Trueness.ai enterprise product and UX specification
25 October 2026. Proposed behaviours, screens and data objects, with no visual identity or product implementation. Everyday use leads: Panel, Verdict, Challenge, Talk, Ask the research, Export. Programme calibration, agency permissions and version control support those actions. Companion descriptions: platform, everyday use, model/integration contract.
Customer journey and the six primary actions
A team opens a permitted brand workspace, chooses an audience and submits actual work. It reads generated reactions, a synthesis and a challenge, investigates a reaction or its source evidence, and exports a useful account. The workflow is available to trained brand and agency users without a researcher approving every click. Quantitative claims require a current matching Calibration Record; exploratory use does not inherit population validity.
| Screen/action | What the user does and receives | Required behaviour and edge states |
|---|---|---|
| Panel | Paste text or upload supported creative, email, document or deck; choose audience/market and see generated reactions | Show requested, processed and omitted assets before interpretation; unsupported audio/video/page content cannot silently be “read.” Offer supported extraction or a scoped alternative. Show scope status, cost/entitlement and synthetic labels. Voices are illustrative, not a human sample. |
| Verdict | Read the chair's concise recommendation, disagreements and next action | Separate generated interpretation from measured estimates. Show no-clear-winner and unsupported-use states plainly. A persona's 1–10 reaction is a generated ordinal response, not calibrated confidence or a purchase probability. Only a separately validated aggregate mapping may carry a quantitative claim. |
| Challenge | Inspect a second reading, contradictions, missing evidence and alternative explanation | Link each material objection to a reaction/source or label it hypothetical. Preserve unresolved disagreement. A second provider is a robustness choice, not an independent human validation or majority vote. |
| Talk | Interview one illustrative synthetic character, with persistent context within the permitted thread | Clearly generated answers; no impersonation of a real respondent. New conversational claims do not update a record, source corpus or validated score. Keep alternative explanations and “we do not know” possible. |
| Ask the research | Question the authorised corpus and open cited source passages | Show source/page/date/base and permission. Distinguish direct evidence, inference and generated explanation; answer insufficient-evidence when needed. Retrieval and Panel may disagree; surface the contradiction rather than forcing agreement. |
| Export | Create or share a concise PDF and machine-readable result | Include stimulus manifest, generated labels, Verdict/Challenge, record version/scope/expiry, fresh-human base and limitations. One page may link to a complete evidence appendix; do not shrink away qualifications to fit. Authorise every download and preserve immutable versions. |
First visible response, completed Panel and completed Verdict latency are separately measured. Targets such as a Panel within 60 seconds and Verdict within 120 seconds apply only to an agreed short static input envelope and remain unverified targets. Streaming is not completion. Queue/backpressure and partial processing must be visible. Large decks, new modalities and outages need honest timings rather than silent truncation.
Every new result shows its actual fresh-human base, often zero, separately from the historical validation sample. Historical error intervals are not prediction intervals for every new concept. Example wording: “These concepts are too close to distinguish with the evidence available. No new human responses were collected for this run. Use the reactions to revise them, then test the finalists with people.”
Supporting customer screens
| Screen | Purpose and state |
|---|---|
| Programme home | Brand, market, permitted audiences, upcoming full wave/pulse, record restrictions, next useful action; agency sees only delegated scope |
| Audience and Calibration Record | Population, source scope, tested tasks, human bases, current configuration, failures, restrictions and expiry; twelve displayed voices never imply n=12 validated people |
| Compare | Match versions of the same work under compatible recipe/audience/configuration; mark exploratory comparisons and refuse unsupported numeric claims across markets/scales |
| Human follow-up | Turn a gap into a scoped question, sample, price/currency and date; a suggestion creates a quote request, not a supplier purchase |
| History and decisions | Immutable runs, exports and user decisions; distinguish changed creative from observed downstream outcomes and causal attribution |
| Programme waves | Cell map, first/refresh/pulse type, readiness, field status, record release and next review; no customer access to protected raw holdout answers before release |
| Usefulness | Role/agency activity, repeated use, Panel-to-action, follow-ups, citation coverage, latency, human time and decision outcomes; separate from validity |
| Contract and usage | Included formal studies, interactive allowances, compute ceiling, actual/failed/refunded usage, invoices and changes; retries are not new billable studies |
| Team, agencies and integrations | Brand-controlled grants, roles, expiry, connectors, events and revocation; agency admin cannot grant itself a new brand |
The proposed twelve bounded studies/month must be distinguished contractually from interactive Panel/Talk/retrieval usage. Store both entitlements separately. An annual fee does not imply unlimited unmetered inference; the signed budget and fair-use terms control the available envelope. Do not sell “test as much as you like” without funded limits and tested capacity.
