Signed records anyone can check without asking us

Each decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.

Evidence is verified by a portable verifier with no database, no signing key, no network and no product installation on the path. Deliberately altered evidence — an edited amount inside a signed body, a stripped signature, a broken chain link, a checkpoint re-signed by the writer's own key — is refused, and a verifier that cannot run reports an instrument failure rather than a refusal.

Limitation · The verifier was written by the same party as the system it checks. Verifying with it confirms signatures, linkage and key separation; it is not a substitute for an independent implementation of the documented record format.

Evidence records and the checkpoints that attest them are signed by different keys held by different service identities. An attacker holding the record-signing key can rebuild a shorter, internally consistent, correctly signed chain and is still detected, because they cannot mint a checkpoint.

Limitation · Different key ids prove key separation. They are not custody. Custody is a deployment fact, reported only when a custody report measured at the deployment is supplied.

Custody is measured rather than asserted. Permission probes run as each service account and record the actual uid, gid and supplementary groups of every running process. A probe that could not run is reported as an error and fails the report — it is never read as a control that held.

Limitation · This is one host. An attacker with root on that host defeats the separation. Independence means a second administrative domain, which is what external trust checkpoints address and which is not built.

Where evidence protection is required, a failure of the witness that attests the evidence chain blocks new protected dispatch rather than letting execution continue unwitnessed. Reconciling work that may already have had an effect is never blocked, because refusing to reconcile would leave a real-world action in an unknown state to protect a log.

Checkpoints anchored outside the host that produced the evidence, so that completeness can be established against a party the writer does not control.

Limitation · Until this exists, truncation is detectable only up to the newest verified checkpoint, and everything above rests on a single administrative domain.