Jon W. Hansen, FCIPS · Procurement Insights | Hansen AI Labs™ · October 2026
When Procurement Insights launched in May 2007, it began with a simple practice: publish once, never edit. Every post is dated and time-stamped, and any change to a published post, however small, records a new date and time. That is why nothing in a post is changed once it is published, not even a spelling error. Nineteen years later, that practice is what makes the archive a contemporaneous record rather than a polished one: anyone can see what was said, and when, before the outcome was known.
Hansen AI Labs™ now applies the same practice to its labs and client research, and adds one thing the blog could never offer on its own: a way to verify work that is not published.
What a fingerprint is
Before a lab’s baseline, a scoring method or a piece of client research is used, it is locked and run through the Secure Hash Algorithm, SHA-256. The result is a 64-character code, a digital fingerprint of the document exactly as it stood.
Three properties make it useful:
- Any change, however small, produces a completely different code. Alter one word, one number or one comma, and the fingerprint no longer matches.
- It works in one direction only. Nothing in the document can be reconstructed from the code, so publishing the fingerprint reveals nothing about the work itself.
- Anyone can check it. SHA-256 is a published standard, used to secure websites, verify software and underpin digital signatures. Free, widely available tools can recalculate a fingerprint in seconds.
Why we use it
The danger in any assessment is that the method quietly moves after the results arrive. It rarely happens on purpose. But when a scoring rule can be adjusted once the scores are known, it becomes easy, even unintentionally, to adjust it until it produces the expected answer.
Scientific research faces the same problem and answers it the same way. Clinical trials register their methods and outcome measures before patients are enrolled, and a growing number of researchers in economics and psychology pre-register their studies in public registries that freeze the plan before any data is collected.
A published fingerprint does the same job. It fixes the method in public before any result is known, and it lets anyone later shown the method confirm that it is the one we committed to.
Posts and private work: two kinds of proof
Blog posts do not need fingerprints. A post is public, so its text is its own evidence: anyone can read what was written and see when it was published, and independent web archives, such as the Internet Archive’s Wayback Machine, keep copies of what a page said on a given day.
Labs and client research are different. A lab’s baseline, a scoring method or a client’s research is not published, so no date stamp or public archive can show what it said before the results came in. A fingerprint closes that gap. Published inside a dated post, it ties the private document to that date: the post proves when, and the fingerprint proves what, without revealing a word of the document itself.
That is why Hansen AI Labs™ uses SHA-256 fingerprints for its labs and client research, and lets its public posts stand on the public record.
Where we use it
- Lab baselines. The Isaias Reverberation Lab’s baseline was fingerprinted when it was locked on 17 October 2026, before any of its expectations could be scored, and the fingerprint is verified before every new entry.
- Methods. The PE Stewardship Scorecard’s method was fingerprinted before any firm was assessed. Version 2, locked on 25 October 2026, carries the fingerprint 74ff21ea714bd365493b2b07cdeafd40f6a6307cf58cdee56ca16e80d120370f.
- Client research. Assessments prepared for clients are fingerprinted before they are released. Once released, they are never edited, so a client can later confirm that the document in hand is exactly the one delivered.
- Changes. When a method needs to change, it becomes a new dated version with its own fingerprint, and the earlier version stays on record unchanged, with its fingerprint, so the history of the method is as visible as the method itself.
The same practice, made checkable
Publish once, never edit, has always asked readers to trust that what they see is what was written. The fingerprint removes the need for trust. It turns a promise into something a reader, a client or a critic can verify for themselves.
That is the purpose behind both. Hansen AI Labs™ is not concerned with being right, nor afraid of getting it wrong and admitting it. The aim is to get it right, and to keep a record that shows, openly and verifiably, how we got there.
“The price of admission to anything extraordinary isn’t talent or capital. It’s a willingness to be publicly bad at something for a while.”
— Shane Parrish, Brain Food
Related reading:
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
A case in point, and in practice
In early 2025, I predicted publicly that 75% of the logos on ProcureTech solution maps would be gone by the end of the year. James Meads disagreed, just as publicly, and put his own number on the record: at most 20 to 25% net consolidation.
When it came time to measure, in February 2026, the problem was plain: the prediction had never defined “gone.” A provider that shuts down, one that is absorbed by an acquirer, and one that is renamed and folded into another product are three different outcomes. So the post that reported the result said so openly, “The problem with the original debate was definitional,” and introduced four observable states: defunct, absorbed, merged or renamed, and still operating independently. Measured that way, 72% of the logos no longer operated independently, and 22% were defunct.