Group, brand and agency access model
The hierarchy is a legal customer/group, one or more separately controlled brand tenants, programme/project spaces and agency sub-tenants with explicit grants. The brand is the authority for its research. A shared agency identity can have memberships in several clients, but its projects, retrieval indexes, caches, outputs and usage remain partitioned by the selected client and grant. A group administrator receives cross-brand access only where the contractual grant permits it; parent hierarchy alone is insufficient.
Brand Owner manages commercial terms, membership, agency delegation and publication permissions. Brand Research Lead proposes protocols and sees released evidence. Agency Administrator manages its own approved roster. Agency Planner runs approved work and shares outputs only within granted projects. Analyst and Viewer have narrower run/read rights. Internal Researcher cannot open sealed targets; Holdout Custodian controls them; Reviewer releases defined evidence after freeze. Support sees metadata by default, with logged, time-limited exceptional access.
Grant attributes: brand/project, agency, named audiences and source collections, actions, record visibility, export/share rights, expiry and delegating owner. Evaluate authorisation on every request, retrieval, background stage, export and connector response. IDs supplied by browsers or assistants never establish tenancy. Recheck grants at job execution and publication. Revocation cancels pending access and invalidates caches and download access; an authorised download already retained by a recipient cannot be recalled by pretending the file disappeared.
Holdout custody uses a separate access domain from ordinary tenant research. Even a brand owner or developer cannot fetch sealed outcomes through an assistant before the agreed freeze. Agency raw-source access and released-record access are independent grants; sharing a record need not reveal licensed transcripts.
Operator screens
| View | Required functions |
|---|---|
| Programme work queue | Stages, wave dependencies, owners, exception reason, deadline and committed hours |
| Capacity and margin | Research leads, external reviewers/custodians, market/language suppliers, pipeline, change reserve and contribution; dates require reservations |
| Enterprise obligations | Executed SOW/MSA/data/security terms, invoice calendar, included revalidation and renewal dates; owner for each commitment |
| Evidence and rights | Source permissions, page lineage, extraction errors, conflicts, market coverage and expiry |
| Wave designer | Cell quotas, 160/240 initial or80/240 refresh splits, boosts, overlap, randomisation, cadence and exact supplier quote |
| Holdout custody | Protected assignments, freeze manifests, access audit, release decisions and consumed-test history |
| Evaluation bench | Deterministic metrics, uncertainty, subgroup/market comparisons, development trials, failures and abstention |
| Record release queue | Reviewer findings, conflict disclosure, supported claims, expiry and release/restriction/rejection |
| Model/change registry | Provider/configuration changes, affected records, fallback, included-scope remediation, new holdout needs and rollback |
| Agency and licence enablement | Grants, training, usage, qualified delivery scope, licensee quality findings and signed-review authority |
| Usefulness and executive read | Adoption and action denominators, time, follow-ups and decision outcomes alongside distinct evidence status |
| Cost/finance close | Inference/failed attempts, research hours, supplier commitment/prepayment, audit WIP, AR, deferred revenue and margin |
| Support/incident/data lifecycle | Severity routing, containment, restore/revocation, export/deletion jobs and retained obligations |
Data objects and relationships
| Object | Essential fields and relationship |
|---|---|
| Organisation, brand, agency, membership, grant | Contracting/group ID; brand boundary; agency identity; role; scoped assets/actions; expiry; delegator; grant version |
| Programme and contract | ACV/currency, annual term, cell matrix, cadence, entitlements, obligations, invoice milestones and licence relationships |
| Wave and cell | Programme/market/language/audience/task, first/refresh/full/pulse, target/actual unique human bases, overlap and supplier status |
| Source and evidence claim | Checksum/version, source/page/date/base, observed/derived/generated type, rights and retention; separate evidence from stimulus uploads |
| Audience and model configuration | Population and exclusions, grounding snapshot, illustrative characters, numerical mapping, provider metadata, prompt/settings/version and parent |
| Protocol, participant split and freeze | Instrument, estimands, thresholds, weights, exclusions, multiplicity, stimulus bank, custodian and hashes; separate protected identity store |
| Calibration Record | Exact evaluated configuration/cell/wave, metrics/uncertainty, failures, review, conflict, allowed uses, expiry and supersession |
