Claim / QuestionDefine the claim that matters to the decision.
↓
FrameSurface assumptions, competing explanations, and the evidence that would support or break each theory.
↓
PreserveProtect the evidence, record source and condition, preserve automation inputs, outputs, and tool/version records where used.
↓
CorroborateTest each material claim against independent sources where available.
SupportedIndependent sources agree without sharing the same failure mode.
ConflictIndependent sources contradict each other; the conflict becomes evidence to investigate.
Unsupported / UnavailableCorroboration is absent or unavailable; the limitation is stated rather than hidden.
↓
AnalyzeReconstruct events and test patterns against the underlying evidence, not against summaries.
Automation may assist retrieval, correlation, summarization, pattern proposal, and drafting across earlier phases. Human judgment only beyond this point.
AdjudicateA person sets the conclusion and classifies the finding before it is relied on.
KnownSupported by evidence within its stated limits.
AssumedRelied on as an assumption and identified as such.
UndeterminedThe evidence does not resolve the matter.
↓
ReportState findings, evidence, reasoning, limits, contrary evidence, assumptions, and automation contribution.
↓
Defensibility CheckIf the finding cannot be traced, bounded, reproduced from preserved evidence, and understood with its limits, it returns to the phase where the gap opened.
↓
Finding Released or ReturnedOnly findings that pass the standing check leave the practice.
Investigation and Assurance
The same lifecycle applies in two directions. In investigation, the method tests claims about what happened inside a system. In assurance, the method tests claims about the system itself: what it does, where it fails, which controls operate, and who remains accountable.
InvestigationClaim about an event → evidence tested → finding about what happened.
AI AssuranceClaim about a system → behavior and controls tested → finding about whether the claim can be trusted.
Plain-Language Reading
The method prevents a jump from “a system says this happened” to “this happened.” It requires the examiner to define the question, preserve the evidence, test claims against independent sources, handle conflicts honestly, separate what is known from what is assumed or undetermined, and release only findings that can be defended.
Claim-centeredTraditional forensic methods protect and examine evidence. Zemi governs the reasoning from evidence to finding.
AI boundaryAutomation can help retrieve, correlate, summarize, propose, and draft. It does not adjudicate, conclude, or sign off.