{
  "dataset": "corrobore-parallel-worlds-exfiltration",
  "version": "1.0.0",
  "description": "Two incompatible explanations of one exfiltration, sharing five base facts, with predictions that separate them and one observation that does not.",
  "license": "CC0-1.0",
  "generated_by": "corrobore-website/usecases/parallel-worlds.mjs",
  "facts": {
    "shared_base_facts": 5,
    "worlds": 2,
    "predictions": 5,
    "non_discriminating_observations": 1
  },
  "memories": [
    {
      "identity_key": "case--exfiltration",
      "kind": "hypothesis.case",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Exfiltration of a design repository through the supplier integration path.",
          "properties": {}
        }
      },
      "provenance": [
        {
          "source_id": "case-file",
          "locator": "opening",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "case"
      ]
    },
    {
      "identity_key": "fact--exfil-volume",
      "kind": "hypothesis.base_fact",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "42 GB left the design network between 01:40 and 04:10 on a Sunday.",
          "properties": {
            "disputed": false
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--exfil-volume#record",
          "observed_at": null
        }
      ],
      "confidence": 0.92,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "base-fact"
      ]
    },
    {
      "identity_key": "fact--egress-path",
      "kind": "hypothesis.base_fact",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The transfer used the supplier VPN concentrator rather than the corporate proxy.",
          "properties": {
            "disputed": false
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--egress-path#record",
          "observed_at": null
        }
      ],
      "confidence": 0.92,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "base-fact"
      ]
    },
    {
      "identity_key": "fact--credential-used",
      "kind": "hypothesis.base_fact",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The transfer authenticated with the shared integration service account.",
          "properties": {
            "disputed": false
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--credential-used#record",
          "observed_at": null
        }
      ],
      "confidence": 0.92,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "base-fact"
      ]
    },
    {
      "identity_key": "fact--no-alert",
      "kind": "hypothesis.base_fact",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "No data-loss rule fired, because the destination was on the supplier allowlist.",
          "properties": {
            "disputed": false
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--no-alert#record",
          "observed_at": null
        }
      ],
      "confidence": 0.92,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "base-fact"
      ]
    },
    {
      "identity_key": "fact--repo-scope",
      "kind": "hypothesis.base_fact",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The exfiltrated set matches a repository both an insider and the supplier could read.",
          "properties": {
            "disputed": false
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--repo-scope#record",
          "observed_at": null
        }
      ],
      "confidence": 0.92,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "base-fact"
      ]
    },
    {
      "identity_key": "world--insider",
      "kind": "hypothesis.world",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Branch holding the insider explanation over the shared base facts.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#branch",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "world"
      ]
    },
    {
      "identity_key": "world--supplier",
      "kind": "hypothesis.world",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "Branch holding the compromised-supplier explanation over the shared base facts.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#branch",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "world"
      ]
    },
    {
      "identity_key": "hypothesis--insider",
      "kind": "hypothesis.hypothesis",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "An employee with legitimate design-network access staged and exfiltrated the repository.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "hypothesis--insider#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "hypothesis"
      ]
    },
    {
      "identity_key": "prediction--badge",
      "kind": "hypothesis.prediction",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "If an insider did this, a badge record or a remote-session record should place a person at work during the window.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--badge#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "prediction"
      ]
    },
    {
      "identity_key": "prediction--local-staging",
      "kind": "hypothesis.prediction",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "If an insider did this, staging artifacts should exist on a workstation inside the design network.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--local-staging#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "prediction"
      ]
    },
    {
      "identity_key": "prediction--shared-account",
      "kind": "hypothesis.prediction",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "If an insider did this, the shared integration account was used because it avoids per-user attribution.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--shared-account#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "prediction"
      ]
    },
    {
      "identity_key": "hypothesis--supplier",
      "kind": "hypothesis.hypothesis",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The supplier's integration environment was compromised and the shared account replayed from outside.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "hypothesis--supplier#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "hypothesis"
      ]
    },
    {
      "identity_key": "prediction--foreign-asn",
      "kind": "hypothesis.prediction",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "If the supplier was compromised, the VPN session should originate from an autonomous system the supplier does not use.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--foreign-asn#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "prediction"
      ]
    },
    {
      "identity_key": "prediction--no-local-staging",
      "kind": "hypothesis.prediction",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "If the supplier was compromised, no staging artifacts should exist inside the design network.",
          "properties": {
            "status": "open"
          }
        }
      },
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--no-local-staging#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.5,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "prediction"
      ]
    },
    {
      "identity_key": "observation--asn-mismatch",
      "kind": "hypothesis.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The VPN session originated from an autonomous system the supplier has never announced.",
          "properties": {
            "discriminating": true
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--asn-mismatch#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "observation"
      ]
    },
    {
      "identity_key": "observation--no-badge",
      "kind": "hypothesis.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "No badge record and no remote session places any employee at work during the window.",
          "properties": {
            "discriminating": true
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--no-badge#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "observation"
      ]
    },
    {
      "identity_key": "observation--account-shared",
      "kind": "hypothesis.observation",
      "schema_version": "1",
