Element Types Guide

A quick reference for the four core element types in TEA assurance cases.

Overview

Core Element

Goal Claims

Purpose: The top-level normative claim that directs the entire assurance case and states what you are trying to demonstrate about the system.

Characteristics:

• Normative (states what should be true)
• Usually one per case (unless using module extension)
• Sets the direction for all other elements
• Broad enough to encompass the assurance scope

When to use:

• Starting a new assurance case
• Defining the overall assurance objective
• Establishing what property you’re trying to demonstrate

Property Claims

Purpose: Specific claims about particular properties of the system or project that collectively support the goal claim.

A property claim must be a claim—a statement that asserts something about the system or project that can be either true or false. If a statement cannot be validated against evidence, or if there’s no conceivable way it could be wrong, it’s not a useful property claim.

Characteristics:

• Testable, specific, and defeasible—can be evaluated as true or false based on evidence
• Provide additional specificity for parent goal claims
• Multiple property claims typically support a single goal
• Can be nested (sub-claims supporting parent claims)
• Should be linked directly to evidence that supports them.

When to use:

• Breaking down a goal into specific properties of a system or project
• Making assertions about the system or project that can be validated
• Creating sub-arguments within the case
• Connecting abstract goals to concrete evidence

Strategies

Purpose: Help to make the argument structure explicit and transparent by decomposing the argument into smaller, manageable sub-arguments.

Characteristics:

• Scaffolding that organises the argument structure
• Makes decomposition reasoning explicit
• Helps reviewers understand the argument logic
• Optional—useful for clarity in complex cases, but not required for simple arguments

When to use:

• Breaking down a goal into multiple property claims
• Explaining your decomposition approach
• Organising complex arguments with many claims
• Making the argument logic transparent to reviewers

Evidence

Purpose: Ground claims in verifiable, concrete information that demonstrates why the claim should be believed.

Characteristics:

• Concrete and specific
• Linked to one or more property claims
• Should be accessible and verifiable by reviewers
• Can be of various types (technical, process, stakeholder, standards)

When to use:

• Supporting property claims with concrete data
• Providing verification that claims are true
• Documenting the basis for trust in claims
• Creating an audit trail for reviewers

Evidence types:

Element Attributes

Goal claims, property claims, and strategies can have three types of attributes attached to them: Context, Justifications, and Assumptions. These attributes provide important supporting information that helps reviewers understand and evaluate the argument.

Context

Purpose: Define the specific conditions under which claims are valid. Context is essential—you cannot meaningfully assure a system without specifying the conditions of its use.

Consider: you cannot assure the safety of an aircraft without specifying (a) who is operating it (a qualified pilot vs an untrained person), (b) where it will be flown (regulated airspace vs restricted zones), and (c) under what conditions (fair weather vs extreme storms). The same system can be safe in one context and dangerous in another. Context makes claims evaluable.

Characteristics:

• Essential for meaningful assurance—claims without context cannot be properly evaluated
• Defines the boundaries within which claims hold true
• Specifies who, what, where, when, and under what conditions
• Makes explicit what is excluded from the scope of assurance

When to use:

• Always attach context to your goal claim to frame the entire case
• Add context to specific property claims when they apply under narrower conditions than the parent goal
• Clarify operational constraints, user qualifications, or environmental requirements

Context categories:

Justifications

Purpose: Explain why a particular claim, goal, or strategy is appropriate or relevant to the argument.

Characteristics:

• Provides rationale for including an element in the argument
• Explains the reasoning behind a decomposition strategy
• Helps reviewers understand the logic of the argument structure

When to use:

• Explaining why a particular property claim is relevant to the goal
• Justifying why a specific decomposition strategy was chosen
• Clarifying the rationale for the argument structure

Assumptions

Purpose: Make explicit any assumptions that underpin a claim, goal, or strategy and must hold for the argument to be valid.

Characteristics:

• States conditions that are taken to be true without direct evidence
• Identifies dependencies that could invalidate the argument if violated
• Makes implicit reasoning explicit for reviewers to evaluate

When to use:

• Documenting preconditions that must hold for a claim to be valid
• Identifying external dependencies outside the scope of the assurance case
• Making explicit any simplifications or approximations in the argument

Valid Relationships

Elements can be connected to form argument structures. The following relationships are valid:

Core Element Relationships

Attribute Relationships

Attributes can be attached to goals, property claims, and strategies:

Further Reading

• Detailed tutorial: Pouring Your First Cup of TEA
• Terminology: Glossary