HDRM — Harm Determination Record Module
OOF® Origin Open Foundation®
Independent Methodological Authority
Canonical Definition
The HDRM — Harm Determination Record Module governs the formation,structure, identity, traceability, integrity, qualification, versioning,
correction, supersession, linkage, preservation, accessibility, and
lifecycle continuity of the authoritative Governed Harm Record produced
through formal Harm Determination.
HDRM converts the completed HDS Determination structure into a durable
methodological record that preserves what Harm was determined, its
governed boundary and Determination State, the basis and methodology
through which the determination was reached, the material limitations and
uncertainty that remain, and the history of subsequent changes.
HDRM establishes the transition:
Governed Harm Determination State + Determination Basis + Governed Harm
Boundary → Record Formation → Record Qualification → Record Integrity →
Governed Harm Record
Its central question is:
How must a formally determined Harm be represented and preserved so that
its identity, scope, Determination basis, limitations, history, and future
governance remain traceable?
- Operational Role
HDS has four preceding methodological stages:
HDIM governs the qualified inputs.
HDCM-D governs the Determination Criteria.
HDEM governs the evaluation.
HDSM governs the formal Determination State.
HDRM converts those governed results into the durable Harm object that can
continue through the HAGA™ lifecycle.
Its operational role is:
to ensure that a Harm Determination does not disappear into a report,
database entry, decision, claim, case file, or temporary system state, but
becomes a persistent, identifiable, traceable, and governable Harm Record.
- Position Within HDS
The HDS internal flow is:
Qualified Inputs → Determination Criteria → Evaluation → Determination
State → Governed Harm Record
The Core Module sequence is:
HDIM → HDCM-D → HDEM → HDSM → HDRM
HDRM receives:
Governed Harm Determination State
together with the relevant governed HDS basis.It produces:
Governed Harm Record
for the next HAGA™ Parent Standard:Harm State Standard (HSS)
- Governed Object
The primary governed object is:
Governed Harm Record
A Governed Harm Record is the authoritative methodological representationof a Harm object formally processed through HDS.
It is not merely:
a report
a complaint
an incident entry
an evidence package
a claim
a liability record
a medical record
an audit finding
or:
a system log
It is the governed representation of the Harm itself.
- Foundational Record Principle
The foundational principle is:
A Harm Determination must remain governable after the moment of
Determination has passed.
Therefore:
Determination Conclusion ≠ Complete Governed Harm Record
The record must preserve sufficient structure for future governance to
understand what was actually determined.
- Governed Harm Identity
Every Governed Harm Record must represent a distinguishable Harm object.
The record should preserve sufficient identity to distinguish:
this Harm
from:
another Harm
even where both involve:
the same subject
the same system
the same event
the same organization
or:
the same time period
Canonical principle:
Related Harm Objects ≠ Same Harm Object by Default
- Record Identity ≠ Harm Origin Identity
The identifier assigned to a record is not itself the origin of the Harm.
Therefore:
Record Creation Time ≠ Harm Emergence Time
and:
Record Identity ≠ Harm Origin
The record represents the Harm.
It does not create it.
- Minimum Record Structure
A Governed Harm Record should preserve, where applicable:
Harm identity
Harm description
Harm Determination State
Governed Harm Boundary
subject scopetemporal scope
effect scope
downstream scope
domain context
Determination Criteria reference
Determination Evaluation reference
qualified input referenceconfidence
uncertainty
limitations
dispute status
effective Determination time
record version
record history
and:
governance status
- Harm Boundary Preservation
The Governed Harm Record must preserve the HBS boundary used for
Determination.
This includes the applicable:
subject
temporal
effect
and:
downstream
boundaries.
Canonical principle:
A Harm Record must not become broader or narrower merely through
documentation.
- Determination State Preservation
HDRM must preserve the exact HDSM state:
Established
Partially Established
Pending
Insufficient Basis
or:Not Established
Where the state contains qualifications, those qualifications must remainattached.
A record must not simplify:
Partially Established
into:Established
or:Insufficient Basis
into:Not Established
- Established Scope Preservation
Where Harm is Partially Established, the record must explicitly
distinguish:
Established Scope
from:Unresolved Scope
The unresolved portion must remain visible for future governance.Canonical principle:
Partial Determination must remain partial in the record.
