The Green Light Nobody Owns
A sign-off said "verified". It was produced by the same process that ran one narrow check.
An artifact was labelled anonymisation verified by the process that had run a single deny-list check. The label sounded like a broad guarantee and covered one failure mode. A sign-off that does not name the check it ran will be read as covering everything.
Pattern
A pipeline runs a check and stamps the result: verified. Downstream, that word is read as safe, and the artifact moves on.
The check covered 1 failure mode out of 4 that the pipeline now tests for. Nobody chose to overclaim — the label was just written at the wrong altitude.
Why it looks right
Short labels are good interface design everywhere else. passed, verified, clean are exactly what you want on a build badge, and spelling out scope in every status line feels like noise.
The label is also literally true. Something was verified.
Why it fails
The sign-off inherits the blind spot of the check while sounding broader than the check. A deny-list confirms no forbidden name appears; it says nothing about whether three innocent facts together identify the author. Both facts are true and only one of them is in the label.
The second-order problem is that the label ends the inquiry. Once an artifact carries verified, the next reader has no reason to ask what was verified, and the question stops being asked precisely at the point where it becomes load-bearing.
Instead
Name the check in the verdict. Not verified but:
deny-list: 0 hits · cross-check: 1 category · reviewer: humanThree properties make this work. It cannot quietly grow into a promise nobody made. It shows the reader what was not checked, by omission. And when a new check is added, the label changes shape, which is a visible event rather than a silent widening of scope.
The same applies to any status that travels further than the thing that produced it: test suites, audits, approvals. If a label will be read by someone who cannot see the check, the label has to carry the scope.