Skip to content
VB-OSVB-OSVB-OS Docs

VBL Evidence Requirements (require_evidence)

Basic Requirement

Section titled “Basic Requirement”

Declare that a field must be present with a non-null value:

require_evidence: transaction_amount
require_evidence: account_balance
require_evidence: risk_score

If any required field is missing from the workload, the evaluation produces DEFER at Stage 1 with failure code F2-004 (ADMISSIBILITY_NOT_SATISFIED).

Conditional Requirements

Section titled “Conditional Requirements”

Require a field only when a condition is true:

require_evidence IF risk_score > 50: enhanced_verification

This means: if risk_score is present and greater than 50, then enhanced_verification must also be present. If risk_score is present and 50 or below, enhanced_verification is not required. If risk_score is absent, the conditional requirement fails closed: the requirement is applied.

If the condition references a field that is itself missing, the conditional requirement fails closed: the requirement is applied. This prevents an attacker from bypassing requirements by omitting the condition field.

Type Declarations

Section titled “Type Declarations”

Validate both presence and type:

require_type: transaction_amount: integer
require_type: currency: string
require_type: is_recurring: boolean

Type declarations are checked in Stage 1 alongside evidence requirements. If the field is present but has the wrong type, the evaluation produces DEFER.

Supported types: integer, string, boolean.

Type declarations are compiler metadata: the cloud platform’s compiler validates them. The binary evaluation engine operates on the compiled version and does not re-parse type declarations.

Multiple Requirements

Section titled “Multiple Requirements”

Each require_evidence line declares one field. List all required fields individually:

require_evidence: field_a
require_evidence: field_b
require_evidence: field_c

Interaction with Other Stages

Section titled “Interaction with Other Stages”

Evidence requirements are checked in Stage 1 before prohibitions (Stage 2) and predicates (Stage 3). If admissibility fails, the pipeline short-circuits. Stages 2 and 3 never run.

This means a workload that is missing required fields will always get a clean F2-004 failure, never a predicate failure. The failure reasons accurately reflect the root cause.

Next Steps

Section titled “Next Steps”