Simulation Use Limitation Module (SUM)
OOF™ Origin Open Foundation™
Independent Methodological Authority
Architecture Ecosystem: Structured Reality Standards™
Architecture Family: SIMULOS® — Simulation Governance Architecture
Parent Standard: Simulation Evidence & Reliance Boundary Standard (SERBS)
Module: SUM — Simulation Use Limitation Module
Operational Layer: Simulation Use Limitation Layer
Category: Governance & Enforcement
Subcategory: Simulation Governance
Type: Core Module
Governed Space: Simulation Evidence Use Limitation
Origin ID: SIMULOS-SERBS-SUM-011.4
Version: 1.0
Status: Canonical · Open Standard
Effective Date: 20 August 2026
Compatibility: OOF® Methodology OS™ · GOA™ · ORA™ · VALIDOS® · INTEGROS® · ADIT® · AGA™ ·
AIG® · ASGA™ · RIS™
AI-Readable: Yes
Authority: OOF®
Protection: MIP® — Methodology Intellectual Property Protection
Canonical Language: English
Canonical Definition
Simulation Use Limitation Module (SUM) is the fourth Core Module of theSimulation Evidence & Reliance Boundary Standard (SERBS) within SIMULOS® —
Simulation Governance Architecture.
SUM governs the explicit restrictions, exclusions, conditions, caveats,
unsupported interpretations, prohibited uses, and dependency conditions that
must remain attached to simulation-derived evidence when that evidence is
interpreted, communicated, transferred, or used.
The Module translates the governed reliance boundary established by SRBM —
Simulation Reliance Boundary Module into explicit controls over what
simulation evidence may not legitimately be used to claim, infer, justify,
demonstrate, predict, authorize, or support.
SUM does not determine whether simulation evidence qualifies as evidence, how
much evidential weight it carries, or whether the complete validation basis is
sufficient.
Its task is narrower:
to ensure that the limitations governing simulation-derived evidence remain
explicit, persistent, interpretable, transferable, and inseparable from
downstream use of that evidence.
Core Question
What must simulation-derived evidence not be used to claim, infer, justify, orsupport?
Architectural Position
SUM is the fourth module within SERBS.It follows:
SEQM — Simulation Evidence Qualification
Module
→ establishes what qualifies as Simulation Evidence;SEWM — Simulation Evidence Weight Module
→ establishes how much simulation-specific evidential significance theevidence may carry;
SRBM — Simulation Reliance Boundary Module
→ establishes how far legitimate reliance may extend.SUM then converts those boundaries into explicit use controls.
It precedes:
SVIM — Simulation Validation Interface
Module
which governs transfer of simulation-derived evidence into broader validationgovernance under VALIDOS®.
The sequence is therefore:
Qualification → Weight → Reliance Boundary → Use Limitation → Validation
Interface.
Internal Flow Position
Weighted Simulation Evidence Governed Simulation Reliance Boundary → IntendedUse Identification → Limitation Source Identification → Use Condition
Definition → Restriction Definition → Exclusion Definition → Unsupported
Interpretation Identification → Prohibited Use Definition → Limitation
Persistence Requirements → Use Limitation State → Governed Simulation Use
Limitation Record → SVIM — Simulation Validation Interface Module
Operational Space
SUM governs the space between:where legitimate simulation reliance ends
and
how that boundary must constrain actual evidence use.
This operational space includes: intended evidence use; permitted-use
conditions; conditional use; restricted use; excluded use; unsupported
interpretation; prohibited inference; prohibited generalization; prohibited
extrapolation; decision-class limitation; configuration limitation; scenario
limitation; parameter limitation; environmental limitation; temporal
limitation; uncertainty limitation; correlation limitation; dependency
limitation; communication limitation; transfer limitation; limitation
persistence; limitation review; limitation withdrawal following material
change.
Operational Scope
SUM applies whenever simulation-derived evidence is: interpreted; summarized;aggregated; communicated; transferred; presented; cited; compared; used in
engineering; used in scientific analysis; used in safety arguments; used in
mission planning; used in design decisions; used in system qualification; used
in regulatory submissions; used in validation processes; used in operational
preparation; used in deployment decisions; used in AI or autonomous-system
evaluation; used in consequential organizational decisions.
It applies to evidence derived from: individual simulation runs; repeated
executions; Monte Carlo studies; scenario portfolios; simulation campaigns;
engineering simulations; scientific simulations; safety simulations; mission
simulations; digital twins; physical simulations; hybrid simulations; AI
simulations; autonomous-system simulations; future simulation technologies.