      "content": {
        "format": "text_and_properties",
        "value": {
          "text": "The shared integration service account was used rather than a named account.",
          "properties": {
            "discriminating": false
          }
        }
      },
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--account-shared#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "tags": [
        "exfil",
        "observation"
      ]
    }
  ],
  "relationships": [
    {
      "identity_key": "rel--case-fact--exfil-volume",
      "source_key": "case--exfiltration",
      "target_key": "fact--exfil-volume",
      "kind": "established",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--exfil-volume#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-fact--egress-path",
      "source_key": "case--exfiltration",
      "target_key": "fact--egress-path",
      "kind": "established",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--egress-path#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-fact--credential-used",
      "source_key": "case--exfiltration",
      "target_key": "fact--credential-used",
      "kind": "established",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--credential-used#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-fact--no-alert",
      "source_key": "case--exfiltration",
      "target_key": "fact--no-alert",
      "kind": "established",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--no-alert#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-fact--repo-scope",
      "source_key": "case--exfiltration",
      "target_key": "fact--repo-scope",
      "kind": "established",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "fact--repo-scope#record",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-world--insider",
      "source_key": "case--exfiltration",
      "target_key": "world--insider",
      "kind": "branches_into",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#branch",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-fact--exfil-volume",
      "source_key": "world--insider",
      "target_key": "fact--exfil-volume",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-fact--egress-path",
      "source_key": "world--insider",
      "target_key": "fact--egress-path",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-fact--credential-used",
      "source_key": "world--insider",
      "target_key": "fact--credential-used",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-fact--no-alert",
      "source_key": "world--insider",
      "target_key": "fact--no-alert",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-fact--repo-scope",
      "source_key": "world--insider",
      "target_key": "fact--repo-scope",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--insider#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--case-world--supplier",
      "source_key": "case--exfiltration",
      "target_key": "world--supplier",
      "kind": "branches_into",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#branch",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-fact--exfil-volume",
      "source_key": "world--supplier",
      "target_key": "fact--exfil-volume",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-fact--egress-path",
      "source_key": "world--supplier",
      "target_key": "fact--egress-path",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-fact--credential-used",
      "source_key": "world--supplier",
      "target_key": "fact--credential-used",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-fact--no-alert",
      "source_key": "world--supplier",
      "target_key": "fact--no-alert",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-fact--repo-scope",
      "source_key": "world--supplier",
      "target_key": "fact--repo-scope",
      "kind": "assumes",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "world--supplier#base",
          "observed_at": null
        }
      ],
      "confidence": 1,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-hypothesis--insider",
      "source_key": "world--insider",
      "target_key": "hypothesis--insider",
      "kind": "asserts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "hypothesis--insider#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-prediction--badge",
      "source_key": "world--insider",
      "target_key": "prediction--badge",
      "kind": "predicts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--badge#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-prediction--local-staging",
      "source_key": "world--insider",
      "target_key": "prediction--local-staging",
      "kind": "predicts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--local-staging#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--insider-prediction--shared-account",
      "source_key": "world--insider",
      "target_key": "prediction--shared-account",
      "kind": "predicts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--shared-account#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-hypothesis--supplier",
      "source_key": "world--supplier",
      "target_key": "hypothesis--supplier",
      "kind": "asserts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "hypothesis--supplier#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-prediction--foreign-asn",
      "source_key": "world--supplier",
      "target_key": "prediction--foreign-asn",
      "kind": "predicts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--foreign-asn#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-prediction--no-local-staging",
      "source_key": "world--supplier",
      "target_key": "prediction--no-local-staging",
      "kind": "predicts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--no-local-staging#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--world--supplier-prediction--shared-account",
      "source_key": "world--supplier",
      "target_key": "prediction--shared-account",
      "kind": "predicts",
      "properties": {},
      "provenance": [
        {
          "source_id": "analysis",
          "locator": "prediction--shared-account#statement",
          "observed_at": null
        }
      ],
      "confidence": 0.7,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--confirms-observation--asn-mismatch-prediction--foreign-asn",
      "source_key": "observation--asn-mismatch",
      "target_key": "prediction--foreign-asn",
      "kind": "confirms",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--asn-mismatch#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--refutes-observation--asn-mismatch-prediction--badge",
      "source_key": "observation--asn-mismatch",
      "target_key": "prediction--badge",
      "kind": "refutes",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--asn-mismatch#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--confirms-observation--no-badge-prediction--no-local-staging",
      "source_key": "observation--no-badge",
      "target_key": "prediction--no-local-staging",
      "kind": "confirms",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--no-badge#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--refutes-observation--no-badge-prediction--badge",
      "source_key": "observation--no-badge",
      "target_key": "prediction--badge",
      "kind": "refutes",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--no-badge#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    },
    {
      "identity_key": "rel--confirms-observation--account-shared-prediction--shared-account",
      "source_key": "observation--account-shared",
      "target_key": "prediction--shared-account",
      "kind": "confirms",
      "properties": {},
      "provenance": [
        {
          "source_id": "forensics",
          "locator": "observation--account-shared#record",
          "observed_at": null
        }
      ],
      "confidence": 0.88,
      "valid_from": null,
      "valid_until": null,
      "expires_at": null,
      "lifecycle": "active"
    }
  ]
}