[ PROOFECONOMY ]™GlossaryOriginSpecsSelf-Provided Engagement
A Self-Provided Engagement is one in which the Implementor and the Provider are the same legal entity: an organization tests a control its own team built, configured or operates. It is allowed only when the people running the Issuer, Proof Witness, Fingerprint Capture and Adjudicator have no reporting line into, and no on-call or change responsibility for, the control under test, and the record says self_provided: true.
What it means
You may test your own control. You may not test it with the people who built it. Every rule that separates a Provider from the testing equipment applies between the two teams exactly as it would between two companies.
The rules
- The organization is the Implementor; the team that built or operates the control is the Provider.
- The Issuer, Proof Witness, Fingerprint Capture and Adjudicator are operated by people with no reporting line into, and no on-call or change responsibility for, the control.
- The Engagement Manifest names the Provider team, the testing teams and the organizational boundary between them.
- The Performance Record carries
self_provided: true. - Where the organization cannot staff that separation, the Proof Witness and Issuer seams are filled by an Independent Test Lab, an auditor or another external party. With no external party at any seam and no demonstrable separation, the Engagement is Provider-Run.
- Self-Provided records sit in the same Comparability Class as any other record under the same Mine Plan, Environment Class and Parity Declaration. The flag is for disclosure, not for discounting. A reader who wants to weight it may; the record does not.
- An Acceptance Profile may accept or refuse Self-Provided records, or require additional separation.
Open source
Open source controls are Provider-provided by their maintainers and Self-Provided by whoever configured and deployed them. The manifest names both: the upstream project and version as Provider of the control, and the deploying team as Provider of the configuration, each under its own fingerprint.
See also Structural Independence and the Self-Attestation Oxymoron Organization.
Related terms
- Acceptance Profile
- Comparability Class
- Disclosed Interests, Sponsor and Funding Tier
- Provider-Run Mode (forbidden)
- Self-Attestation Oxymoron Organization (SAOO)
- Structural Independence