Appendix B — Engineering Moves

B.4 Derive What Must Be Assured

Problem. Measures of existing evidence—tests written, lines covered, checks passing—cannot reveal obligations that were never encoded. Before measuring coverage, establish what evidence should exist.

Move. Derive what must be assured from the engineering model, then compare that required set with the evidence that exists.

Figure B.4-1 traces the required set against the evidence.

C.4 Derive what must be assured: generate the obligation set from the model, then subtract existing evidence A vertical flow. A model derives the set of things that must be assured — what must be tested. That required set is compared against the evidence that actually exists. The comparison splits into two: obligations that are covered, and obligations with no matching evidence. The gap is not measured from tests written; it is the required set minus the present evidence, and each uncovered obligation becomes a finding. derive compare MODEL WHAT MUST BE ASSURED seams · failure edges · invariants EXISTING EVIDENCE tests · checks that actually exist COVERED GAP FINDING Measure the required set minus the present evidence — not the evidence you happen to have written.
Figure B.4-1. Required set minus present evidence. The model derives what must be assured; that required set is compared against existing evidence; the intersection is covered, and the remainder is a gap that raises a finding.

Example — Test obligations. Structured models expose seams, failure edges, and invariants. Those elements generate a census of what should be tested. Compare that census with the existing suite, and every missing test becomes mechanically visible and can block the gate.

Example — Governance obligations. The same move applies to controls. When governance targets are explicit, the environment classifies controls by what they protect and surfaces every target with no control — or only advisory guidance. Here the evidence is governance mechanisms rather than tests, but the move is the same: derive the required set, compare it with what exists, and report what is missing.

Related mechanisms: Model-derived test-obligation census · Coverage → model-node mapping · Control-coverage census · Governance Graph · Journey-criticality → test-tier placement.

© James C. Davis, 2026–present