Generative AI is an extraordinary capability multiplier for creative teams. But there is a dangerous category error hiding inside its usefulness.
Ask a model to generate options and you get possibilities. Ask it, “How likely is this outcome?” or “Score these options,” and you get numbers that look like estimates.
The problem is that looking calibrated is not the same as being calibrated.
Yet once that number enters a decision loop, it starts accumulating credibility. It informs a plan. The plan creates a target. The target becomes a benchmark. Soon, an unsupported estimate has been transformed into something the organization treats as evidence.
The model did not earn that credibility. The process laundered it.
That failure mode is why one of Iridae’s requirements from day one has been simple: no black boxes.
If a system is going to influence a decision, we need to be able to inspect where its claims came from and why they deserve to be believed. That forces us to approach auditability differently from most game technology companies.
Two pieces of our technical stack show what that means in practice:
- LineageKit — our internal library for tracing every outcome and decision back to the data that informed it.
- Antecedent — our causal inference library, which we open-sourced so that when our systems claim “X happened because of Y,” the mathematics and methodology behind that claim can be independently inspected and verified.
They solve different problems, but they serve the same principle: a conclusion should never become more credible merely because a system produced it.
LineageKit: what did we know when we decided?
LineageKit is not just an audit log. It keeps two different records of the same history because each answers a different question.
The first records what happened, and in what order. Every asserted fact, registered artifact, lineage edge, and run event is added to an append-only chain whose history cannot be quietly rewritten.
That gives us a trustworthy sequence of events. But sequence alone is not enough.
We also need to answer questions like: What was true at this exact moment? Did two systems have the same state? Was this fact actually available when an inference was made? What changed between one state and another?
Replaying an entire event history every time would be slow and cumbersome. So LineageKit maintains a second record: a deterministic snapshot of the state at a given point in that history (implemented as a history-independent prolly tree).
The distinction is simple:
The log tells us what happened. The snapshot tells us what was true.
And, importantly, the two can check each other.
Normal reads use the snapshot because it is fast. But if we need to verify it, we can replay the underlying history, rebuild the state independently, and confirm that we arrive at exactly the same result. The fast representation never gets to become an unverified second source of truth.
That principle matters to us at Iridae. We do not want the correctness of a decision system to depend on someone trusting that our database is right, that an internal service behaved properly, or that our reconstruction of events is accurate. Where we can make something independently checkable, we do.
It also gives us efficient ways to compare state. If two replicas produce the same state fingerprint, we know they represent the same committed state even if events reached them in a different order. If they differ, LineageKit can locate the divergence without comparing the entire history.
The surrounding databases and lineage graphs are therefore conveniences, not authorities. If one drifts, we rebuild it from the committed record rather than trusting it because it happens to be there.
That is the property we actually need from provenance: not simply a record of what happened, but a way to prove what information was available when a decision was made.
If Latent Spark concludes that two games are related, that conclusion can be traced back to the individual screenshots, reviews, telemetry, or other observations that supported it. When Anchored Horizon constructs a distribution from those relationships, it inherits the same lineage. When Patient Cartographer updates uncertainty from that distribution and Subtle Beacon decides that players should be surveyed on Discord, the recommendation, the uncertainty that motivated it, and the evidence beneath both remain connected.
Everything goes back to first-byte evidence.
So months later, the organization can ask:
“What did we know when we decided to do that?”
And LineageKit can answer from the exact state available at the time, rather than reconstructing a plausible story from whatever happens to be in the database today.
For us, that is a baseline requirement for a system that participates in consequential decisions. If we cannot show what the system knew, we should not ask anyone else to trust what it concluded.
But provenance only gets us so far.
Knowing exactly what evidence informed a decision does not tell us whether the inference drawn from that evidence was justified.
The next question is:
“Why did we believe X caused Y?”
Antecedent: when can we actually say X caused Y?
Causal inference has an uncomfortable property: it is often possible to calculate a very precise answer to a question the data cannot actually answer.
Antecedent is built around preventing that.
Its governing rule is identify before estimate. Before calculating how much X affected Y, Antecedent first establishes whether that effect can be recovered from the evidence and assumptions available. The estimator does not get to choose its own confounders or quietly make the causal problem solvable.
Suppose the evidence supports several plausible explanations of how variables relate. Some would allow us to estimate the effect of X on Y; others would not. A convenient system can pick one structure, estimate against it, and return a clean number.
Antecedent keeps the ambiguity.
It carries uncertainty about the causal structure into the effect itself. If part of the plausible world is one in which the effect cannot be identified, that part does not disappear from the calculation. We do not discard it, renormalize over the convenient remainder, and report a more confident result.
Likewise, a stronger prior or a more sophisticated statistical model cannot turn an unidentified question into an identified one. More certainty inside a set of assumptions is not evidence that those assumptions are justified.
Antecedent applies the same discipline to how the data came to exist. If observations were censored, selected, truncated, drawn from a different population, or affected by interactions between subjects, those conditions are explicit parts of the causal problem. They cannot be silently inferred from the columns in a dataset. If the necessary conditions are not supported, Antecedent can return NotCertified rather than manufacture an estimate.
That discipline persists across the causal analysis. Structure discovered from data does not quietly become ground truth at identification. Identification assumptions do not disappear when estimation begins. And uncertainty established upstream remains attached to interventions, counterfactuals, and attribution downstream.
Moving to the next stage of an analysis does not get to make the previous stage more certain.
The goal is not to make Antecedent reluctant to answer questions. It is to preserve the boundary between:
what the data suggests, what our assumptions allow us to infer, and what we can actually claim caused what.
But there is an obvious problem with telling people that our causal engine behaves this carefully: you would still have to take our word for it.
That is why we open-sourced Antecedent.
“Because the model said so” is not an explanation of causality—unless you have good reason to trust the model. And you cannot meaningfully trust what you cannot inspect.
Antecedent is a public repository on GitHub. The code is there. The mathematics is there. The assumptions are there. A statistician does not have to rely on our description of how an unidentified effect is handled; they can inspect exactly what Antecedent does.
That is the point of open-sourcing it: causal claims should be auditable all the way down to the machinery that produced them.
Auditability is not one thing
LineageKit and Antecedent make two very different things auditable.
LineageKit makes the evidence trail auditable. If a claim has no provenance, that absence is visible immediately. You can ask what was known, when it was known, and exactly what evidence a decision rested on.
Antecedent makes the causal reasoning auditable. It will not certify causality where the evidence and assumptions do not justify it—and that refusal lives in code anyone can inspect.
Different mechanisms. Same purpose.
Iridae should never gain credibility simply because a claim passed through Iridae.
A number does not become calibrated because it appears in a dashboard. A causal story does not become true because it informed a plan. And an uncertain claim should not become more authoritative merely because an organization acted on it.
That is the failure mode we are trying to prevent: epistemic laundering.
For us, “no black boxes” means more than being able to explain what a system did. It means preserving the evidence beneath a claim, preserving the uncertainty around it, and making the machinery that turns one into the other available for scrutiny.
Trust should not be something the system asks for.
It should be something the system makes possible to verify.