than its premise.
Establishing the mechanism
The smaller half, its purpose to show the failure mode is structural and inevitable rather than a contingent quirk of current systems.
Generation produces basis-free assertion by design. The evidence that hallucination follows predictably from how models are trained and evaluated, that under any grading regime where abstention scores zero, confident guessing dominates the admission of ignorance, so a well-trained model asserts under uncertainty by design. This is what makes False Determinism structural rather than a defect awaiting a fix.
Confidence is the wrong category of evidence. The empirical finding that expressed confidence is poorly calibrated is used and then explicitly set aside as not load-bearing, because the argument does not depend on it: confidence is the wrong kind of information even when perfectly calibrated, being a statement about the generator's internal state rather than evidence about the world.
The philosophical adjacency. The observation that generated assertion bears no relation to the truth of what it asserts has already been named in the philosophy of language. That work is acknowledged and its departure stated: it diagnoses the speech act, whereas the concern here is downstream and mechanical, what happens when a value with no relation to its own truth reaches a consumer that can only treat it as settled.
Handover strips information. The handover literature evidences that transfer between owners loses information. It does not evidence the loss of a claim's basis, and is not designed to; that remains the argument this work must make rather than a finding it can borrow. The review states that limit openly rather than overclaiming from the source.
Sourcing
The review works only from sources that are open-access and read in full; paywalled and abstract-only material is excluded, and that exclusion is stated as a limitation rather than concealed. This matters less than it might: the entire comparison class, provenance, attestation, policy, and the firewall precedent, rests on public primary standards, so the load-bearing half of the review carries no paywall exposure at all. The constraint bites only on the clinical-handover literature behind the mechanism section, and that flank was always going to be argued rather than borrowed.