- Determination Basis Traceability
The Governed Harm Record should permit authorized governance processes to
trace the Determination back to its methodological basis.
Conceptually:
Governed Harm Record
↓Determination State
↓Determination Evaluation
↓Determination Criteria
↓Qualified Determination Inputs
This creates:Determination Lineage
- Determination Lineage
Determination Lineage allows future governance to answer:
What was determined?
Under which criteria?
Using which qualified basis?
What evaluation was performed?
What state resulted?
What limitations existed?
What changed later?
Canonical principle:
A Determination without lineage is difficult to audit, reassess, correct,
or trust.
- Record ≠ Evidence Repository
HDRM does not require every underlying evidence object to be duplicated
inside the Harm Record.
Instead, the record may maintain governed references to evidence
controlled elsewhere.
Therefore:
Governed Harm Record ≠ Evidence Archive
ADIT® remains responsible for evidence governance.
- Record ≠ Determination Evaluation
The record preserves the result and lineage of HDEM.
It does not replace the evaluation itself.
Therefore:
Record Summary ≠ Complete Evaluation
Where detailed evaluation is required, the record should maintain the
appropriate reference.
- Record ≠ Incident Record
An incident may be one operational occurrence associated with Harm.
The Harm may:
begin before the incident is recorded
continue after the incident ends
extend beyond the incident boundary
or:
exist without a discrete incident
Therefore:
Incident Record ≠ Governed Harm Record
- Record ≠ Claim Record
A claim is a separate governance or legal object.
A Harm may exist:
without a claim
before a claim
after a claim closes
or:
across multiple claims
Therefore:
Claim Record ≠ Governed Harm Record
- Record ≠ Liability Record
HDS does not determine liability.
Therefore:
Governed Harm Record ≠ Liability Record
A Governed Harm Record may exist where:
liability is unknown
liability is disputed
no liability exists
or:
liability has not yet been evaluated
- Record ≠ Accountability Record
Likewise:
Governed Harm Record ≠ Accountability Record
AGA™ may govern accountability separately.
The inability to identify an accountable actor must not invalidate the
Harm Record.
- Record ≠ Harm State
HDRM records the HDS Determination result.
HSS subsequently governs the current lifecycle state of established Harm.
Therefore:
Harm Determination Record ≠ Harm State Record
A Governed Harm Record may later reference evolving HSS states without
converting HDRM into Harm State governance.
- Persistent Harm Identity Across State Change
Once a governed Harm object proceeds into HSS, its lifecycle state may
change:
Emerging → Active → Escalating → Stabilized → Reduced → Recovering →
Residual → Resolved
The Harm identity should remain continuous where it remains the same Harm.
Canonical principle:
Harm State Change ≠ New Harm Identity by Default
- Record Continuity Across HAGA™
The Governed Harm Record becomes a continuity anchor across subsequent
HAGA™ governance.
Conceptually:
Determined Harm → Harm State → Harm Change & Propagation → Containment →
Mitigation → Recovery / Residual Harm → Resolution / Finality
The record enables these stages to refer to the same governed Harm object
where appropriate.
- Record Versioning
A Governed Harm Record may evolve.
Material changes should produce a new governed version rather than
silently overwrite the existing representation.
Conceptually:
Record v1 → New Governed Basis → Record v2
Each version should preserve its relationship to previous versions.
- Version ≠ New Harm
Canonical distinction:
New Record Version ≠ New Harm Object
Versioning reflects changes in the governed representation.
A new Harm identity is required only where governance determines that a
materially separate Harm object exists.
- Record Correction
Where an error is discovered, HDRM must support correction.
The record should preserve:
what was incorrect
what replaced it
why it changed
when it changed
and:
who or what authorized the correction where applicable
Canonical principle:
Correction must repair the record without erasing the history of the
error.
- Record Supersession
A record version may be superseded by a later version.
The superseded record should remain historically traceable.
Therefore:
Superseded ≠ Deleted
The current authoritative representation and the historical representation
must remain distinguishable.
- Determination Reassessment
Where HDS is reopened and the Determination State changes, HDRM must
preserve the transition.
