Business evidence
- Business objectives and incomplete requirements (expected, not a blocker)
- Workflow narratives, policies, and risk boundaries
- Historical decisions, exceptions, and human judgment records
- Operational context that defines what “allowed” means in your domain