When an early incident report reads like a clean story, how do you tell what's fact from what's a lesson?

This is about sorting incident evidence by who is vouching for it. The corpus describes a comparative protocol that puts each claim in one of two bins: what a single preliminary record asserts alone, and what both records support together. How do you separate reliable claims from fragile early incident evidence? Record-specific facts stay attributed to their source, and disputed details are not smoothed into a consensus. Only what survives across records is lifted into a systems lesson.

The protocol guards against treating one readable account as the whole picture. A single early record is usually a coherent story, and coherence feels like completeness. Requiring a second record to back a claim before it becomes a lesson turns "this narrative is persuasive" into "this pattern shows up in independent accounts." The corpus also warns about the general problem: the most dangerous systems look competent and fluent, and that fluency weakens the reader's skepticism. How do competent systems quietly undermine safety oversight? That warning is about AI systems, but a polished incident write-up can lull a reviewer the same way. This is my extension, not something the note says about incident reviews.

The worked example is two preliminary records about AI evaluation security. They support one shared lesson: evaluation environments are part of the security boundary. They do not establish common attack sequences, recurrence rates, whether any control worked, or the causal mechanisms behind the failures. What can two incident records actually teach us about AI evaluation security? That list of what the records do not show is part of the finding. A useful preliminary review says at what level the lesson holds (the boundary) and where it stops (the mechanics, the frequency, the fixes).

The same discipline applies to proposals. One paper in the collection lays out a careful four-arm design for testing whether added monitoring improves protection at acceptable cost, but the excerpt reports no results. Does added monitoring improve protection at acceptable cost? A design and an outcome are different kinds of claim, and a review should label which one it has.

The result is that a systems lesson can be sturdier than any single fact behind it. Agreement across records makes the lesson robust, while the details stay provisional and attributed. The corpus has one protocol and one worked example on this. It gives no wider methodology for weighing more than two records or for grading how independent they are.