| PanelRun | Stimulus manifest, audience/recipe, grant, generated reactions, status, costs, attempts, actual fresh-human base and referenced record |
| Verdict and Challenge | Immutable generated syntheses linked to PanelRun; evidence references, disagreements and unresolved claims; no overwrite of the other |
| TalkThread and ResearchQuestion | Selected illustrative character or authorised corpus snapshot, messages, citations, scope labels and feedback; no automatic promotion to grounding |
| Export | Input versions, grant/recipient, redaction status, expiry, downloadable artefact hash and caveat manifest |
| Decision and follow-up | Action, changed asset/version, human-study request, responsible owner, later outcome/date, attribution limits |
| UsefulnessEvent | Event ID, pseudonymous seat/role, brand/agency/project, action type, run ID, success, timing, declared action, consent/retention; exclude raw prompt text |
| Obligation, ledger and incident | Contract owner, approved spend, costs/receipts, idempotency, actor, audit trail, severity and remedy |
Usefulness metric definitions
- Weekly active seat: unique authorised human account completing a successful primary action that week; exclude operators, demos, tests and bot repeats. Report denominator of invited/eligible seats and role/agency breakdown with small-cell privacy controls.
- Panels per active seat: unique completed PanelRun IDs divided by active seats. Internal retries, previews and failed jobs do not inflate usage.
- Panel-to-action rate: share of completed eligible Panels with a linked change, export or human-follow-up within seven days; count each Panel once and show action categories. Export is an activity proxy, not decision improvement.
- Repeat use: share of first-week active seats returning in a defined later week, with cohort denominator and agency composition.
- Talk/research use: threads/questions started and meaningfully completed; cited-answer coverage and user/source-check feedback separately from answer volume.
- Latency: p50/p95 from accepted complete input to first response, complete Panel and complete Verdict; report queue time and failures, not only successful fast jobs.
- Decisions and outcomes: proportion with a recorded decision and later observation; mark self-report, missing outcomes and observational attribution. Do not infer sales lift from Panel adoption.
- Human workload: researcher, reviewer, support and user minutes per completed outcome, including exceptions and model-change work.
Capture a pre-pilot baseline, register usefulness targets with the buyer and show them separately from statistical release gates. “More panels than last year's agency tests” may be an adoption hypothesis but is not a like-for-like effectiveness measure.
Job lifecycle and change behaviour
Use draft → input check → queued → running → output checks → available for preapproved exploratory interactions. Research record release additionally requires sealed evaluation → reviewer decision → released/restricted/inconclusive/failed. A generated verdict cannot perform that transition. Unsupported predictive requests offer labelled exploration or a human study; confidentiality, forbidden data or broken permissions still block all processing.
Reserve cost/entitlement with stable request and stage idempotency keys; persist successful stages, bill once under contract, and explain cancellation costs. Snapshot configuration and grant versions. A material model change creates new candidates and records; an old label never follows the model automatically. Included-scope remediation follows SOP16.
Pilot acceptance checks to implement
- Two brands, two agencies within one brand and a multi-client agency cannot cross-read sources, embeddings, jobs, caches, exports or MCP results without grants; test guessed IDs and background workers.
- Delegation, expiry and revocation affect browser/API/MCP/download/job paths consistently; agency administrators cannot escalate client scope.
- Developers and ordinary client roles cannot obtain sealed targets through retrieval, tools, logs, caches or exports before freeze.
- Each primary action preserves generated labels, provenance, actual human base and record status. Talk and Challenge cannot create a validated score.
- Partial stimulus processing is explicit; unsupported media is never silently interpreted.
- Retry/cancel/reconnect does not duplicate jobs or charges; a failed stage preserves completed work.
- Model retirement or drift restricts affected claims and preserves historical records; rollout requires review and rollback evidence.
- Usefulness events deduplicate retries and separate human activity from automation; denominators and retention rules are inspectable.
- Keyboard navigation, readable errors, text exports and non-colour status work across all six actions.
- The anchor's agency can retrieve only its authorised records through read-only MCP by M3; latency and usefulness targets are measured under the actual workload.
These are acceptance specifications, not claims of implemented or passed product tests. The financial workbook's eight checks do not test this platform.