For example:
Insufficient Basis → Established
or:
Partially Established → Established
The updated record should preserve both:
current state
and:
previous Determination history
- Determination Reversal
Where a previous Determination is legitimately reversed after
reassessment, HDRM must preserve:
the original Determination
the basis available at that time
the later basis
the reassessment
the new state
and:
the reason for change
Canonical principle:
A corrected Determination does not make the previous governance history
disappear.
- Record Reopening
A closed or stable Determination Record may be reopened when materially
relevant new information appears.
Reopening may be triggered by:
new evidence
newly discovered Harm effects
boundary expansion
boundary contraction
input correction
criteria correction
evaluation error
or:
integrity concern
Reopening must be explicit and traceable.
- Historical Integrity
HDRM must preserve the Harm Determination history as a sequence rather
than only the latest state.
Conceptually:
Recognition → Boundary → Determination₁ → Record₁ → Reassessment →
Determination₂ → Record₂
Canonical principle:
Current Record ≠ Complete Governance History
- Temporal Integrity
The record should distinguish relevant times such as:
Harm emergence period
Recognition time
Boundary establishment time
Determination time
record creation timereassessment time
correction time
and:
current effective time
These timestamps must not be collapsed.
- Record Creation Time ≠ Harm Time
Canonical distinction:
Record Creation Time ≠ Harm Emergence Time
A Harm may have existed long before HDRM creates its formal record.
- Late Determination
Harm may be formally determined:
hours
days
months
or:
years
after emergence.
The record must preserve this temporal separation.
Canonical principle:
Late Determination Must Not Become Late Harm by Documentation.
- Uncertainty Preservation
Material uncertainty present in HDSM must remain visible in the Governed
Harm Record.
Uncertainty may concern:
time
subject scope
effect scope
downstream relationships
methodology
or:
other bounded characteristics
A record must not create false precision merely because structured data
fields require values.
- Unknown ≠ Zero
Where a value is unknown, HDRM should represent:
Unknown
rather than silently substitute:0
None
Noor another value with different methodological meaning.
Canonical principle:
Unknown Must Remain Unknown Until Governance Changes It.
- Limitation Preservation
Material limitations must remain attached to the Determination Record.
Examples include:
partial temporal precision
limited subject coverage
unresolved downstream relationship
methodological limitation
source limitation
or:
pending reassessment
A summary that removes these limitations may materially distort the
Determination.
- Confidence Preservation
Where HDSM uses Determination Confidence, HDRM must preserve:
confidence object
confidence state
and:
scope
It must not convert confidence into severity or certainty.
Therefore:
Confidence ≠ Harm Severity
and:
High Confidence ≠ Complete Knowledge
- Dispute Status
A Harm Determination may be disputed.
HDRM should preserve:
whether the record is disputed
what part is disputed
basis of dispute
status of reassessment
and:
current authoritative state
Dispute must not silently erase the existing Determination.
- Record Relationship Governance
One Harm Record may be related to another.
Relationships may include:
same-origin relationship
propagation relationship
downstream relationship
shared-subject relationship
shared-mechanism relationship
successor relationship
composite relationship
or:
possible relationship under review
A relationship does not automatically merge the Harm objects.
- Related Harm ≠ Same Harm
Canonical principle:
Relationship ≠ Identity
Two Harm objects may be strongly related while remaining methodologically
separate.
HBS and later HCPS governance determine relevant boundary and propagation
structures.
- Harm Record Merge
Where governance determines that two records represent the same underlying
Harm object, HDRM may support a governed merge.
A merge must preserve:
original record identities
reason for merge
merged Harm identity
historical references
and:
supersession relationships
A merge must not destroy provenance.
- Harm Record Separation
Where one record is later found to contain multiple distinct Harm objects,
HDRM may support governed separation.
The separation should preserve:
original record
new Harm identities
allocation of relevant scope
reason
and:
history
Canonical principle:
Record Structure Must Follow Governed Harm Identity, Not Administrative
Convenience.
- Composite Harm Record
A composite Harm may require one Governed Harm Record representing a
materially coherent whole even where:
multiple actions
multiple agents
multiple systems
multiple effects
or:
multiple subjects
contributed.
