# Systems that are not reproducible

Evidencing constraint when you cannot evidence behaviour.

Source: https://intransic.com/questions/non-determinism

## How do I evidence a control when the system's behaviour isn't fully determined by its source?

Stop evidencing behaviour. Evidence constraint instead. Source-derived evidence answers what your system will do, and that answer is not available to you here. No amount of testing recovers it either, because a passing sample of a non-deterministic system is a fact about the sample. What stays available is the shape of the box. What may your agent call? What identity does it call with? What is it denied? Those are properties of your infrastructure. They hold whatever the model decides on any given run. Write controls that constrain rather than predict, and your evidence problem turns back into an ordinary one.

## What does an auditor do with a system whose outputs aren't reproducible?

Honestly, the profession is still working this out. Anyone telling you otherwise is selling something. What is already clear is that an auditor can assess the controls around your system without reproducing its outputs. They do this for processes run by people, who are also not reproducible. Access control, change management, logging, segregation of duties — all of it transfers. What does not transfer is any assurance resting on your output being predictable. Expect scrutiny to land on your boundaries rather than your model. You can start preparing that boundary evidence now. It does not depend on how the guidance settles.