The IR agent that cannot lie about what it found.
Requires every incident-response finding to cite a log entry or artifact, and rejects findings that lack one.