Therefore:
Multiple Components ≠ Multiple Harm Records by Default
- Distributed Harm Record
A distributed Harm Record must remain capable of referencing information
across technical and organizational partitions.
Canonical principle:
Evidence fragmentation, system fragmentation, or organizational
fragmentation must not fragment the identity of a materially coherent
Harm.
- Collective Harm Record
A Harm affecting a group, infrastructure, environment, population, or
society may require a collective Harm Record.
It must not necessarily be reduced to thousands or millions of identical
individual records.
Therefore:
Collective Harm Record ≠ Sum of Individual Records by Default
- Machine Readability
The Governed Harm Record should be representable in a structured
machine-readable form.
A machine-readable record should preserve semantic distinctions such as:
Established
versus:Partially Established
and:Insufficient Basis
versus:Not Established
These must not collapse into generic boolean fields.- Human Readability
Machine readability must not eliminate human interpretability.
A competent reviewer should be able to understand:
what Harm was determined
what was not determined
what scope applies
what uncertainty remains
and:
how the Determination was reached
- Interoperability
The Governed Harm Record should support controlled exchange across
compatible governance systems without losing semantic meaning.
Interoperability must preserve:
Harm identity
Determination State
Boundary
limitationsuncertainty
version
and:
lineage
Canonical principle:
Data Transfer ≠ Governance Transfer Unless Meaning Is Preserved.
- Semantic Integrity
A receiving system must not translate:
Insufficient Basis
into:No Harm
or:Partially Established
into:Established
simply because its data model supports fewer states.Canonical principle:
Interoperability must preserve governance distinctions, not merely data
fields.
- Record Accessibility
A Governed Harm Record must be accessible to authorized governance
processes that require it.
Accessibility does not mean unrestricted disclosure.
The record may contain sensitive information requiring:
access controls
purpose limitation
role-based access
data minimization
or:
jurisdiction-specific protections
HDRM governs methodological availability, not general privacy law.
- Record Integrity
The Governed Harm Record must be protected against unauthorized:
modification
deletion
state change
scope change
history alteration
or:
lineage loss
INTEGROS® may govern broader integrity mechanisms.
HDRM requires sufficient record integrity for Harm continuity.
- Auditability
A Governed Harm Record should make material governance actions traceable.
Where appropriate, this includes:
creation
state assignment
reassessment
correction
reopening
merge
separation
supersession
and:
closure
ADIT® may govern the evidence and audit infrastructure supporting these
records.
- Provenance
HDRM should preserve sufficient provenance to understand:
which HDS process created the record
which Determination State produced it
which evaluation supports it
and:
which governed basis underlies that evaluation
OBIDENITY® may provide supporting identity and provenance infrastructure.
- Record Persistence
The record should persist for as long as required to preserve legitimate
Harm governance continuity.
A Harm Record must not disappear merely because:
a system is replaced
an organization changes
a claim closes
a contract ends
a session ends
an AI model changes
or:
the producing mechanism stops
Canonical principle:
System Lifecycle ≠ Harm Record Lifecycle
- Mechanism Termination ≠ Record Termination
A mechanism may stop while Harm continues.
Therefore:
Mechanism Termination ≠ Harm Termination
and:
Mechanism Termination ≠ Governed Harm Record Termination
- Organizational Boundary ≠ Record Boundary
A Harm Record may need continuity across:
departments
companies
providers
institutions
or:
jurisdictions
where the same Harm remains governed.
Administrative transfer must not automatically create a new Harm identity.
- Handoff to Harm State Standard
The principal purpose of HDRM within the architecture sequence is to
create the governed Harm object required by HSS.
The handoff is:
Governed Harm Record → Harm State Governance
HSS then governs:
State Identification → State Classification → State Persistence → State
Transition → State Monitoring
HDRM does not perform those functions.
- HSS Continuity Reference
HSS should be capable of referencing the Governed Harm Record as the
stable identity anchor for Harm State governance.
Conceptually:
Governed Harm Record
↓Harm State₁
↓
Harm State₂
↓
Harm State₃
The record preserves which Harm those states belong to.
- Minimum Implementation Framework
A minimum HDRM implementation requires eight capabilities.
- Harm Record Formation
Create a distinguishable Governed Harm Record from the Governed Harm
Determination State and relevant HDS basis.