SUM remains technology-neutral. Reliance
Boundary ≠ Use Limitation
SUM enforces the distinction:Reliance Boundary ≠ Use Limitation
SRBM determines:where legitimate reliance stops.
SUM determines:
what restrictions must govern use because that boundary exists.
For example, SRBM may establish that evidence applies only to:
Object Version V4 + Scenario Family S3 + Parameter Range P2 + Environment E1.
SUM may translate this into explicit controls:
Do not apply this evidence to Object Version V5.
Do not generalize this evidence beyond Scenario Family S3.
Do not use this evidence to support performance outside Parameter Range P2.
Do not represent this evidence as demonstrating performance in environments
materially different from E1.
SRBM defines the boundary.
SUM operationalizes it.
Use Limitation Principle
A Simulation Use Limitation is:an explicit governance condition constraining how simulation-derived evidence
may be interpreted, communicated, transferred, generalized, or relied upon.
A limitation may arise from: simulation purpose; simulation scope; exclusions;
reality representation; abstraction; fidelity; assumptions; model
applicability; environmental configuration; input basis; scenario coverage;
execution conditions; output classification; inference basis;
simulation-to-reality correlation; uncertainty; evidence weight; reliance
boundary; temporal relevance.
Use limitations must remain linked to their source.
Limitations Are Part of the Evidence
SUM establishes a central principle:A material limitation is part of the governed evidential meaning, not optional
commentary attached to it.
Removing a material limitation while preserving the evidence can materially
change the meaning of the evidence.
Therefore:
Evidence − Material Limitation ≠ Same Evidence Meaning.
Where a limitation materially determines legitimate interpretation, the
limitation must travel with the evidence.
Intended Use Identification
SUM requires the intended use of simulation evidence to be explicit.An Intended Use may include: exploration; comparison; screening; engineering
design; optimization; hypothesis support; safety analysis; scenario planning;
mission planning; training; system qualification; validation input;
operational preparation; deployment support; regulatory evidence; predictive
analysis.
The same evidence may have different limitations for different intended uses.
Permitted Use Conditions
SUM may establish conditions under which evidence remains legitimately usable.Examples include:
Permitted only for comparative analysis.
Permitted only for the governed Simulation Object configuration.
Permitted only within represented environmental conditions.
Permitted only within Parameter Range P.
Permitted only while Assumption Set A remains applicable.
Permitted only as one input to a broader validation process.
Conditional use must remain distinguishable from unrestricted use. Restriction
A restriction narrows how evidence may be used without completely prohibiting
its use.
Restrictions may concern: purpose; object; configuration; scenario;
environment; parameter range; decision type; temporal period; inference class;
communication context.
For example:
Evidence may support comparative design selection but must not be used as
independent evidence of operational safety. Exclusion
An exclusion identifies a condition or domain that the evidence does not
cover.
Examples include: weather conditions not represented; hardware versions not
simulated; excluded failure modes; populations not modeled; untested terrain;
unrepresented physical phenomena; mission phases outside simulation scope;
operating conditions outside parameter limits.
An exclusion must not disappear merely because downstream users are unaware of
it.
Unsupported Interpretation
An Unsupported Interpretation occurs where the evidence is described asmeaning more than its governed basis supports.
Examples include:
Simulation demonstrated safe behavior
when the evidence only establishes:no unsafe behavior was observed within the simulated scenario set.
Or:
The system performs reliably in reality
when the evidence establishes only:high simulated performance within represented conditions.
SUM requires unsupported interpretations to be identifiable and preventable.
Observed Absence ≠ Demonstrated Impossibility
Simulation campaigns frequently produce no instance of a particular failure.
SUM establishes:
Failure Not Observed ≠ Failure Impossible
The absence of an event within a simulated scenario space may provide evidenceconcerning that tested space.
It does not automatically establish impossibility outside that space.
This distinction is especially important in: rare-event simulation; safety
analysis; autonomous systems; mission simulation; infrastructure failure
analysis; high-consequence engineering.
Simulation Success ≠ Operational Safety
A simulation campaign may demonstrate extensive successful simulated behavior.That does not independently establish operational safety.
Therefore:
Simulation Success ≠ Operational Safety Determination.
SUM must prevent simulation success metrics from being communicated as broader
safety determinations where the evidence basis does not support that
interpretation. Scenario Success ≠ Universal Performance
Successful performance across all executed scenarios means:
successful performance across those governed executed scenarios.
It does not mean:
successful performance across every possible condition.
