Source events and evidence

Everything Memnox learns arrives as a source event. A Slack message, a merged pull request, an updated issue, a meeting transcript, a signed contract, all of them normalize into the same shape before anything else looks at them.

That one shape is why adding an integration is a configuration act rather than a code change. The extraction pipeline has never heard of Slack.

The shape

The rule that never bends

Every source event carries a resolvable URL.

Content with nowhere to point back to is rejected at the normalizer, not stored with a blank field. An unevidenced meeting or document does not enter the system at all.

Some tools do not send a link. Slack sends a channel and a timestamp; Jira sends an issue key. For those, the permalink is composed from the workspace's configured base URL, which is why a workspace missing slack.workspaceUrl or jira.baseUrl rejects those events rather than storing them bare. Set them under Settings → Permalinks.

Trust is a lookup

authorTrusted is never assumed. The author is resolved against the people known in that workspace, and:

• resolves to a known person → trusted;
• unrecognised, or absent entirely → tainted.

Fail closed, for every toolkit alike. There is no source type senior enough to skip the lookup, and no author name trusted because it looks internal.

Some sources are tainted whatever the author

A second rule runs after the author check. Source types that are inherently third-party, documents, email, chat outside your workspace boundary, are always tainted, no matter who forwarded them.

The reasoning is short: a senior person forwarding a supplier's PDF does not make the supplier's PDF ground truth. What is trusted is that they forwarded it, not what it says.

Derivatives ending in _enriched inherit their base type's classification, so an LLM rewrite of a tainted document is still tainted. Laundering taint through a summarizer does not work.

Full treatment in Trust, taint and provenance.

What happens to a tainted event

Nothing dramatic. It is stored, indexed and searchable like everything else, and it is marked UNTRUSTED SOURCE where an extraction prompt can see it, and it raises the bar for any privileged action taken in a session that read it.

Tainted does not mean false. It means not ground truth.

The log

Events are appended to a per-workspace, append-only log, ordered by when they happened. It is the raw material for extraction, search and the timeline.

Retention prunes it on a schedule you set, see Privacy and retention.