- Boundary & State Preservation
Preserve the exact Harm Boundary, Determination State, Established and
unresolved scope, uncertainty, confidence, and material limitations.
- Determination Lineage
Maintain traceability from the record to the Determination State,
evaluation, criteria, and qualified input basis without requiring
unnecessary duplication of underlying evidence.
- Identity & Relationship Governance
Maintain persistent Harm identity and support governed relationships,
merge, separation, composite, distributed, and collective Harm structures.
- Versioning & Historical Continuity
Support versioning, correction, supersession, reassessment, reopening, and
preservation of previous record states.
- Semantic Integrity & Interoperability
Preserve HDS meanings across human-readable, machine-readable, and
interoperable representations without collapsing distinct Determination
States.
- Integrity, Accessibility & Persistence
Protect the record against unauthorized alteration or loss while
maintaining legitimate governance accessibility and continuity across
technical or organizational change.
- Governed Handoff
Produce the authoritative Governed Harm Record required for Harm State
governance under HSS.
A system that stores only a conclusion such as “Harm: Yes/No” without
Boundary, Determination State, lineage, limitations, uncertainty, and
history does not fully implement HDRM.
- Use Case 1 — Established Harm Continues After the Original System
Is
Replaced
A Harm is formally established following an AI-mediated operation.
The original AI model is later replaced, the relevant session no longer
exists, and the operational system is migrated.
The Harm nevertheless continues.
HDRM preserves:
the same Harm identity
the original Governed Harm Boundary
the Established Determination State
the Determination lineage
the record history
and:
the connection to subsequent HSS governance
The Harm does not become a new Harm merely because the technology that
produced it changed.
The governing principle is:
System replacement does not reset Harm identity.
- Use Case 2 — New Information Changes a Partially Established Harm
A Harm Record initially carries:
Determination State: Partially Established
with:
Established Scope — Subjects A and B
and:
Unresolved Scope — Downstream effect affecting Subject C
New qualified information later establishes the downstream effect.HDS performs governed reassessment and HDSM changes the Determination
State to:
Established
HDRM creates the updated record version while preserving:the original Partially Established state
the unresolved scope at that time
the new basis
the reassessment
the state transition
and:
the current authoritative version
The governing principle is:
New knowledge may change the current record without changing what
governance legitimately knew before the new knowledge existed.
- Governance Requirements
HDRM requires that:
- every formally governed Harm remain distinguishable as a Harm
object - record identity remain separate from Harm origin
- the exact Governed Harm Boundary be preserved
- Determination States retain their canonical meaning
- Partial Establishment preserve established and unresolved scope
- Determination lineage remain traceable
- the Harm Record remain separate from incident, evidence, claim,
accountability, and liability records; - Harm identity remain stable
through legitimate lifecycle-state change; - record versioning not create
new Harm identity by default; - corrections and supersession preserve
history; - reassessment and reversal not erase earlier governance states;
- temporal distinctions between emergence, Recognition, Determination, and
record creation remain preserved; - uncertainty and limitations not
disappear through documentation; - Unknown not silently become No or Zero;
- relationships between Harm objects remain separate from identity; -
merge and separation preserve provenance; - composite, distributed, and
collective Harm remain representable; - machine readability preserve
methodological semantics; - interoperability preserve Determination State
and Boundary meaning; - unauthorized alteration or history loss be
prevented; - the record remain accessible to legitimate governance
processes; - technical, organizational, or mechanism change not
automatically terminate record continuity; - the Governed Harm Record
provide the authoritative handoff to HSS.
- Governance Logic
HDRM applies the following logic:
Has HDSM produced a Governed Harm Determination State?
If no:
→ no final Governed Harm Record is formed through HDRM.
If yes:
→ identify the governed Harm object.
What exact Harm Boundary was determined?
→ preserve it.
What Determination State applies?
→ preserve it without semantic simplification.
Is the Harm Partially Established?
→ record Established Scope and Unresolved Scope separately.
What Determination lineage must remain traceable?
→ link the State to HDEM, HDCM-D, HDIM, and relevant governed basis.
What uncertainty, confidence, or limitations remain?
→ preserve them.