SUM therefore preserves:
Tested Scenario Space ≠ Total Possible Reality Space. Comparative Evidence ≠
Absolute Evidence
Evidence demonstrating that:
Configuration A outperformed Configuration
B
does not necessarily establish:Configuration A meets an absolute operational performance requirement.
SUM requires comparative claims and absolute claims to remain distinct.
Simulation Prediction ≠ Guaranteed Outcome
Where simulation evidence supports prediction, SUM requires the distinction:
Predicted Outcome ≠ Guaranteed Outcome.
Predictive simulation evidence may legitimately inform planning and
decision-making.
It must not acquire deterministic meaning merely because the simulation
produces precise numerical outputs.
Precision Limitation
Highly precise simulation outputs may create false confidence.SUM therefore establishes:
Numerical Precision ≠ Evidential Certainty.
An output of:
0.003721 failure probability
does not necessarily mean the real-world probability is known to six
significant digits.
The precision communicated must remain compatible with: model uncertainty;
input uncertainty; scenario uncertainty; representation limits; correlation
uncertainty; inference uncertainty.
Extrapolation Limitation
Where evidence is extrapolated beyond directly simulated conditions, theextrapolation must remain explicitly identified.
SUM may require statements such as:
This conclusion includes extrapolation beyond the directly simulated parameter
range.
or:
This evidence does not independently support performance beyond the simulated
environmental domain.
Unidentified extrapolation is a use-governance failure.
Decision-Class Limitation
Simulation evidence may legitimately inform one decision class while remaininginsufficient for another.
For example:
Exploratory Design Decision
may require less evidential support than:Safety-Critical Deployment Decision.
SUM may therefore assign different use limitations based upon the intended
decision class.
It does not define organizational decision authority.
Configuration Limitation
Evidence associated with one Simulation Object configuration must retainlimitations concerning materially different configurations.
Changes may include: hardware; software; architecture; sensor suite; actuator
system; material; payload; model configuration; operating mode.
Evidence transfer across configurations requires a governed basis.
Scenario Limitation
SUM requires scenario limitations to remain visible.Evidence may be limited to: expected scenarios; edge cases; stress conditions;
specified scenario families; defined uncertainty ranges; specific failure
combinations.
A scenario limitation should identify both:
what was represented
and, where material:
what was not represented.
Environmental Limitation
Evidence may be valid only under specified represented environments.Limitations may concern: weather; terrain; lighting; atmosphere; gravity;
thermal conditions; traffic; infrastructure; communication availability; human
interaction; electromagnetic conditions.
Environmental limitations are especially important where simulation-to-reality
transfer is material.
Temporal Limitation
Simulation evidence may have a temporal use boundary.A limitation may require review when: the Simulation Object changes; the
operational environment changes; new reality data becomes available; model
versions change; assumptions become obsolete; new failure modes emerge; input
distributions shift; correlation deteriorates.
Evidence should not retain permanent unrestricted use merely because it was
once appropriately qualified.
Uncertainty Limitation
Material uncertainty must constrain interpretation where relevant.SUM may require: confidence qualification; uncertainty ranges; conditional
language; restricted extrapolation; additional evidence; prohibition of
deterministic claims.
Uncertainty is not a reason to discard useful evidence.
It is a reason to govern how strongly that evidence is expressed and used.
Dependency Limitation
Where evidence objects share material dependencies, downstream users must notinterpret their quantity as equivalent independent confirmation.
SUM may therefore require disclosure that: runs share the same model; evidence
shares the same assumptions; outputs share the same input source; models share
a common representation; scenario sets share common omissions; evidence shares
one correlation basis.
Multiple dependent evidence objects must not be presented as independent
confirmation.
Aggregation Limitation
Aggregated simulation metrics must not erase material information.An aggregate success rate may conceal: rare failures; scenario-specific
failures; environmental clusters; configuration-specific weaknesses; anomalous
executions; distribution tails; common-mode failures.
SUM may therefore require that material underlying limitations remain attached
to aggregate evidence.
Communication Limitation
Simulation evidence can be methodologically distorted through communicationeven when the underlying evidence remains unchanged.
SUM therefore applies to: reports; dashboards; executive summaries; regulatory
submissions; presentations; scientific communication; engineering
documentation; automated AI-generated summaries; machine-readable evidence
transfers.
A summary must not remove limitations necessary to interpret the evidence
correctly.
Human-Readable and Machine-Readable
Limitations
Because simulation evidence may move through automated systems, limitationsshould be capable of being represented in both:
human-readable form
and
machine-readable form.
