[ PROOFECONOMY ]™GlossaryOriginSpecsEffect Point
An Effect Point is the place where a canary's intended effect lands, such as a target host, data store, identity system, egress sink or agent tool output. It is where a Proof Witness watches, instead of the control's own console or logs.
What it means
A control’s console tells you what the control thinks happened. The Effect Point tells you what actually happened. If the data reached the egress sink, the attack worked, whatever the alert said.
That is why the Proof Witness sits at the Effect Point, over a path and credentials the control does not administer, and why the Dead Canary Protocol measures outcome, not detection.
The rules
- Every canary has a defined, machine-checkable expected effect at a declared Effect Point, recorded in its commitment.
- The Effect Points a witness watches are published as its Witness Coverage Map. A canary committed to an Effect Point outside the map is Blind.
- Liveness of every Effect Point is checked over paths that do not cross the control, so an outage is recorded as a black hole, not as a stopped attack.
What it is not
Not the control’s log, alert or dashboard. Those are written by the thing under test and are verification evidence.