Does an existing Harm Record already represent the same Harm?
If yes:
→ update or version that record rather than create a duplicate Harm
identity.
Has the Harm materially changed identity or separated into another Harm
object?
→ apply governed relationship, merge, or separation logic.
Has new information changed the Determination?
→ preserve the prior state and create the appropriate reassessed version.
Has an error been corrected?
→ preserve both correction and history.
Can another system receive the record without losing its methodological
meaning?
If no:
→ do not treat data transfer as complete governance interoperability.
Then produce:
Governed Harm Record
for HSS.At every stage:
Record ≠ Harm Origin
Record ≠ Evidence
Record ≠ Claim
Record ≠ Liability
Record Version ≠ New Harm
Current Record ≠ Complete History
Record Creation Time ≠ Harm Emergence Time
System Lifecycle ≠ Harm Record Lifecycle
- Governance Outputs
HDRM may produce:
- Governed Harm Record
- Governed Harm Identity
- Harm Record Identifier
- Determination State Reference
- Governed Harm Boundary Reference
- Established Scope
- Unresolved Scope
- Determination Lineage
- Determination Criteria Reference
- Determination Evaluation Reference
- Qualified Input Reference
- Uncertainty Record
- Limitation Record
- Confidence Record
- Dispute Status
- Record Version
- Record History
- Record Correction
- Record Supersession
- Record Reopening State
- Harm Relationship Record
- Harm Merge Record
- Harm Separation Record
- Composite Harm Record
- Distributed Harm Record
- Collective Harm Record
- Record Integrity State
- Interoperability Representation
- HSS Handoff Package
The principal output is:
Governed Harm Record
- Critical Distinctions
Determination Conclusion ≠ Complete Governed Harm Record
Related Harm Objects ≠ Same Harm Object by Default
Record Identity ≠ Harm Origin
Record Creation Time ≠ Harm Emergence Time
Governed Harm Record ≠ Evidence Archive
Record Summary ≠ Complete Evaluation
Incident Record ≠ Governed Harm Record
Claim Record ≠ Governed Harm Record
Governed Harm Record ≠ Liability Record
Governed Harm Record ≠ Accountability Record
Harm Determination Record ≠ Harm State Record
Harm State Change ≠ New Harm Identity by Default
New Record Version ≠ New Harm Object
Superseded ≠ Deleted
Current Record ≠ Complete Governance History
Late Determination ≠ Late Harm
Unknown ≠ Zero
Confidence ≠ Harm Severity
Relationship ≠ Identity
Multiple Components ≠ Multiple Harm Records by Default
Collective Harm Record ≠ Sum of Individual Records by Default
Data Transfer ≠ Governance Transfer Unless Meaning Is Preserved
System Lifecycle ≠ Harm Record Lifecycle
Mechanism Termination ≠ Harm Record Termination
Organizational Boundary ≠ Harm Record Boundary
- Canonical Boundary
The HDRM — Harm Determination Record Module governs the formation,
identity, structure, qualification, lineage, versioning, correction,
supersession, reopening, relationship, merge, separation, integrity,
semantic preservation, interoperability, accessibility, persistence, and
historical continuity of the Governed Harm Record produced through HDS. It
preserves the formal Harm Determination and provides the durable governed
Harm object required for subsequent HAGA™ governance, but does not qualify
Determination inputs, establish Determination Criteria, perform
Determination Evaluation, independently assign the Determination State,
govern the evolving Harm lifecycle State, determine propagation,
containment, mitigation, recovery, Residual Harm, Resolution or Finality,
establish general causation, assign accountability or responsibility,
determine liability, govern claims or compensation, or replace evidence,
validation, integrity, operational reality, identity, AI behavior,
autonomous execution, simulation, prediction, Value, tax-event, or
jurisdiction-specific governance.
- Canonical Closing Statement
A Harm Determination that cannot survive the system, report, organization,
or process in which it was created cannot provide reliable lifecycle
governance.
HDRM gives determined Harm a persistent methodological identity —
preserving what was established, what remained unresolved, how the
determination was reached, and how that understanding changed over time.
The record must follow the Harm, not the administrative systems that
happen to store it.
Once Harm becomes a governed object, its governance history must remain
part of that object.