Machine-readable limitation fields may include: permitted use; restricted use;
prohibited use; applicable object; applicable version; applicable
configuration; scenario domain; parameter domain; environmental domain;
temporal validity; uncertainty condition; correlation condition; review
trigger.
This allows limitations to survive automated evidence pipelines.
Limitation Persistence Principle
SUM establishes:A limitation must travel at least as far as the evidence it limits.
If evidence is: copied; exported; aggregated; summarized; transferred;
transformed; entered into another system; entered into validation; reused in
another analysis,
material limitations must remain discoverable and linked.
Limitation Detachment
Limitation Detachment occurs when evidence continues downstream while itsgoverning limitations are lost, hidden, omitted, weakened, or separated.
Examples include: copying a simulation metric without its scenario boundary;
presenting a success percentage without excluded failures; transferring
evidence without uncertainty; using a graph without its parameter range;
citing a simulation conclusion after the Simulation Object configuration
changed; removing caveats from an executive summary.
SUM treats material limitation detachment as a simulation governance failure.
Limitation Conflict
Different evidence objects may carry conflicting use limitations.One evidence object may support a proposition under one condition while
another constrains it under another.
SUM requires such conflicts to remain visible rather than collapsing them into
one apparently unrestricted conclusion.
Use Limitation States
SUM may assign a governed Use Limitation State.A minimum state model may include: 1.
Undefined Limitation
Evidence exists, but material use limitations have not yet been explicitlyestablished. 2. Conditional Use
Evidence may be used only while defined conditions remain satisfied. 3.
Restricted Use
Evidence may be used only for specified purposes, contexts, objects,
scenarios, or decision classes. 4. Prohibited Use
A specified use, interpretation, inference, or decision application is not
supported by the governed simulation evidence. 5. Review Required
Material change or new information requires reassessment before continued use.
6. Limitation Superseded
A previous limitation has been replaced by a newly governed limitation basis.
These states govern evidence use rather than overall validation status.
Prohibited Use
A Prohibited Use is a use that exceeds the legitimate simulation-specificevidential basis sufficiently that it should not proceed without a new
governed basis.
Examples may include: claiming universal behavior from bounded scenarios;
claiming real-world equivalence from simulation alone; claiming operational
safety solely from simulated success; applying evidence to a materially
different object configuration; concealing known scenario exclusions; treating
correlated simulations as independent evidence; presenting inferred results as
directly observed results; using stale evidence after material reality change;
treating extrapolation as direct simulation evidence; representing simulation
evidence as a formal Validation Determination.
Prohibited Use ≠ Organizational
Prohibition
SUM defines methodological prohibited use within simulation evidencegovernance.
It does not itself impose legal, regulatory, corporate, or disciplinary
sanctions.
Other governance structures may use SUM outputs to establish such controls.
Limitation Review Trigger
Use limitations should be reassessed when materially relevant changes occur.Triggers may include: Simulation Object change; configuration change; new
simulation results; new scenarios; new model; new input basis; new correlation
evidence; operational observations; newly discovered failure; changed intended
use; changed decision class; changed environment; expired temporal
applicability.
Review may result in:
limitation retained → limitation narrowed → limitation expanded → limitation
replaced → additional simulation required.
SUM Boundary with SRBM
SRBM determines the maximum legitimate reliance boundary.SUM operationalizes that boundary through explicit restrictions and prohibited
uses.
Therefore:
SRBM = Where reliance stops.
SUM = What use must be constrained because it stops there.
SUM Boundary with SVIM
SUM establishes the limitations.SVIM ensures that those limitations remain attached when evidence crosses into
broader validation governance.
SUM therefore provides a critical input to SVIM.
SUM Boundary with VALIDOS®
SUM does not determine validation sufficiency.It may establish that simulation evidence:
must not independently be used to support a Validation Determination.
VALIDOS® then determines whether the total evidence basis is sufficient.
Therefore:
Simulation Use Limitation ≠ Validation Determination.
SUM Boundary with SOGS
SOGS governs limitations associated with what simulation outputs themselvesmean.
SUM governs limitations on evidential use after those outputs have become
qualified Simulation Evidence.
Therefore:
Output Limitation ≠ Evidence Use Limitation.
An output limitation may become an input into SUM, but the governed spaces
remain distinct.
SUM Boundary with SRCS
SRCS governs simulation-to-reality correlation.SUM may impose use limitations based upon the correlation conditions
established by SRCS.
It does not determine correlation itself.
SUM Boundary with ORA™
ORA™ governs Operational Reality.SUM may prohibit or restrict claims about Operational Reality where simulation
evidence does not support them.