The definition came after the prediction, and the record shows it. That was not a failure of the method. It was the method incomplete, and the gap, acknowledged in public, became the lesson: define the measure before you predict.
That lesson is now the practice. The next test will lock the four-state classification and a publicly published baseline map, fingerprint both, and name the date of measurement before any result is known. Whatever it shows, it will be published as it falls.
We do not strive to be right, and we do not shrink from being wrong. The mandate is to get it right.
Related reading:
Related
Publish Once, Never Edit, and Now You Can Check: Why Hansen AI Labs™ Fingerprints Its Work
Posted on October 25, 2026
0
Jon W. Hansen, FCIPS · Procurement Insights | Hansen AI Labs™ · October 2026
When Procurement Insights launched in May 2007, it began with a simple practice: publish once, never edit. Every post is dated and time-stamped, and any change to a published post, however small, records a new date and time. That is why nothing in a post is changed once it is published, not even a spelling error. Nineteen years later, that practice is what makes the archive a contemporaneous record rather than a polished one: anyone can see what was said, and when, before the outcome was known.
Hansen AI Labs™ now applies the same practice to its labs and client research, and adds one thing the blog could never offer on its own: a way to verify work that is not published.
What a fingerprint is
Before a lab’s baseline, a scoring method or a piece of client research is used, it is locked and run through the Secure Hash Algorithm, SHA-256. The result is a 64-character code, a digital fingerprint of the document exactly as it stood.
Three properties make it useful:
Why we use it
The danger in any assessment is that the method quietly moves after the results arrive. It rarely happens on purpose. But when a scoring rule can be adjusted once the scores are known, it becomes easy, even unintentionally, to adjust it until it produces the expected answer.
Scientific research faces the same problem and answers it the same way. Clinical trials register their methods and outcome measures before patients are enrolled, and a growing number of researchers in economics and psychology pre-register their studies in public registries that freeze the plan before any data is collected.
A published fingerprint does the same job. It fixes the method in public before any result is known, and it lets anyone later shown the method confirm that it is the one we committed to.
Posts and private work: two kinds of proof
Blog posts do not need fingerprints. A post is public, so its text is its own evidence: anyone can read what was written and see when it was published, and independent web archives, such as the Internet Archive’s Wayback Machine, keep copies of what a page said on a given day.
Labs and client research are different. A lab’s baseline, a scoring method or a client’s research is not published, so no date stamp or public archive can show what it said before the results came in. A fingerprint closes that gap. Published inside a dated post, it ties the private document to that date: the post proves when, and the fingerprint proves what, without revealing a word of the document itself.
That is why Hansen AI Labs™ uses SHA-256 fingerprints for its labs and client research, and lets its public posts stand on the public record.
Where we use it
The same practice, made checkable
Publish once, never edit, has always asked readers to trust that what they see is what was written. The fingerprint removes the need for trust. It turns a promise into something a reader, a client or a critic can verify for themselves.
That is the purpose behind both. Hansen AI Labs™ is not concerned with being right, nor afraid of getting it wrong and admitting it. The aim is to get it right, and to keep a record that shows, openly and verifiably, how we got there.
Related reading:
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
A case in point, and in practice
In early 2025, I predicted publicly that 75% of the logos on ProcureTech solution maps would be gone by the end of the year. James Meads disagreed, just as publicly, and put his own number on the record: at most 20 to 25% net consolidation.
When it came time to measure, in February 2026, the problem was plain: the prediction had never defined “gone.” A provider that shuts down, one that is absorbed by an acquirer, and one that is renamed and folded into another product are three different outcomes. So the post that reported the result said so openly, “The problem with the original debate was definitional,” and introduced four observable states: defunct, absorbed, merged or renamed, and still operating independently. Measured that way, 72% of the logos no longer operated independently, and 22% were defunct.
The definition came after the prediction, and the record shows it. That was not a failure of the method. It was the method incomplete, and the gap, acknowledged in public, became the lesson: define the measure before you predict.
That lesson is now the practice. The next test will lock the four-state classification and a publicly published baseline map, fingerprint both, and name the date of measurement before any result is known. Whatever it shows, it will be published as it falls.
We do not strive to be right, and we do not shrink from being wrong. The mandate is to get it right.
Related reading:
Share this:
Like this:
Related