Skip to main content
Every signal Heretic emits belongs to one of four tiers — absolute, composite, conditional, or weak. The tier system exists for a single purpose: to prevent weak evidence from convicting. A signal that merely looks suspicious should never reach the same enforcement outcome as a signal that has no benign explanation. Before you write any enforcement policy against Heretic verdicts, you need to understand what each tier can and cannot prove, and why corroboration across different evidence families is the key to a conclusive ruling.

​
The Four Tiers

​
Absolute

An absolute signal has no plausible benign explanation. The observation it reports is physically or mathematically impossible if the client’s claims are true. A single absolute signal is sufficient to set conclusive: true on its own — no corroboration from another family is required. Absolute signals are rare by design. Heretic only promotes a signal to absolute tier after confirming that the observation cannot occur in any legitimate browser configuration, including unusual but valid hardware, network, or OS setups. Verdict contribution: contradicted + conclusive: true, alone.

​
Composite

A composite signal is strong evidence — it reflects a real contradiction that has no common innocent cause — but it acknowledges that any single measurement could theoretically be wrong due to an exotic configuration, a measurement artifact, or an edge case in the signal’s model. A composite signal is conclusive only when corroborated by at least one other composite signal from a different evidence family. Two composite signals from the same family do not corroborate each other. Verdict contribution: contradicted + conclusive: true, only with cross-family corroboration. Alone, it produces disputed.

​
Conditional

A conditional signal is worth acting on — it is the right basis for a CAPTCHA challenge, a rate-limit, or step-up authentication — but it never contributes to a conclusive ruling, regardless of how many conditional signals fire. Common sources of conditional signals include network conditions that are anomalous but not physically impossible, browser configurations that are rare but legitimate, and behaviors that correlate strongly with automation without being definitive proof. Verdict contribution: disputed. Never conclusive: true.

​
Weak

A weak signal provides context only. It may raise your prior slightly in a manual review, but it should never drive an automated enforcement decision. Weak signals appear in the response under signals with tier: "weak" and are excluded from the verdict calculation entirely. Verdict contribution: none. Context only.

​
The Ruling Algebra at a Glance

​
Why the “Different Family” Corroboration Rule Matters

Requiring corroboration from a different evidence family is not an arbitrary strictness requirement — it closes a specific attack vector. If two composite signals from the same family could combine to produce a conclusive verdict, a single exploit that compromises one layer of the stack (say, a TCP spoofing technique) could trigger multiple signals within transport-stack that all appear independent but share a common cause. The verdict would look corroborated when it is not. By requiring signals from different families — for example, network-geometry and transport-stack — Heretic ensures that a conclusive ruling reflects independent evidence from independent measurement layers. An attacker would need to simultaneously manipulate the network physics layer and the kernel TCP fingerprint layer and produce consistent declared values across all three. That is a substantially harder constraint to satisfy.
This is the same principle that underlies multi-factor authentication. Two factors from the same category (two passwords) are not two factors. Two signals from the same family are not two independent pieces of evidence.
The following table maps each tier to the enforcement actions that are proportionate to its certainty level:
Blocking on conclusive: false is almost always wrong. A disputed verdict means the evidence points in one direction but has not crossed the proof threshold. Acting on it as if it had produces false positives at a rate that will frustrate legitimate users.

​
The Five Heresies

Heretic’s measurement design is governed by five core principles. Principle iv is directly relevant to tier policy:
Weak evidence never convicts.
No accumulation of weak signals — no matter how many fire in a single session — can produce a conclusive: true verdict. This constraint is enforced in the ruling algebra, not left to policy configuration. You cannot override it. The other four principles govern measurement independence, clock assumptions, declared-value trust, and refusal interpretation. They are reflected throughout the evidence family design.

​
Reading Tiers in the API Response

Every signal in the signals array exposes its tier under the tier field:
Use the tier field in your logging pipeline to build dashboards that distinguish conclusive blocks from speculative challenges. Tracking the tier distribution of signals over time helps you calibrate your policy and spot shifts in attack patterns.
For the full list of signals and their tiers, see Evidence Families. For how tiers combine into verdicts, see Understanding Heretic Verdicts.

Related topics

Enforce Traffic Policy Using Heretic Verdicts and SignalsHow Heretic Measures Browser Integrity with PhysicsHeretic Verdicts: Five Outcomes and the Conclusive FlagHeretic Signal Reference: IDs, Evidence Families, and TiersHeretic Pricing: Apostate, Heretic, and Inquisition Tiers