It does not define Operational Reality.
SUM Boundary with INTEGROS®
SUM does not govern general evidence integrity.INTEGROS® may govern whether evidence and limitations retain integrity through
processing or transfer.
SUM governs what limitations must exist and remain associated with simulation
evidence.
SUM Boundary with ADIT®
ADIT® may audit whether limitations were preserved, communicated, or followed.SUM defines the simulation-specific limitations that should govern evidence
use.
SUM Boundary with AGA™
AGA™ governs who holds responsibility and accountability for decisionsinvolving evidence.
SUM governs what simulation evidence may legitimately be used to support.
It does not assign accountability for violating a limitation. SUM Boundary
with AIG® / ASGA™
SUM may constrain claims derived from simulations of AI or autonomous systems.
It does not govern the actual deployed system's behavior, autonomy, authority,
permissions, or operational constraints.
Minimum Implementation Framework
A minimum SUM implementation should
establish: 1. Evidence Input
Receive qualified, weighted, reliance-bounded Simulation Evidence. 2. IntendedUse Identification
Define how the evidence is intended to be interpreted or used. 3. Limitation
Source Identification
Identify the simulation conditions creating material use limitations. 4.
Permitted Use Conditions
Define conditions under which use remains legitimate. 5. Restriction
Definition
Identify materially restricted uses. 6.
Exclusion Definition
Identify contexts, conditions, objects, scenarios, or claims outside theevidence basis. 7. Unsupported Interpretation Assessment
Identify interpretations that exceed the governed meaning. 8. Prohibited Use
Definition
Define uses that cannot legitimately proceed on the existing simulation
evidence basis. 9. Persistence Control
Ensure material limitations remain linked to evidence through communication,
aggregation, transformation, and transfer. 10. Limitation State and Review
Assign a governed limitation state and identify conditions requiring
reassessment.
Governance Outputs
SUM may produce: Simulation Intended Use Record Simulation Permitted UseCondition Simulation Evidence Restriction Record Simulation Evidence Exclusion
Record Unsupported Interpretation Record Prohibited Simulation Evidence Use
Record Simulation Extrapolation Limitation Simulation Decision-Class
Limitation Simulation Configuration Limitation Simulation Scenario Limitation
Simulation Environmental Limitation Simulation Temporal Limitation Simulation
Uncertainty Limitation Simulation Evidence Dependency Limitation Simulation
Limitation Persistence Record Simulation Use Limitation State Governed
Simulation Use Limitation Record
These outputs provide the limitation basis required by:
SVIM — Simulation Validation Interface Module.
Enterprise Application
SUM enables organizations to solve a critical problem that occurs aftersimulation evidence has already been produced correctly:
the evidence may be governed correctly at its source but used incorrectly
downstream.
A simulation team may clearly understand that a result applies only to: one
configuration; one scenario family; one environment; one parameter range; one
model version; one uncertainty range.
But after the result enters a dashboard, management report, validation
package, regulatory submission, engineering decision, or automated evidence
pipeline, those qualifications may disappear.
The result may remain numerically identical while its organizational meaning
becomes distorted.
SUM prevents that separation.
For a spacecraft simulation, evidence concerning a defined landing envelope
must not silently become evidence for all landing conditions.
For an autonomous vehicle, millions of successful simulated scenarios must not
be represented as proving unrestricted real-world safety where the simulation
did not represent all materially relevant conditions.
For a robot, evidence produced for one sensor, actuator, payload, software,
and environmental configuration must not automatically transfer to another
configuration.
For engineering simulation, results generated within defined physical
assumptions and parameter ranges must not be presented as universal physical
behavior.
SUM therefore ensures that organizations preserve not only:
the simulation result
but also:
the rules governing what that result may legitimately be used to mean.
Foundational Principles
A material use limitation is part of the evidential meaning.Reliance boundaries must become operational use controls.
Evidence must not travel without the limitations that govern it.
Failure not observed does not mean failure impossible.
Simulation success does not independently establish operational safety.
Scenario success does not establish universal performance.
Comparative evidence does not automatically establish absolute performance.
Simulation prediction does not guarantee outcome.
Numerical precision does not create evidential certainty.
Extrapolation must remain identifiable as extrapolation.
Multiple dependent evidence objects must not be represented as independent
confirmation.
Summarization must not remove limitations necessary for legitimate
interpretation.
A limitation must travel at least as far as the evidence it limits.
Simulation-derived evidence must never become more general, certain,
transferable, or authoritative merely because the limitations that originally
constrained it have been forgotten.